Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 201006-18 ] Oracle JRE/JDK: Multiple vulnerabilities
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1471

PostPosted: Fri Jun 04, 2010 5:26 am    Post subject: [ GLSA 201006-18 ] Oracle JRE/JDK: Multiple vulnerabilities Reply with quote

Gentoo Linux Security Advisory

Title: Oracle JRE/JDK: Multiple vulnerabilities (GLSA 201006-18)
Severity: normal
Exploitable: remote
Date: June 04, 2010
Bug(s): #306579, #314531
ID: 201006-18

Synopsis


The Oracle JDK and JRE are vulnerable to multiple unspecified
vulnerabilities.


Background


The Oracle Java Development Kit (JDK) (formerly known as Sun JDK) and
the Oracle Java Runtime Environment (JRE) (formerly known as Sun JRE)
provide the Oracle Java platform (formerly known as Sun Java Platform).


Affected Packages

Package: dev-java/sun-jre-bin
Vulnerable: < 1.6.0.20
Unaffected: >= 1.6.0.20
Architectures: All supported architectures

Package: dev-java/sun-jdk
Vulnerable: < 1.6.0.20
Unaffected: >= 1.6.0.20
Architectures: All supported architectures

Package: app-emulation/emul-linux-x86-java
Vulnerable: < 1.6.0.20
Unaffected: >= 1.6.0.20
Architectures: All supported architectures


Description


Multiple vulnerabilities have been reported in the Oracle Java
implementation. Please review the CVE identifiers referenced below and
the associated Oracle Critical Patch Update Advisory for details.


Impact


A remote attacker could exploit these vulnerabilities to cause
unspecified impact, possibly including remote execution of arbitrary
code.


Workaround


There is no known workaround at this time.


Resolution


All Oracle JRE 1.6.x users should upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-java/sun-jre-bin-1.6.0.20"

All Oracle JDK 1.6.x users should upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-java/sun-jdk-1.6.0.20"

All users of the precompiled 32bit Oracle JRE 1.6.x should upgrade to
the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=app-emulation/emul-linux-x86-java-1.6.0.20"

All Oracle JRE 1.5.x, Oracle JDK 1.5.x, and precompiled 32bit Oracle
JRE 1.5.x users are strongly advised to unmerge Java 1.5:
Code:
# emerge --unmerge =app-emulation/emul-linux-x86-java-1.5*
    # emerge --unmerge =dev-java/sun-jre-bin-1.5*
    # emerge --unmerge =dev-java/sun-jdk-1.5*

Gentoo is ceasing support for the 1.5 generation of the Oracle Java
Platform in accordance with upstream. All 1.5 JRE versions are masked
and will be removed shortly. All 1.5 JDK versions are marked as
"build-only" and will be masked for removal shortly. Users are advised
to change their default user and system Java implementation to an
unaffected version. For example:
Code:
# java-config --set-system-vm sun-jdk-1.6

For more information, please consult the Gentoo Linux Java
documentation.


References

CVE-2009-3555
CVE-2010-0082
CVE-2010-0084
CVE-2010-0085
CVE-2010-0087
CVE-2010-0088
CVE-2010-0089
CVE-2010-0090
CVE-2010-0091
CVE-2010-0092
CVE-2010-0093
CVE-2010-0094
CVE-2010-0095
CVE-2010-0837
CVE-2010-0838
CVE-2010-0839
CVE-2010-0840
CVE-2010-0841
CVE-2010-0842
CVE-2010-0843
CVE-2010-0844
CVE-2010-0845
CVE-2010-0846
CVE-2010-0847
CVE-2010-0848
CVE-2010-0849
CVE-2010-0850
CVE-2010-0886
CVE-2010-0887
Gentoo Linux Java documentation
Oracle Java SE and Java for Business Critical Patch Update Advisory - March 2010


Last edited by GLSA on Mon Jun 10, 2013 4:31 am; edited 1 time in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum