Otkriveno je nekoliko ranjivosti u programskom paketu java-1.5.0-ibm, koje udaljeni zlonamjerni korisnici mogu iskoristiti kako bi narušili povjerljivost, integritet i dostupnost sustava.
Paket: | java-1.5.0-ibm |
Operacijski sustavi: | SUSE Linux Enterprise Desktop 10, SUSE Linux Enterprise Server (SLES) 10, SUSE Linux Enterprise Teradata 10 |
Kritičnost: | 7.6 |
Problem: | pogreška u programskoj komponenti |
Iskorištavanje: | udaljeno |
Posljedica: | izmjena podataka, otkrivanje osjetljivih informacija, uskraćivanje usluga (DoS) |
Rješenje: | programska zakrpa proizvođača |
CVE: | CVE-2011-0865, CVE-2011-0866, CVE-2011-0802, CVE-2011-0786, CVE-2011-0814, CVE-2011-0815, CVE-2011-0862, CVE-2011-0867, CVE-2011-0871, CVE-2011-0872, CVE-2011-0873, CVE-2011-1576 |
Izvorni ID preporuke: | SUSE-SU-2011:0863-1 |
Izvor: | SUSE |
Problem: | |
Ranjivosti su otkrivene u programskim komponentama „Deserialization“, „Java Runtime Environment“, „Deployment“, „Sound“, „AWT“, „2D“, „Networking“, „Swing“ i „NIO“. |
|
Posljedica: | |
Iskorištavanjem neke od navedenih ranjivosti udaljeni napadač može narušiti povjerljivost, integritet i dostupnost sustava. |
|
Rješenje: | |
Kao rješenje problema preporuča se primjena odgovarajuće nadogradnje. |
Izvorni tekst preporuke
SUSE Security Update: Security update for IBM Java
______________________________________________________________________________
Announcement ID: SUSE-SU-2011:0863-1
Rating: important
References: #707244
Affected Products:
SUSE Linux Enterprise Teradata 10 SP3
SUSE Linux Enterprise Server 10 SP4
SUSE Linux Enterprise Server 10 SP3
SUSE Linux Enterprise Java 10 SP4
SUSE Linux Enterprise Java 10 SP3
SUSE Linux Enterprise Desktop 10 SP4
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
IBM Java 1.5.0 SR12 FP5 has been released fixing bugs and
security issues.
Following security issues were fixed:
*
CVE-2011-0865: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, 5.0 Update 29 and earlier, and
1.4.2_31 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect integrity
via unknown vectors related to Deserialization.
*
CVE-2011-0866: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, 5.0 Update 29 and earlier, and
1.4.2_31 and earlier, when running on Windows, allows
remote untrusted Java Web Start applications and untrusted
Java applets to affect confidentiality, integrity, and
availability via unknown vectors related to Java Runtime
Environment.
*
CVE-2011-0802: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, when running on Windows, allows
remote untrusted Java Web Start applications and untrusted
Java applets to affect confidentiality, integrity, and
availability via unknown vectors related to Deployment, a
different vulnerability than CVE-2011-0786.
*
CVE-2011-0814: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, 5.0 Update 29 and earlier, and
1.4.2_31 and earlier allows remote attackers to affect
confidentiality, integrity, and availability via unknown
vectors related to Sound, a different vulnerability than
CVE-2011-0802.
*
CVE-2011-0815: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, 5.0 Update 29 and earlier, and
1.4.2_31 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect
confidentiality, integrity, and availability via unknown
vectors related to AWT.
*
CVE-2011-0862: Multiple unspecified vulnerabilities
in the Java Runtime Environment (JRE) component in Oracle
Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier,
and 1.4.2_31 and earlier allow remote attackers to affect
confidentiality, integrity, and availability via unknown
vectors related to 2D.
*
CVE-2011-0867: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, 5.0 Update 29 and earlier, and
1.4.2_31 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect
confidentiality via unknown vectors related to Networking.
*
CVE-2011-0871: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, 5.0 Update 29 and earlier, and
1.4.2_31 and earlier allows remote untrusted Java Web Start
applications and untrusted Java applets to affect
confidentiality, integrity, and availability via unknown
vectors related to Swing.
*
CVE-2011-0872: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier allows remote attackers to affect
availability via unknown vectors related to NIO.
*
CVE-2011-0873: Unspecified vulnerability in the Java
Runtime Environment (JRE) component in Oracle Java SE 6
Update 25 and earlier, and 5.0 Update 29 and earlier,
allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to
2D.
Indications:
Please install this update.
Package List:
- SUSE Linux Enterprise Teradata 10 SP3 (x86_64):
java-1_5_0-ibm-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-alsa-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-fonts-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64):
java-1_5_0-ibm-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-fonts-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (s390x x86_64):
java-1_5_0-ibm-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-32bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (i586 ppc):
java-1_5_0-ibm-jdbc-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-plugin-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (x86_64):
java-1_5_0-ibm-alsa-32bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (i586):
java-1_5_0-ibm-alsa-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (ppc):
java-1_5_0-ibm-64bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP3 (i586 ppc s390x x86_64):
java-1_5_0-ibm-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-fonts-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP3 (s390x x86_64):
java-1_5_0-ibm-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-32bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP3 (i586 ppc):
java-1_5_0-ibm-jdbc-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-plugin-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP3 (x86_64):
java-1_5_0-ibm-alsa-32bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP3 (i586):
java-1_5_0-ibm-alsa-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Server 10 SP3 (ppc):
java-1_5_0-ibm-64bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Java 10 SP4 (i586 ppc s390x x86_64):
java-1_5_0-ibm-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-fonts-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Java 10 SP4 (ppc):
java-1_5_0-ibm-jdbc-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-plugin-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Java 10 SP3 (i586 ppc s390x):
java-1_5_0-ibm-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-fonts-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Java 10 SP3 (ppc):
java-1_5_0-ibm-jdbc-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-plugin-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64):
java-1_5_0-ibm-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-demo-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-fonts-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-src-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (x86_64):
java-1_5_0-ibm-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-alsa-32bit-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-devel-32bit-1.5.0_sr12.5-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (i586):
java-1_5_0-ibm-alsa-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-jdbc-1.5.0_sr12.5-0.5.1
java-1_5_0-ibm-plugin-1.5.0_sr12.5-0.5.1
References:
https://bugzilla.novell.com/707244
http://download.novell.com/patch/finder/?keywords=2937cbb354c6df7495e14d6572d00c23
http://download.novell.com/patch/finder/?keywords=9f362d0065fd135e7f4ae300527396e5
--
To unsubscribe, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
For additional commands, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
any Linux
operating system.
This update fixes the following security issue:
* A flaw allowed napi_reuse_skb() to be called on VLAN (virtual LAN)
packets. An attacker on the local network could trigger this flaw by
sending specially-crafted packets to a target system, possibly causing a
denial of service. (CVE-2011-1576, Moderate)
Red Hat would like to thank Ryan Sweat for reporting this issue.
This update also fixes the following bugs:
* The LSI SAS2 controller firmware issued an 0x620f fault while performing
I/O operations and with a Task Manager running, causing possible data
corruption. This update corrects this issue. (BZ#710625)
* The crashkernel memory region can overlap the RunTime Abstraction
Services (RTAS) memory region. If the crashkernel memory region was freed,
the RTAS memory region was freed as well and the system would crash. With
this update, the crash_free_reserved_phys_range() function is overridden
and overlaps with the RTAS memory region are checked so that system crashes
no longer occur. (BZ#710626)
* If the microcode module was loaded, saving and restoring a Xen guest
returned a warning message and a backtrace error. With this update,
backtrace errors are no longer returned, and saving and restoring a Xen
guest works as expected. (BZ#710632)
* When the Distributed Lock Manager (DLM) queued three callbacks for a lock
in the following sequence: blocking - completion - blocking, it would
consider the final blocking callback redundant and skip it. Because the
callback was skipped, GFS would not release the lock, causing processes on
other nodes to wait indefinitely for it. With this update, the DLM does not
skip the necessary blocking callback. (BZ#710642)
* The XFRM_SUB_POLICY feature causes all bundles to be at the finest
granularity possible. As a result of the data structure used to implement
this, the system performance would drop considerably. This update disables
a part of XFRM_SUB_POLICY, eliminating the poor performance at the cost of
sub-IP address selection granularity in the policy. (BZ#710645)
* A kernel panic in the mpt2sas driver could occur on an IBM system using a
drive with SMART (Self-Monitoring, Analysis and Reporting Technology)
issues. This was because the driver was sending an SEP request while the
kernel was in the interrupt context, causing the driver to enter the sleep
state. With this update, a fake event is now executed from the interrupt
context, assuring the SEP request is properly issued. (BZ#714189)
Finally, this update provides the following enhancements:
* This update introduces a kernel module option that allows the Flow
Director to be disabled. (BZ#711549)
* This update introduces parallel port printer support for Red Hat
Enterprise Linux 6. (BZ#713825)
* This update restricts access to the /proc/kcore file to ELF headers only.
(BZ#710638)
Users should upgrade to these updated packages, which contain backported
patches to resolve these issues and add these enhancements. The system must
be rebooted for this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
5. Bugs fixed (http://bugzilla.redhat.com/):
695173 - CVE-2011-1576 kernel: net: Fix memory leak/corruption on VLAN
GRO_DROP
710632 - xen microcode WARN on save-restore
710638 - kernel: restrict access to /proc/kcore to just elf headers
[rhel-6.0.z]
710642 - GFS2: inode glock stuck without holder
710645 - Big performance regression found on connect/request/response test
through IPSEC (openswan) transport
713825 - Parallel port issue in RHEL 6.0 server
714189 - System Hang when there is smart error on IBM platform
6. Package List:
Red Hat Enterprise Linux Server (v. 6.0.z):
Source:
kernel-2.6.32-71.34.1.el6.src.rpm
i386:
kernel-2.6.32-71.34.1.el6.i686.rpm
kernel-debug-2.6.32-71.34.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-71.34.1.el6.i686.rpm
kernel-debug-devel-2.6.32-71.34.1.el6.i686.rpm
kernel-debuginfo-2.6.32-71.34.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-71.34.1.el6.i686.rpm
kernel-devel-2.6.32-71.34.1.el6.i686.rpm
kernel-headers-2.6.32-71.34.1.el6.i686.rpm
noarch:
kernel-doc-2.6.32-71.34.1.el6.noarch.rpm
kernel-firmware-2.6.32-71.34.1.el6.noarch.rpm
perf-2.6.32-71.34.1.el6.noarch.rpm
ppc64:
kernel-2.6.32-71.34.1.el6.ppc64.rpm
kernel-bootwrapper-2.6.32-71.34.1.el6.ppc64.rpm
kernel-debug-2.6.32-71.34.1.el6.ppc64.rpm
kernel-debug-debuginfo-2.6.32-71.34.1.el6.ppc64.rpm
kernel-debug-devel-2.6.32-71.34.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-71.34.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-71.34.1.el6.ppc64.rpm
kernel-devel-2.6.32-71.34.1.el6.ppc64.rpm
kernel-headers-2.6.32-71.34.1.el6.ppc64.rpm
s390x:
kernel-2.6.32-71.34.1.el6.s390x.rpm
kernel-debug-2.6.32-71.34.1.el6.s390x.rpm
kernel-debug-debuginfo-2.6.32-71.34.1.el6.s390x.rpm
kernel-debug-devel-2.6.32-71.34.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-71.34.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-71.34.1.el6.s390x.rpm
kernel-devel-2.6.32-71.34.1.el6.s390x.rpm
kernel-headers-2.6.32-71.34.1.el6.s390x.rpm
kernel-kdump-2.6.32-71.34.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-71.34.1.el6.s390x.rpm
kernel-kdump-devel-2.6.32-71.34.1.el6.s390x.rpm
x86_64:
kernel-2.6.32-71.34.1.el6.x86_64.rpm
kernel-debug-2.6.32-71.34.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-71.34.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-71.34.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-71.34.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-71.34.1.el6.x86_64.rpm
kernel-devel-2.6.32-71.34.1.el6.x86_64.rpm
kernel-headers-2.6.32-71.34.1.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-1576.html
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFOOCwPXlSAg2UNWIIRAuBoAJ9vXfMQq8itAFEPwFs17afnKo9lgQCgn5G+
LAKqawnjemBkRPBM9lYRdVM=
=6vdu
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://www.redhat.com/mailman/listinfo/rhsa-announce
Posljednje sigurnosne preporuke