Описание
Security update for java-1_6_0-ibm
This update for java-1_6_0-ibm fixes the following issues:
-
CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
-
CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
-
CVE-2016-9842: zlib: Undefined left shift of negative number
-
CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
-
CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data
-
CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
-
CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
-
CVE-2017-3533: OpenJDK: newline injection in the FTP client
-
CVE-2017-3544: OpenJDK: newline injection in the SMTP client
-
Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183
Список пакетов
SUSE Linux Enterprise Point of Sale 11 SP3
SUSE Linux Enterprise Server 11 SP3-LTSS
SUSE Linux Enterprise Server 11 SP3-TERADATA
Ссылки
- Link for SUSE-SU-2017:1444-1
- E-Mail link for SUSE-SU-2017:1444-1
- SUSE Security Ratings
- SUSE Bug 1027038
- SUSE Bug 1038505
- SUSE CVE CVE-2016-2183 page
- SUSE CVE CVE-2016-9840 page
- SUSE CVE CVE-2016-9841 page
- SUSE CVE CVE-2016-9842 page
- SUSE CVE CVE-2016-9843 page
- SUSE CVE CVE-2017-1289 page
- SUSE CVE CVE-2017-3509 page
- SUSE CVE CVE-2017-3514 page
- SUSE CVE CVE-2017-3533 page
- SUSE CVE CVE-2017-3539 page
- SUSE CVE CVE-2017-3544 page
Описание
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
Затронутые продукты
Ссылки
- CVE-2016-2183
- SUSE Bug 1001912
- SUSE Bug 1024218
- SUSE Bug 1027038
- SUSE Bug 1034689
- SUSE Bug 1056614
- SUSE Bug 1171693
- SUSE Bug 994844
- SUSE Bug 995359
Описание
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Затронутые продукты
Ссылки
- CVE-2016-9840
- SUSE Bug 1003579
- SUSE Bug 1022633
- SUSE Bug 1023215
- SUSE Bug 1038505
- SUSE Bug 1062104
- SUSE Bug 1120866
- SUSE Bug 1123150
- SUSE Bug 1127473
- SUSE Bug 1184301
Описание
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Затронутые продукты
Ссылки
- CVE-2016-9841
- SUSE Bug 1003579
- SUSE Bug 1022633
- SUSE Bug 1038505
- SUSE Bug 1064070
- SUSE Bug 1070162
- SUSE Bug 1120866
- SUSE Bug 1123150
- SUSE Bug 1127473
Описание
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
Затронутые продукты
Ссылки
- CVE-2016-9842
- SUSE Bug 1003580
- SUSE Bug 1022633
- SUSE Bug 1023215
- SUSE Bug 1038505
- SUSE Bug 1062104
- SUSE Bug 1120866
- SUSE Bug 1123150
- SUSE Bug 1127473
- SUSE Bug 1184301
Описание
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
Затронутые продукты
Ссылки
- CVE-2016-9843
- SUSE Bug 1003580
- SUSE Bug 1013882
- SUSE Bug 1038505
- SUSE Bug 1062104
- SUSE Bug 1116686
- SUSE Bug 1120866
- SUSE Bug 1123150
- SUSE Bug 1127473
- SUSE Bug 1184301
Описание
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.
Затронутые продукты
Ссылки
- CVE-2017-1289
- SUSE Bug 1038505
Описание
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
Затронутые продукты
Ссылки
- CVE-2017-3509
- SUSE Bug 1034849
- SUSE Bug 1038505
Описание
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Затронутые продукты
Ссылки
- CVE-2017-3514
- SUSE Bug 1034849
- SUSE Bug 1038505
Описание
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Затронутые продукты
Ссылки
- CVE-2017-3533
- SUSE Bug 1034849
- SUSE Bug 1038505
Описание
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
Затронутые продукты
Ссылки
- CVE-2017-3539
- SUSE Bug 1005522
- SUSE Bug 1034849
- SUSE Bug 1038505
Описание
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Затронутые продукты
Ссылки
- CVE-2017-3544
- SUSE Bug 1034849
- SUSE Bug 1038505