Summary: | <dev-java/sun-{jdk,jre-bin}-1.6.0.43, <app-emulation/emul-linux-x86-java-1.6.0.43, <dev-java/oracle-{jdk,jre}-bin-1.7.0.17: Multiple vulnerabilities (CVE-2013-{0809,1493}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | wyvern5 |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | java, mrueg |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://blogs.oracle.com/security/entry/security_alert_cve_2013_1493 | ||
Whiteboard: | B2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
wyvern5
2013-03-05 00:59:39 UTC
Version bumps are now in tree. The following need to be stabilized on amd64: =app-emulation/emul-linux-x86-java-1.6.0.43 =dev-java/sun-jdk-1.6.0.43 =dev-java/sun-jre-bin-1.6.0.43 The following need to be stabilized on x86: =dev-java/sun-jdk-1.6.0.43 =dev-java/sun-jre-bin-1.6.0.43 =dev-java/oracle-jdk-bin-1.7.0.17 =dev-java/oracle-jre-bin-1.7.0.17 *** Bug 460470 has been marked as a duplicate of this bug. *** amd64 stable x86 stable CVE-2013-1493 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1493): The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013. CVE-2013-0809 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0809): Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493. This issue was resolved and addressed in GLSA 201401-30 at http://security.gentoo.org/glsa/glsa-201401-30.xml by GLSA coordinator Sean Amoss (ackle). |