Bug 38302 – openjdk-7 (4.0)

Bug 38302 - openjdk-7 (4.0)


Summary:	openjdk-7 (4.0)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.0-2-errata
Assigned To:	Philipp Hahn
QA Contact:	Janek Walkenhorst

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2015-04-20 15:23 CEST by Arvid Requate
Modified:	2015-08-14 10:38 CEST (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:

Flags:	requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2015-04-20 15:23:52 CEST

New security vulnerabilities have been reported in openssl-7.

Specific details are not available:
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Incorrect handling of phantom references (CVE-2015-0460)
Layout engine glyphStorage off-by-one (CVE-2015-0469)
Incorrect permissions check in resource loading (CVE-2015-0477)
RSA implementation hardening (CVE-2015-0478)
Jar directory traversal issues (CVE-2015-0480)
Certificate options parsing uncaught exception (CVE-2015-0488)

Comment 1 Arvid Requate

2015-05-28 13:03:27 CEST

Fixed in upstream Debian package version 7u79-2.5.5-1~deb7u1

Comment 2 Philipp Hahn

2015-07-06 15:38:13 CEST

repo_admin.py -U -p openjdk-7 -d wheezy -r 4.0-0-0 -s errata4.0-2

r14912 | Bug #38302: OpenJDK-7
 Refresh patches

build-package-ng -r 4.0-0-0 -P ucs -s errata4.0-2 --no-pbuilder-update -p openjdk-7

Package: openjdk-7
Version: 7u79-2.5.5-1.14.201507031547
Branch: ucs_4.0-0-errata4.0-2
Scope: errata4.0-2

r61807 | Bug #38302: OpenJDK-7 YAML
 2015-07-06-openjdk-7.yaml

Comment 3 Sönke Schwardt-Krummrich

2015-07-09 01:50:27 CEST

I'm not sure if it's a real problem or just an interims bug:

The installation of univention-ox-meta-singleserver fails if the errata4.0-2 scope is included:

univention-install univention-ox-meta-singleserver univention-ox univention-java openjdk-7-jre openjdk-7-jre-headless
[…]
Die folgenden Pakete haben unerfüllte Abhängigkeiten:
 openjdk-7-jre-headless : Hängt ab von: libnss3 (>= 2:3.17.1) aber 2:3.14.5-1.27.201502031418 soll installiert werden

Comment 4 Philipp Hahn

2015-07-09 22:42:09 CEST

r14943 | Bug #38302: OpenJDK-7
 Fix variable name

Package: openjdk-7
Version: 7u79-2.5.5-1.15.201507090942
Branch: ucs_4.0-0
Scope: errata4.0-2

r62012 | Bug #38302: OpenJDK-7 YAML
 2015-07-06-openjdk-7.yaml

Comment 5 Janek Walkenhorst

2015-07-15 19:39:35 CEST

Tests (amd64): OK
Advisory: OK

Comment 6 Janek Walkenhorst

2015-07-16 16:52:22 CEST

<http://errata.univention.de/ucs/4.0/246.html>

Comment 7 Arvid Requate

2015-08-14 10:38:13 CEST

For the record: This also has been fixed with this update:

* bypass certain Java sandbox restrictions by untrusted Java application or app due to incorrect handling of default methods (CVE-2015-0470)