[SECURITY] [DLA 1339-1] openjdk-7 security update

2018-04-0321:05:12

lists.debian.org

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

Low

EPSS

0.003

Percentile

71.3%

JSON

Package : openjdk-7
Version : 7u171-2.6.13-1~deb7u1
CVE ID : CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602
CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633
CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663
CVE-2018-2677 CVE-2018-2678
Debian Bug : 891330

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in denial of
service, unauthorized access, sandbox bypass or HTTP header injection.

For Debian 7 "Wheezy", these problems have been fixed in version
7u171-2.6.13-1~deb7u1.

We recommend that you upgrade your openjdk-7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8amd64openjdk-7-jdk< 7u171-2.6.13-1~deb8u1openjdk-7-jdk_7u171-2.6.13-1~deb8u1_amd64.deb
Debian9allopenjdk-8< 8u162-b12-1~deb9u1openjdk-8_8u162-b12-1~deb9u1_all.deb
Debian8armelopenjdk-7-jre-headless< 7u171-2.6.13-1~deb8u1openjdk-7-jre-headless_7u171-2.6.13-1~deb8u1_armel.deb
Debian8amd64openjdk-7-jre-headless< 7u171-2.6.13-1~deb8u1openjdk-7-jre-headless_7u171-2.6.13-1~deb8u1_amd64.deb
Debian9arm64openjdk-8-jdk-headless< 8u162-b12-1~deb9u1openjdk-8-jdk-headless_8u162-b12-1~deb9u1_arm64.deb
Debian9amd64openjdk-8-jre-headless< 8u162-b12-1~deb9u1openjdk-8-jre-headless_8u162-b12-1~deb9u1_amd64.deb
Debian9ppc64elopenjdk-8-dbg< 8u162-b12-1~deb9u1openjdk-8-dbg_8u162-b12-1~deb9u1_ppc64el.deb
Debian7armelopenjdk-7-dbg< 7u171-2.6.13-1~deb7u1openjdk-7-dbg_7u171-2.6.13-1~deb7u1_armel.deb
Debian9armelopenjdk-8-jre< 8u162-b12-1~deb9u1openjdk-8-jre_8u162-b12-1~deb9u1_armel.deb
Debian9mipsopenjdk-8-jre< 8u162-b12-1~deb9u1openjdk-8-jre_8u162-b12-1~deb9u1_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	openjdk-7-jdk	< 7u171-2.6.13-1~deb8u1	openjdk-7-jdk_7u171-2.6.13-1~deb8u1_amd64.deb
Debian	9	all	openjdk-8	< 8u162-b12-1~deb9u1	openjdk-8_8u162-b12-1~deb9u1_all.deb
Debian	8	armel	openjdk-7-jre-headless	< 7u171-2.6.13-1~deb8u1	openjdk-7-jre-headless_7u171-2.6.13-1~deb8u1_armel.deb
Debian	8	amd64	openjdk-7-jre-headless	< 7u171-2.6.13-1~deb8u1	openjdk-7-jre-headless_7u171-2.6.13-1~deb8u1_amd64.deb
Debian	9	arm64	openjdk-8-jdk-headless	< 8u162-b12-1~deb9u1	openjdk-8-jdk-headless_8u162-b12-1~deb9u1_arm64.deb
Debian	9	amd64	openjdk-8-jre-headless	< 8u162-b12-1~deb9u1	openjdk-8-jre-headless_8u162-b12-1~deb9u1_amd64.deb
Debian	9	ppc64el	openjdk-8-dbg	< 8u162-b12-1~deb9u1	openjdk-8-dbg_8u162-b12-1~deb9u1_ppc64el.deb
Debian	7	armel	openjdk-7-dbg	< 7u171-2.6.13-1~deb7u1	openjdk-7-dbg_7u171-2.6.13-1~deb7u1_armel.deb
Debian	9	armel	openjdk-8-jre	< 8u162-b12-1~deb9u1	openjdk-8-jre_8u162-b12-1~deb9u1_armel.deb
Debian	9	mips	openjdk-8-jre	< 8u162-b12-1~deb9u1	openjdk-8-jre_8u162-b12-1~deb9u1_mips.deb