Security update for java-1_7_0-openjdk

Announcement ID:	SUSE-SU-2016:0265-1
Rating:	critical
References:	bsc#939523 bsc#960996 bsc#962743
Cross-References:	CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494
CVSS scores:
Affected Products:	SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1

An update that solves nine vulnerabilities can now be installed.

Description:

java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743)

• CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed
• CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996)
• CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays
• CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix
• CVE-2016-0402: Vulnerability in the Networking component related to URL processing
• CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing
• CVE-2016-0466: Vulnerability in the JAXP component, related to limits
• CVE-2016-0483: Vulnerability in the AWT component related to image decoding
• CVE-2016-0494: Vulnerability in 2D component related to font actions

The following bugs were fixed:

• bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move libjavagtk to full package

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP1
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-169=1
• SUSE Linux Enterprise Desktop 12
  zypper in -t patch SUSE-SLE-DESKTOP-12-2016-169=1
• SUSE Linux Enterprise Server 12
  zypper in -t patch SUSE-SLE-SERVER-12-2016-169=1
• SUSE Linux Enterprise Server for SAP Applications 12
  zypper in -t patch SUSE-SLE-SERVER-12-2016-169=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-169=1
• SUSE Linux Enterprise Server 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-169=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
  • java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-debugsource-1.7.0.95-24.2
  • java-1_7_0-openjdk-1.7.0.95-24.2
• SUSE Linux Enterprise Desktop 12 (x86_64)
  • java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-debugsource-1.7.0.95-24.2
  • java-1_7_0-openjdk-1.7.0.95-24.2
• SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64)
  • java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-1.7.0.95-24.2
  • java-1_7_0-openjdk-debugsource-1.7.0.95-24.2
  • java-1_7_0-openjdk-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.2
• SUSE Linux Enterprise Server for SAP Applications 12 (x86_64)
  • java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-1.7.0.95-24.2
  • java-1_7_0-openjdk-debugsource-1.7.0.95-24.2
  • java-1_7_0-openjdk-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.2
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
  • java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-1.7.0.95-24.2
  • java-1_7_0-openjdk-debugsource-1.7.0.95-24.2
  • java-1_7_0-openjdk-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.2
• SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
  • java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-1.7.0.95-24.2
  • java-1_7_0-openjdk-demo-1.7.0.95-24.2
  • java-1_7_0-openjdk-debugsource-1.7.0.95-24.2
  • java-1_7_0-openjdk-1.7.0.95-24.2
  • java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.2

References:

• https://www.suse.com/security/cve/CVE-2015-4871.html
• https://www.suse.com/security/cve/CVE-2015-7575.html
• https://www.suse.com/security/cve/CVE-2015-8126.html
• https://www.suse.com/security/cve/CVE-2015-8472.html
• https://www.suse.com/security/cve/CVE-2016-0402.html
• https://www.suse.com/security/cve/CVE-2016-0448.html
• https://www.suse.com/security/cve/CVE-2016-0466.html
• https://www.suse.com/security/cve/CVE-2016-0483.html
• https://www.suse.com/security/cve/CVE-2016-0494.html
• https://bugzilla.suse.com/show_bug.cgi?id=939523
• https://bugzilla.suse.com/show_bug.cgi?id=960996
• https://bugzilla.suse.com/show_bug.cgi?id=962743