Skip to content
OpenAdvisories
Critical ELSA-2016-0049 7 CVEs

Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

Published Jan 20, 2016 · Updated Jan 20, 2016

Ecosystem: Oracle Linux

Summary

[1:1.8.0.71-2.b15]
- Add md5sum for previous java.security file so it gets updated.
- Resolves: rhbz#1295753

[1:1.8.0.71-1.b15]
- Restore upstream version of system LCMS patch removed by 'sync with Fedora'
- Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
- Resolves: rhbz#1295753

[1:1.8.0.71-0.b15]
- January 2016 security update to u71b15.
- Improve verbosity and helpfulness of tarball generation script.
- Remove RH1290936 workaround as RHEL does not have the hardened flags nor ARM32.
- Update patch documentation using version originally written for Fedora.
- Drop prelink requirement as we no longer use execstack.
- Drop ifdefbugfix patch as this is fixed upstream.
- Provide optional boostrap build and turn it off by default.
- Turn off additional CFLAGS/LDFLAGS on AArch64 as bootstrapping failed.
- Add patch for size_t formatting on s390 as size_t != intptr_t there.
- Resolves: rhbz#1295753

[1:1.8.0.65-4.b17]
- moved to integration forest
- sync with fedora (all but extracted luas and family)
- Resolves: rhbz#1295753

Fixed packages 14

ReleasePackageFixed in
Oracle Linux · 7 java-1.8.0-openjdk 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-accessibility 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-accessibility-debug 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-debug 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-demo 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-demo-debug 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-devel 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-devel-debug 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-headless 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-headless-debug 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-javadoc 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-javadoc-debug 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-src 1:1.8.0.71-2.b15.el7_2
Oracle Linux · 7 java-1.8.0-openjdk-src-debug 1:1.8.0.71-2.b15.el7_2

Vulnerabilities 7

  • Unscored —
    CVE-2015-7575

    Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x be…

    thunderbird firefox openssl openjdk-7 Debian Ubuntu
  • Unscored —
    CVE-2016-0402

    Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Ja…

    openjdk-7 openjdk-6 Ubuntu
  • Unscored —
    CVE-2016-0448

    Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and J…

    openjdk-7 openjdk-6 Ubuntu
  • Unscored —
    CVE-2016-0466

    Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8…

    openjdk-7 openjdk-6 Ubuntu
  • Unscored —
    CVE-2016-0475

    Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embe…

  • Unscored —
    CVE-2016-0483 EPSS 15%

    Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows re…

    openjdk-7 openjdk-6 Ubuntu
  • Unscored —
    CVE-2016-0494

    Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Ja…

    openjdk-7 openjdk-6 icu icu Debian Ubuntu