[SECURITY] [DLA 821-1] openjdk-7 security update

2017-02-1100:38:57

lists.debian.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

8.6 High

AI Score

Confidence

Low

0.054 Low

EPSS

Percentile

93.2%

JSON

Package : openjdk-7
Version : 7u121-2.6.8-2~deb7u1
CVE ID : CVE-2016-5546 CVE-2016-5547 CVE-2016-5548 CVE-2016-5552
CVE-2017-3231 CVE-2017-3241 CVE-2017-3252 CVE-2017-3253
CVE-2017-3260 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in the bypass of
Java sandbox restrictions, denial of service, arbitrary code execution,
incorrect parsing or URLs/LDAP DNs or cryptoraphice timing side channel
attacks.

For Debian 7 "Wheezy", these problems have been fixed in version
7u121-2.6.8-2~deb7u1.

We recommend that you upgrade your openjdk-7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7allopenjdk-7-source< 7u121-2.6.8-2~deb7u1openjdk-7-source_7u121-2.6.8-2~deb7u1_all.deb
Debian7i386icedtea-7-jre-cacao< 7u121-2.6.8-2~deb7u1icedtea-7-jre-cacao_7u121-2.6.8-2~deb7u1_i386.deb
Debian7i386openjdk-7-jre-zero< 7u121-2.6.8-2~deb7u1openjdk-7-jre-zero_7u121-2.6.8-2~deb7u1_i386.deb
Debian8i386openjdk-7-jre-headless< 7u121-2.6.8-2~deb8u1openjdk-7-jre-headless_7u121-2.6.8-2~deb8u1_i386.deb
Debian8powerpcopenjdk-7-dbg< 7u121-2.6.8-2~deb8u1openjdk-7-dbg_7u121-2.6.8-2~deb8u1_powerpc.deb
Debian8mipselopenjdk-7-jre-headless< 7u121-2.6.8-2~deb8u1openjdk-7-jre-headless_7u121-2.6.8-2~deb8u1_mipsel.deb
Debian8mipsopenjdk-7-dbg< 7u121-2.6.8-2~deb8u1openjdk-7-dbg_7u121-2.6.8-2~deb8u1_mips.deb
Debian8kfreebsd-amd64icedtea-7-jre-jamvm< 7u121-2.6.8-2~deb8u1icedtea-7-jre-jamvm_7u121-2.6.8-2~deb8u1_kfreebsd-amd64.deb
Debian7armhficedtea-7-jre-jamvm< 7u121-2.6.8-2~deb7u1icedtea-7-jre-jamvm_7u121-2.6.8-2~deb7u1_armhf.deb
Debian7amd64icedtea-7-jre-cacao< 7u121-2.6.8-2~deb7u1icedtea-7-jre-cacao_7u121-2.6.8-2~deb7u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	openjdk-7-source	< 7u121-2.6.8-2~deb7u1	openjdk-7-source_7u121-2.6.8-2~deb7u1_all.deb
Debian	7	i386	icedtea-7-jre-cacao	< 7u121-2.6.8-2~deb7u1	icedtea-7-jre-cacao_7u121-2.6.8-2~deb7u1_i386.deb
Debian	7	i386	openjdk-7-jre-zero	< 7u121-2.6.8-2~deb7u1	openjdk-7-jre-zero_7u121-2.6.8-2~deb7u1_i386.deb
Debian	8	i386	openjdk-7-jre-headless	< 7u121-2.6.8-2~deb8u1	openjdk-7-jre-headless_7u121-2.6.8-2~deb8u1_i386.deb
Debian	8	powerpc	openjdk-7-dbg	< 7u121-2.6.8-2~deb8u1	openjdk-7-dbg_7u121-2.6.8-2~deb8u1_powerpc.deb
Debian	8	mipsel	openjdk-7-jre-headless	< 7u121-2.6.8-2~deb8u1	openjdk-7-jre-headless_7u121-2.6.8-2~deb8u1_mipsel.deb
Debian	8	mips	openjdk-7-dbg	< 7u121-2.6.8-2~deb8u1	openjdk-7-dbg_7u121-2.6.8-2~deb8u1_mips.deb
Debian	8	kfreebsd-amd64	icedtea-7-jre-jamvm	< 7u121-2.6.8-2~deb8u1	icedtea-7-jre-jamvm_7u121-2.6.8-2~deb8u1_kfreebsd-amd64.deb
Debian	7	armhf	icedtea-7-jre-jamvm	< 7u121-2.6.8-2~deb7u1	icedtea-7-jre-jamvm_7u121-2.6.8-2~deb7u1_armhf.deb
Debian	7	amd64	icedtea-7-jre-cacao	< 7u121-2.6.8-2~deb7u1	icedtea-7-jre-cacao_7u121-2.6.8-2~deb7u1_amd64.deb