Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0431
SUSE Security Update: Security update for java-1_8_0-ibm
15 February 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: java-1_8_0-ibm
Publisher: SUSE
Operating System: SUSE
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-3289 CVE-2017-3272 CVE-2017-3261
CVE-2017-3259 CVE-2017-3253 CVE-2017-3252
CVE-2017-3241 CVE-2017-3231 CVE-2016-5552
CVE-2016-5549 CVE-2016-5548 CVE-2016-5547
CVE-2016-2183
Reference: ASB-2017.0001
ESB-2017.0409
ESB-2017.0391
ESB-2017.0388
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for java-1_8_0-ibm
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:0460-1
Rating: important
References: #1024218
Cross-References: CVE-2016-2183 CVE-2016-5547 CVE-2016-5548
CVE-2016-5549 CVE-2016-5552 CVE-2017-3231
CVE-2017-3241 CVE-2017-3252 CVE-2017-3253
CVE-2017-3259 CVE-2017-3261 CVE-2017-3272
CVE-2017-3289
Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP2
SUSE Linux Enterprise Software Development Kit 12-SP1
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Server 12-SP1
______________________________________________________________________________
An update that fixes 13 vulnerabilities is now available.
Description:
This update for java-1_8_0-ibm to version 8.0-4.0 fixes a lot of security
issues (bsc#1024218):
Following CVEs are fixed: CVE-2016-5552 CVE-2017-3231 CVE-2017-3241
CVE-2017-3253 CVE-2017-3259 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289
CVE-2016-2183 CVE-2016-5547 CVE-2016-5548 CVE-2016-5549 CVE-2017-3252
More information can be found on:
https://developer.ibm.com/javasdk/support/security-vulnerabilities/
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 12-SP2:
zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-237=1
- SUSE Linux Enterprise Software Development Kit 12-SP1:
zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-237=1
- SUSE Linux Enterprise Server 12-SP2:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-237=1
- SUSE Linux Enterprise Server 12-SP1:
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-237=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64):
java-1_8_0-ibm-devel-1.8.0_sr4.0-23.1
- SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64):
java-1_8_0-ibm-devel-1.8.0_sr4.0-23.1
- SUSE Linux Enterprise Server 12-SP2 (ppc64le x86_64):
java-1_8_0-ibm-1.8.0_sr4.0-23.1
- SUSE Linux Enterprise Server 12-SP2 (x86_64):
java-1_8_0-ibm-alsa-1.8.0_sr4.0-23.1
java-1_8_0-ibm-plugin-1.8.0_sr4.0-23.1
- SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64):
java-1_8_0-ibm-1.8.0_sr4.0-23.1
- SUSE Linux Enterprise Server 12-SP1 (x86_64):
java-1_8_0-ibm-alsa-1.8.0_sr4.0-23.1
java-1_8_0-ibm-plugin-1.8.0_sr4.0-23.1
References:
https://www.suse.com/security/cve/CVE-2016-2183.html
https://www.suse.com/security/cve/CVE-2016-5547.html
https://www.suse.com/security/cve/CVE-2016-5548.html
https://www.suse.com/security/cve/CVE-2016-5549.html
https://www.suse.com/security/cve/CVE-2016-5552.html
https://www.suse.com/security/cve/CVE-2017-3231.html
https://www.suse.com/security/cve/CVE-2017-3241.html
https://www.suse.com/security/cve/CVE-2017-3252.html
https://www.suse.com/security/cve/CVE-2017-3253.html
https://www.suse.com/security/cve/CVE-2017-3259.html
https://www.suse.com/security/cve/CVE-2017-3261.html
https://www.suse.com/security/cve/CVE-2017-3272.html
https://www.suse.com/security/cve/CVE-2017-3289.html
https://bugzilla.suse.com/1024218
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWKOvRYx+lLeg9Ub1AQgNog/+JphqXm1JXCVVF09UJN3YCCNAFVWgpNBR
eG2fSN6Y5070Y9HIAN9++BjTKQFKpwcVGUQ8GZbYradvtVzWmz5q71g70ONmYvMz
QGgO5SoR3sOYNM49+hSlq7/EwhISz1uwrgUEWDGz+Q9lU4DDAu8AbBDAun9j2C58
tob2Pnse08phb3QcYprwdSZTCDuJey8l+qP95OQFCSMz9MbMtAkw2QmV4Xy+8tp1
2IuIYCQ7M4j6HhR7EFJC+Ro2eFEdfNUd/nu5MRW64rxwhPFt4qFqaqUaZzWKUKW5
s+s/JBEOM2htIX38lCgsExWloWbmK5PIyeXxe4FwZ0+sflZAlGo/fjIHtMAvfOe9
PwgS1CpnYmfmhvx3wNfmcMedgxWRKu6kdKeFXSa3OEgo7dGzDbFUp/4xa3qmh3Zi
eH3dyxUpbYx8CEOHkXBGNxc+mhT+Fa7jdI73wrNAMWWXkiPKdDh6f6aCZogu0B8+
omXEpw/4+ZlNjfkXhuc95YJLlXQRy8urxmBBECk6v3Ce3SUs178aepCIfjoIteVF
R/yIqzPQ7XcDZLDIhAZIU5ky0gq31lqtsxxaAQJ0ZWKvnqSOQLASxMfH38SRQ/uL
hHBjFICp2AL8E8cZWhOixSPGPJupg+4gVUPk+YdNeM3VRBD2mxAF5Pl4QH9cjrSh
5hJd8AiEsow=
=OckK
-----END PGP SIGNATURE-----