-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2012:150-1 http://www.mandriva.com/security/ _______________________________________________________________________ Package : java-1.6.0-openjdk Date : October 5, 2012 Affected: 2011. _______________________________________________________________________ Problem Description: Multiple security issues were identified and fixed in OpenJDK (icedtea6): Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited. NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities (CVE-2012-0547). Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136 (CVE-2012-1682). The updated packages provides icedtea6-1.11.4 which is not vulnerable to these issues. Update: Packages for Mandriva Linux 2011 is being provided. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0547 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1682 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html _______________________________________________________________________ Updated Packages: Mandriva Linux 2011: 409b2a65b6ac01bf537dc87d6fbe0e00 2011/i586/java-1.6.0-openjdk-1.6.0.0-34.b24.1-mdv2011.0.i586.rpm a3b9c036cb42f052e953fee603849bd5 2011/i586/java-1.6.0-openjdk-demo-1.6.0.0-34.b24.1-mdv2011.0.i586.rpm d975875b84f010da17335be5130a7b39 2011/i586/java-1.6.0-openjdk-devel-1.6.0.0-34.b24.1-mdv2011.0.i586.rpm 51978600272cb7ad001b8fa600bd912d 2011/i586/java-1.6.0-openjdk-javadoc-1.6.0.0-34.b24.1-mdv2011.0.i586.rpm 76f83e5164565cb1ec2b84b6d7e96f5b 2011/i586/java-1.6.0-openjdk-src-1.6.0.0-34.b24.1-mdv2011.0.i586.rpm 8fb9bec13e7faca9afbfa35bfa473de7 2011/SRPMS/java-1.6.0-openjdk-1.6.0.0-34.b24.1.src.rpm Mandriva Linux 2011/X86_64: 30a037bcc4114f8f866d701ed765df9e 2011/x86_64/java-1.6.0-openjdk-1.6.0.0-34.b24.1-mdv2011.0.x86_64.rpm 313653aa95969e3eb0d109c709cfdbf6 2011/x86_64/java-1.6.0-openjdk-demo-1.6.0.0-34.b24.1-mdv2011.0.x86_64.rpm 05ad9762cfc7530fb5925757f515ba97 2011/x86_64/java-1.6.0-openjdk-devel-1.6.0.0-34.b24.1-mdv2011.0.x86_64.rpm c56736754f2ec0be60b8929587d0d1a1 2011/x86_64/java-1.6.0-openjdk-javadoc-1.6.0.0-34.b24.1-mdv2011.0.x86_64.rpm b4c25d4919f099b37cdc6ad5ffc993a4 2011/x86_64/java-1.6.0-openjdk-src-1.6.0.0-34.b24.1-mdv2011.0.x86_64.rpm 8fb9bec13e7faca9afbfa35bfa473de7 2011/SRPMS/java-1.6.0-openjdk-1.6.0.0-34.b24.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFQbs2ymqjQ0CJFipgRAiYKAJwJ0vHw9qGIAftnhgRi6F0fBo5pcACdEDe1 8nLyaEUKimJVHhxnRzaMQgA= =FRGy -----END PGP SIGNATURE-----