Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0229
openjdk-6 security update
29 February 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openjdk-6
Publisher: Debian
Operating System: Debian GNU/Linux 6
Impact/Access: Access Privileged Data -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Denial of Service -- Remote/Unauthenticated
Unauthorised Access -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2012-0507 CVE-2012-0506 CVE-2012-0505
CVE-2012-0503 CVE-2012-0502 CVE-2012-0501
CVE-2012-0497 CVE-2011-5035 CVE-2011-3563
CVE-2011-3377
Reference: ASB-2012.0024
ASB-2012.0023
ASB-2012.0009
ESB-2012.0171
ESB-2011.1128
Original Bulletin:
http://www.debian.org/security/2012/dsa-2420
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2420-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
February 28, 2012 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : openjdk-6
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-3377 CVE-2011-3563 CVE-2011-5035 CVE-2012-0497
CVE-2012-0501 CVE-2012-0502 CVE-2012-0503 CVE-2012-0505
CVE-2012-0506 CVE-2012-0507
Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform.
CVE-2011-3377
The Iced Tea browser plugin included in the openjdk-6 package
does not properly enforce the Same Origin Policy on web content
served under a domain name which has a common suffix with the
required domain name.
CVE-2011-3563
The Java Sound component did not properly check for array
boundaries. A malicious input or an untrusted Java application
or applet could use this flaw to cause Java Virtual Machine to
crash or disclose portion of its memory.
CVE-2011-5035
The OpenJDK embedded web server did not guard against an
excessive number of a request parameters, leading to a denial
of service vulnerability involving hash collisions.
CVE-2012-0497
It was discovered that Java2D did not properly check graphics
rendering objects before passing them to the native renderer.
This could lead to JVM crash or Java sandbox bypass.
CVE-2012-0501
The ZIP central directory parser used by java.util.zip.ZipFile
entered an infinite recursion in native code when processing a
crafted ZIP file, leading to a denial of service.
CVE-2012-0502
A flaw was found in the AWT KeyboardFocusManager class that
could allow untrusted Java applets to acquire keyboard focus
and possibly steal sensitive information.
CVE-2012-0503
The java.util.TimeZone.setDefault() method lacked a security
manager invocation, allowing an untrusted Java application or
applet to set a new default time zone.
CVE-2012-0505
The Java serialization code leaked references to serialization
exceptions, possibly leaking critical objects to untrusted
code in Java applets and applications.
CVE-2012-0506
It was discovered that CORBA implementation in Java did not
properly protect repository identifiers (that can be obtained
using _ids() method) on certain Corba objects. This could
have been used to perform modification of the data that should
have been immutable.
CVE-2012-0507
The AtomicReferenceArray class implementation did not properly
check if the array is of an expected Object[] type. A
malicious Java application or applet could use this flaw to
cause Java Virtual Machine to crash or bypass Java sandbox
restrictions
For the stable distribution (squeeze), these problems have been fixed in
version 6b18-1.8.13-0+squeeze1.
For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 6b24-1.11.1-1.
We recommend that you upgrade your openjdk-6 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJPTTmbAAoJEL97/wQC1SS+lqwH/1F5hffrk0ciMajdYvUuPgs5
tDeo+Sq6WwZqSYJFYsXDyyxtLProzR9Szi4n0O5942nUqRV6UtzxsvWPoQVm+gVF
c9waYDogwr7X6KNUdhLoWRwR0wZm5lryLPUNPx1AGJd0CstxJJ3cFX243m2F0+03
BuDU4QuwMliS5YpvEJ3JUFA4zZ3ETwa033poeOD9Pkh5Y8wfbaiYM6/0yvI/lIDC
EmszvApi8iM/Q6s5olvFgHpv+J2aiLR6IYmP8wWJLd2vvGpukoix06U/eqF0NirT
ilZaZmw1YGultG34yWP95TaF5+AOYgkm5g80SeHX2B3iL2u1cd1xklo6i2eGVBE=
=jUub
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBT01+xu4yVqjM2NGpAQI/6Q/7Be0JssxtaLgfStRKdjOvD4yJa/PxBm4j
DwO81s88iB5h6fzOuyGpUNH3wZXh5Uc3Pqn5DGlhRS4XS00fCk0xfjLgDdGJWJxj
R1TD4XJem0wM+twESzJDtfD9aIPmJtVaEWvCtXOaZ6lEb2oZxuWybRzXEG7asdSi
l+tXZW7JqafN1cdgx/YneDmRkjnj56dZdCLR1thgxaNIbyfE8vV2qiKQwAvn1joP
Cu4IZQziofmnenFxfD0aSaOV0cQHYj/Dfyn0LTQ2r4340sKaKT9xw7mpgOWJRmVE
HJjjAioSSAcZj64seMbigrGrx6ba9rb9INdR9yZzSJdGnvZ7kZiuLZuIf2ETTlZA
YQsH8jHtIuG0tYvMU4xQvN7nbtD/4Qf33pk5lYHuJgOgz8Axya09AaCY/LbE3SUd
KpDTitLO2dzQhR50bKg6Yds+4HtKK5zjg2m9pxQT+lykYETIPGzx/cd+7s27pswe
Nz4zoLMVpINFvLdLO44ZFzHwE5ddA5EEHFFUUtYURI3lSeW2EMMsjsnRNZ+3MtiR
ucRol3VAZVOWmM9L/xw674K26lVu3XxywBjOtrrTt2Y43tQVWDbDNfvHvqPF5XkE
SS79Z8KzsjWemeNqUA/uIoaV71JDDm1eDSsxkoLLtzPJ1bvVgRv0/FClJ0BccFH/
bmPjjtmBKyw=
=ghE1
-----END PGP SIGNATURE-----