- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201710-31
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: Oracle JDK/JRE: Multiple vulnerabilities
     Date: October 29, 2017
     Bugs: #635030
       ID: 201710-31

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in Oracle's JDK and JRE
software suites, the worst of which can be remotely exploited without
authentication.

Background
==========

Java Platform, Standard Edition (Java SE) lets you develop and deploy
Java applications on desktops and servers, as well as in todayas
demanding embedded environments. Java offers the rich user interface,
performance, versatility, portability, and security that todayas
applications require.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  dev-java/oracle-jdk-bin   < 1.8.0.152-r1         >= 1.8.0.152-r1 
  2  dev-java/oracle-jre-bin   < 1.8.0.152-r1         >= 1.8.0.152-r1 
    -------------------------------------------------------------------
     2 affected packages

Description
===========

Multiple vulnerabilities have been discovered in Oracleas Java  SE.
Please review the referenced CVE identifiers for details.

Impact
======

A remote attacker could cause a Denial of Service condition, modify
arbitrary data, or have numerous other impacts.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Oracle JDK users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot -v ">=dev-java/oracle-jdk-bin-1.8.0.152-r1"

All Oracle JRE users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot -v ">=dev-java/oracle-jre-bin-1.8.0.152-r1"

References
==========

[  1 ] CVE-2017-10274
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10274
[  2 ] CVE-2017-10281
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10281
[  3 ] CVE-2017-10285
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10285
[  4 ] CVE-2017-10293
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10293
[  5 ] CVE-2017-10295
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10295
[  6 ] CVE-2017-10309
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10309
[  7 ] CVE-2017-10345
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10345
[  8 ] CVE-2017-10346
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10346
[  9 ] CVE-2017-10347
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10347
[ 10 ] CVE-2017-10348
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10348
[ 11 ] CVE-2017-10349
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10349
[ 12 ] CVE-2017-10350
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10350
[ 13 ] CVE-2017-10355
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10355
[ 14 ] CVE-2017-10356
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10356
[ 15 ] CVE-2017-10357
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10357
[ 16 ] CVE-2017-10388
       https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10388

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/201710-31

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2017 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5