Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Ubuntu :: va2454.htm

openjdk-6 vulnerabilities
openjdk-6 vulnerabilities
openjdk-6 vulnerabilities

Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================Ubuntu Security Notice USN-713-1           January 27, 2009
openjdk-6 vulnerabilities
CVE-2008-5347, CVE-2008-5348, CVE-2008-5349, CVE-2008-5350,
CVE-2008-5351, CVE-2008-5352, CVE-2008-5353, CVE-2008-5354,
CVE-2008-5358, CVE-2008-5359, CVE-2008-5360
A security issue affects the following Ubuntu releases:

Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
  icedtea6-plugin                 6b12-0ubuntu6.1
  openjdk-6-jdk                   6b12-0ubuntu6.1
  openjdk-6-jre                   6b12-0ubuntu6.1
  openjdk-6-jre-headless          6b12-0ubuntu6.1
  openjdk-6-jre-lib               6b12-0ubuntu6.1

After a standard system upgrade you need to restart any Java applications
to effect the necessary changes.

Details follow:

It was discovered that Java did not correctly handle untrusted applets.
If a user were tricked into running a malicious applet, a remote attacker
could gain user privileges, or list directory contents. (CVE-2008-5347,

It was discovered that Kerberos authentication and RSA public key
processing were not correctly handled in Java.  A remote attacker
could exploit these flaws to cause a denial of service. (CVE-2008-5348,

It was discovered that Java accepted UTF-8 encodings that might be
handled incorrectly by certain applications.  A remote attacker could
bypass string filters, possible leading to other exploits. (CVE-2008-5351)

Overflows were discovered in Java JAR processing.  If a user or
automated system were tricked into processing a malicious JAR file,
a remote attacker could crash the application, leading to a denial of
service. (CVE-2008-5352, CVE-2008-5354)

It was discovered that Java calendar objects were not unserialized safely.
If a user or automated system were tricked into processing a specially
crafted calendar object, a remote attacker could execute arbitrary code
with user privileges. (CVE-2008-5353)

It was discovered that the Java image handling code could lead to memory
corruption.  If a user or automated system were tricked into processing
a specially crafted image, a remote attacker could crash the application,
leading to a denial of service. (CVE-2008-5358, CVE-2008-5359)

It was discovered that temporary files created by Java had predictable
names.  If a user or automated system were tricked into processing a
specially crafted JAR file, a remote attacker could overwrite sensitive
information.  (CVE-2008-5360)

Updated packages for Ubuntu 8.10:

  Source archives: 
      Size/MD5:   222090 25681e25a40ae36385d2429e8b905009 
      Size/MD5:     2355 281bc682638116538e829499572e3cde 
      Size/MD5: 54363262 f3aa01206f2192464b998fb7cc550686

  Architecture independent packages: 
      Size/MD5:  8468244 7746db24f22ff25e7655bd9ad73b7077 
      Size/MD5:  4708568 3e9ffbcebcadc431e5c1a21b80e9a9b7 
      Size/MD5: 25619670 4eb18b9cdd11778e80ce6b1ac63c2040 
      Size/MD5: 49156890 044fa2fafc22c35568c01e46f85dbf0a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon): 
      Size/MD5:    81028 8f3c35e45a001a5bb5e7d7231656e206 
      Size/MD5: 47370572 db9493bf071aa08183a7aeef6efc71ea 
      Size/MD5:  2366078 639ac32c62c5b951a77a0a58fcf8ee70 
      Size/MD5:  9942620 ac6600eb8cddc9afd55d37a646ba3a89 
      Size/MD5: 24087518 d9b0e9f7a0f6df9392eed8c67fa77acd 
      Size/MD5:   241532 404e268000d8d15e903f67eb4383146e

  i386 architecture (x86 compatible Intel/AMD): 
      Size/MD5:    71520 9af6963e6ddc977bd05a8dbbe40f1139 
      Size/MD5: 101844924 fcdcbeacbb5f2854f68efa196e6d0ab3 
      Size/MD5:  2348616 6313881219ebbee2ee650685bcb6105f 
      Size/MD5:  9949838 366df23097c855e2d329dec6bf9f9d24 
      Size/MD5: 25169062 1354f7327a8df3422a442f37b357f77a 
      Size/MD5:   230678 59ed425557f18fba815bcbf9b17c6d1d

  lpia architecture (Low Power Intel Architecture): 
      Size/MD5:    72102 c3317b35cd38f7b4ab607bf49331e440 
      Size/MD5: 101930608 292954d99c81b528891824548c6b885e 
      Size/MD5:  2345410 fc2cd7ec4e96749e39307f756231fdc3 
      Size/MD5:  9945176 4a8fb4a2b021f7ce6729dca9b0eef67c 
      Size/MD5: 25192978 cccb11f6580b47ab30c981a0a8cea0f6 
      Size/MD5:   227450 abf58752fcf129175266e60b86857f8c

  powerpc architecture (Apple Macintosh G3/G4/G5): 
      Size/MD5:    77056 790776ea3f41a2392e6c9666402428c0 
      Size/MD5: 35896200 55947cfd47a40e248a626adcb601b4da 
      Size/MD5:  2393068 c475228e916c602eea348b0382f51f21 
      Size/MD5:  8599254 97e338f60e55a488ef0ba06bc23cf414 
      Size/MD5: 22974726 e3bf13b8599a94a0b89f2757a90800f5 
      Size/MD5:   255456 54b666eaaf464931a56406d09cfff088

  sparc architecture (Sun SPARC/UltraSPARC): 
      Size/MD5:    70100 b4addb80ceb8e01dd8819a1bc3b8c89a 
      Size/MD5: 103684964 9f7150e6e1675831b723cdbae5b5c963 
      Size/MD5:  2355110 38f63636383fcb60ba60552ca4e0c60c 
      Size/MD5:  9927636 7c32c7c800f01a2dc1ae878eceade91d 
      Size/MD5: 25175260 a09637fa2629b9ffa58d932078a44d67 
      Size/MD5:   232954 17e8a53c99ea3ac34c0018b2e60a2be8

Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Kees Cook  



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH