Twenty Year Anniversary

Gentoo Linux Security Advisory 201709-22

Gentoo Linux Security Advisory 201709-22
Posted Sep 25, 2017
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201709-22 - Multiple vulnerabilities have been found in Oracle's JRE and JDK software suites, and IcedTea, the worst of which may allow execution of arbitrary code. Versions less than 1.8.0.141 are affected.

tags | advisory, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2017-10053, CVE-2017-10067, CVE-2017-10074, CVE-2017-10078, CVE-2017-10081, CVE-2017-10086, CVE-2017-10087, CVE-2017-10089, CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102, CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109, CVE-2017-10110, CVE-2017-10111, CVE-2017-10114, CVE-2017-10115, CVE-2017-10116, CVE-2017-10117, CVE-2017-10118, CVE-2017-10121, CVE-2017-10125, CVE-2017-10135
MD5 | 702931abb96a5de04ac95434ba1896f0

Gentoo Linux Security Advisory 201709-22

Change Mirror Download
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201709-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Oracle JDK/JRE, IcedTea: Multiple vulnerabilities
Date: September 24, 2017
Bugs: #625602, #626088, #627682
ID: 201709-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in Oracle's JRE and JDK
software suites, and IcedTea, the worst of which may allow execution of
arbitrary code.

Background
==========

Java Platform, Standard Edition (Java SE) lets you develop and deploy
Java applications on desktops and servers, as well as in todayas
demanding embedded environments. Java offers the rich user interface,
performance, versatility, portability, and security that todayas
applications require.

IcedTeaas aim is to provide OpenJDK in a form suitable for easy
configuration, compilation and distribution with the primary goal of
allowing inclusion in GNU/Linux distributions.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-java/oracle-jdk-bin < 1.8.0.141 >= 1.8.0.141
2 dev-java/oracle-jre-bin < 1.8.0.141 >= 1.8.0.141
3 dev-java/icedtea-bin < 3.5.0:8 *>= 3.5.0:8
< 7.2.6.11:7 *>= 7.2.6.11:7
-------------------------------------------------------------------
3 affected packages

Description
===========

Multiple vulnerabilities have been discovered in Oracleas JRE, JDK and
IcedTea. Please review the referenced CVE identifiers for details.

Impact
======

A remote attacker could possibly execute arbitrary code with the
privileges of the process, cause a Denial of Service condition, or gain
access to information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Oracle JDK binary users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot -v ">=dev-java/oracle-jdk-bin-1.8.0.141"

All Oracle JRE binary users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot -v ">=dev-java/oracle-jre-bin-1.8.0.141"

All IcedTea binary 7.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-7.2.6.11"

All IcedTea binary 3.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-3.5.0"

References
==========

[ 1 ] CVE-2017-10053
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10053
[ 2 ] CVE-2017-10067
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10067
[ 3 ] CVE-2017-10074
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10074
[ 4 ] CVE-2017-10078
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10078
[ 5 ] CVE-2017-10081
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10081
[ 6 ] CVE-2017-10086
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10086
[ 7 ] CVE-2017-10087
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10087
[ 8 ] CVE-2017-10089
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10089
[ 9 ] CVE-2017-10090
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10090
[ 10 ] CVE-2017-10096
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10096
[ 11 ] CVE-2017-10101
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10101
[ 12 ] CVE-2017-10102
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10102
[ 13 ] CVE-2017-10105
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10105
[ 14 ] CVE-2017-10107
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10107
[ 15 ] CVE-2017-10108
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10108
[ 16 ] CVE-2017-10109
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10109
[ 17 ] CVE-2017-10110
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10110
[ 18 ] CVE-2017-10111
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10111
[ 19 ] CVE-2017-10114
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10114
[ 20 ] CVE-2017-10115
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10115
[ 21 ] CVE-2017-10116
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10116
[ 22 ] CVE-2017-10117
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10117
[ 23 ] CVE-2017-10118
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10118
[ 24 ] CVE-2017-10121
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10121
[ 25 ] CVE-2017-10125
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10125
[ 26 ] CVE-2017-10135
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10135
[ 27 ] CVE-2017-10176
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10176
[ 28 ] CVE-2017-10193
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10193
[ 29 ] CVE-2017-10198
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10198
[ 30 ] CVE-2017-10243
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10243

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201709-22

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2017 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

April 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    5 Files
  • 2
    Apr 2nd
    17 Files
  • 3
    Apr 3rd
    11 Files
  • 4
    Apr 4th
    21 Files
  • 5
    Apr 5th
    17 Files
  • 6
    Apr 6th
    12 Files
  • 7
    Apr 7th
    1 Files
  • 8
    Apr 8th
    6 Files
  • 9
    Apr 9th
    21 Files
  • 10
    Apr 10th
    18 Files
  • 11
    Apr 11th
    42 Files
  • 12
    Apr 12th
    7 Files
  • 13
    Apr 13th
    14 Files
  • 14
    Apr 14th
    1 Files
  • 15
    Apr 15th
    1 Files
  • 16
    Apr 16th
    15 Files
  • 17
    Apr 17th
    20 Files
  • 18
    Apr 18th
    24 Files
  • 19
    Apr 19th
    20 Files
  • 20
    Apr 20th
    2 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close