Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 580608

Summary: <dev-java/oracle-{jdk, jre}-bin-1.8.0.91: Multiple vulnerabilities (CVE-2016-{3458,3485,3498,3500,3503,3508,3511,3550,3552,3587,3598,3606,3610})
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: ap, java, wyvern5
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A2 [glsa]
Package list:
Runtime testing required: ---

Comment 1 James Le Cuirot gentoo-dev 2016-04-20 21:41:42 UTC
Versions bumped.

amd64 and x86 teams, please stabilize:
dev-java/oracle-jdk-bin-1.8.0.92
dev-java/oracle-jre-bin-1.8.0.92
Comment 2 Agostino Sarubbo gentoo-dev 2016-04-21 10:21:45 UTC
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-04-21 10:22:19 UTC
x86 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 4 James Le Cuirot gentoo-dev 2016-04-21 20:34:11 UTC
Thanks! Old removed. Security team, please continue.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2016-07-16 11:25:01 UTC
Considering the Java team bumped to 8u92 the relevant pre-release notes are here:

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Pending CVE release and specific security notes.
Comment 6 Aaron Bauman (RETIRED) gentoo-dev 2016-07-16 11:45:21 UTC
Added to existing GLSA.
Comment 7 Patrice Clement gentoo-dev 2016-07-16 12:59:10 UTC
commit c92d046e02e6c85128a57580293a7e97f6b3534e (HEAD -> master, origin/master, origin/HEAD)
Author:     Patrice Clement <monsieurp@gentoo.org>
AuthorDate: Sat Jul 16 12:48:59 2016 +0200
Commit:     Patrice Clement <monsieurp@gentoo.org>
CommitDate: Sat Jul 16 14:57:16 2016 +0200

dev-java/oracle-jdk-bin: Clean up vulnerable version.

Gentoo-Bug: https://bugs.gentoo.org/580608

Package-Manager: portage-2.2.28

dev-java/oracle-jdk-bin/Manifest                   |   4 -
.../oracle-jdk-bin/oracle-jdk-bin-1.8.0.91.ebuild  | 366 ---------------------
2 files changed, 370 deletions(-)
delete mode 100644 dev-java/oracle-jdk-bin/oracle-jdk-bin-1.8.0.91.ebuild

Security team, please proceed.
Comment 8 James Le Cuirot gentoo-dev 2016-07-26 21:40:55 UTC
(In reply to Patrice Clement from comment #7)
> delete mode 100644 dev-java/oracle-jdk-bin/oracle-jdk-bin-1.8.0.91.ebuild

Gaah. This version was not known vulnerable at the time you deleted it (though it is now) and you deleted the only arm(64) version. Granted the title of this bug report was wrong but you should at least note that two architectures are being dropped.

Does the GLSA need to be amended? I can't find one for this version.
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2016-10-15 12:18:57 UTC
This issue was resolved and addressed in
 GLSA 201610-08 at https://security.gentoo.org/glsa/201610-08
by GLSA coordinator Aaron Bauman (b-man).