Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 580608 - <dev-java/oracle-{jdk, jre}-bin-1.8.0.91: Multiple vulnerabilities (CVE-2016-{3458,3485,3498,3500,3503,3508,3511,3550,3552,3587,3598,3606,3610})
Summary: <dev-java/oracle-{jdk, jre}-bin-1.8.0.91: Multiple vulnerabilities (CVE-2016-...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-04-20 09:23 UTC by Agostino Sarubbo
Modified: 2016-10-15 12:18 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 James Le Cuirot gentoo-dev 2016-04-20 21:41:42 UTC 
Versions bumped.

amd64 and x86 teams, please stabilize:
dev-java/oracle-jdk-bin-1.8.0.92
dev-java/oracle-jre-bin-1.8.0.92
Comment 2 Agostino Sarubbo gentoo-dev 2016-04-21 10:21:45 UTC 
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-04-21 10:22:19 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 4 James Le Cuirot gentoo-dev 2016-04-21 20:34:11 UTC 
Thanks! Old removed. Security team, please continue.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2016-07-16 11:25:01 UTC 
Considering the Java team bumped to 8u92 the relevant pre-release notes are here:

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Pending CVE release and specific security notes.
Comment 6 Aaron Bauman (RETIRED) gentoo-dev 2016-07-16 11:45:21 UTC 
Added to existing GLSA.
Comment 7 Patrice Clement (RETIRED) gentoo-dev 2016-07-16 12:59:10 UTC 
commit c92d046e02e6c85128a57580293a7e97f6b3534e (HEAD -> master, origin/master, origin/HEAD)
Author:     Patrice Clement <monsieurp@gentoo.org>
AuthorDate: Sat Jul 16 12:48:59 2016 +0200
Commit:     Patrice Clement <monsieurp@gentoo.org>
CommitDate: Sat Jul 16 14:57:16 2016 +0200

dev-java/oracle-jdk-bin: Clean up vulnerable version.

Gentoo-Bug: https://bugs.gentoo.org/580608

Package-Manager: portage-2.2.28

dev-java/oracle-jdk-bin/Manifest                   |   4 -
.../oracle-jdk-bin/oracle-jdk-bin-1.8.0.91.ebuild  | 366 ---------------------
2 files changed, 370 deletions(-)
delete mode 100644 dev-java/oracle-jdk-bin/oracle-jdk-bin-1.8.0.91.ebuild

Security team, please proceed.
Comment 8 James Le Cuirot gentoo-dev 2016-07-26 21:40:55 UTC 
(In reply to Patrice Clement from comment #7)
> delete mode 100644 dev-java/oracle-jdk-bin/oracle-jdk-bin-1.8.0.91.ebuild

Gaah. This version was not known vulnerable at the time you deleted it (though it is now) and you deleted the only arm(64) version. Granted the title of this bug report was wrong but you should at least note that two architectures are being dropped.

Does the GLSA need to be amended? I can't find one for this version.
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2016-10-15 12:18:57 UTC 
This issue was resolved and addressed in
 GLSA 201610-08 at https://security.gentoo.org/glsa/201610-08
by GLSA coordinator Aaron Bauman (b-man).