what you don't know can hurt you

Mandriva Linux Security Advisory 2014-141

Mandriva Linux Security Advisory 2014-141
Posted Jul 30, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-141 - It was discovered that the Hotspot component in OpenJDK did not properly verify bytecode from the class files. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. A format string flaw was discovered in the Hotspot component event logger in OpenJDK. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine or, potentially, execute arbitrary code with the privileges of the Java Virtual Machine. Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions ,. Multiple flaws were discovered in the JMX, Libraries, Security, and Serviceability components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. It was discovered that the RSA algorithm in the Security component in OpenJDK did not sufficiently perform blinding while performing operations that were using private keys. An attacker able to measure timing differences of those operations could possibly leak information about the used keys. The Diffie-Hellman key exchange algorithm implementation in the Security component in OpenJDK failed to validate public DH parameters properly. This could cause OpenJDK to accept and use weak parameters, allowing an attacker to recover the negotiated key. This update is based on IcedTea version 2.5.1, which fixes these issues, as well as several others.

tags | advisory, java, arbitrary
systems | linux, mandriva
advisories | CVE-2014-2483, CVE-2014-2490, CVE-2014-4209, CVE-2014-4216, CVE-2014-4218, CVE-2014-4219, CVE-2014-4221, CVE-2014-4223, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4266
MD5 | 9f3a0a0629308fe4407de93cce2bb1d2

Mandriva Linux Security Advisory 2014-141

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:141
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : java-1.7.0-openjdk
Date : July 29, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated java-1.7.0-openjdk packages fix security vulnerabilities:

It was discovered that the Hotspot component in OpenJDK did not
properly verify bytecode from the class files. An untrusted Java
application or applet could possibly use these flaws to bypass Java
sandbox restrictions (CVE-2014-4216, CVE-2014-4219).

A format string flaw was discovered in the Hotspot component event
logger in OpenJDK. An untrusted Java application or applet could
use this flaw to crash the Java Virtual Machine or, potentially,
execute arbitrary code with the privileges of the Java Virtual Machine
(CVE-2014-2490).

Multiple improper permission check issues were discovered in the
Libraries component in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions
(CVE-2014-4223, CVE-2014-4262, CVE-2014-2483).

Multiple flaws were discovered in the JMX, Libraries, Security,
and Serviceability components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221,
CVE-2014-4252, CVE-2014-4266).

It was discovered that the RSA algorithm in the Security component
in OpenJDK did not sufficiently perform blinding while performing
operations that were using private keys. An attacker able to measure
timing differences of those operations could possibly leak information
about the used keys (CVE-2014-4244).

The Diffie-Hellman (DH) key exchange algorithm implementation in the
Security component in OpenJDK failed to validate public DH parameters
properly. This could cause OpenJDK to accept and use weak parameters,
allowing an attacker to recover the negotiated key (CVE-2014-4263).

This update is based on IcedTea version 2.5.1, which fixes these
issues, as well as several others.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
http://advisories.mageia.org/MGASA-2014-0292.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
6f3a09b012ab13f78c5c086dc13323dd mbs1/x86_64/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
bbc4a8e6155b94f75e5a68d72fd71cc4 mbs1/x86_64/java-1.7.0-openjdk-accessibility-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
249305659b449fd4bd313dc1467ed160 mbs1/x86_64/java-1.7.0-openjdk-demo-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
dd6ee50fb77c81d049aca83c043903c6 mbs1/x86_64/java-1.7.0-openjdk-devel-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
2dbbff1346376ce35aa19026168c282e mbs1/x86_64/java-1.7.0-openjdk-headless-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
c66fed21595279f83d2b79580db1971d mbs1/x86_64/java-1.7.0-openjdk-javadoc-1.7.0.65-2.5.1.1.mbs1.noarch.rpm
4253ce0bc28cb2fa057585ac3cf18aa8 mbs1/x86_64/java-1.7.0-openjdk-src-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
8938dc4f0a7b5d7c67eb16f968c7a137 mbs1/SRPMS/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFT17MJmqjQ0CJFipgRAo7RAKDRZYNj2a+GH6nyVnptjezozNLtZACfTT57
+jUAtHgs8GAqNujSkLlmZSY=
=DvBa
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

August 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    1 Files
  • 2
    Aug 2nd
    7 Files
  • 3
    Aug 3rd
    5 Files
  • 4
    Aug 4th
    7 Files
  • 5
    Aug 5th
    7 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close