Summary: | <dev-java/icedtea{-bin}-3.15.0, <dev-java/openjdk{-bin}-8.242{_p08}: Multiple vulnerabilties (CVE-2020-{2583,2590,2593,2601,2604,2659,2654}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Andrew John Hughes <gnu_andrew> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | gyakovlev, java |
Priority: | Normal | Flags: | nattka:
sanity-check-
|
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://mail.openjdk.java.net/pipermail/distro-pkg-dev/2020-January/041998.html | ||
See Also: | https://bugs.gentoo.org/show_bug.cgi?id=717632 | ||
Whiteboard: | B2 [glsa+ cve] | ||
Package list: |
dev-java/icedtea-bin-3.15.0 amd64 arm64 ppc64 x86
|
Runtime testing required: | --- |
Description
Andrew John Hughes
2020-01-21 06:26:18 UTC
* Security fixes - S8225261: Better method resolutions - S8224909, CVE-2020-2583: Unlink Set of LinkedHashSets - S8225279: Better XRender interpolation - S8226352, CVE-2020-2590: Improve Kerberos interop capabilities - S8227758: More valid PKIX processing - S8227816: More Colorful ICC profiles - S8228548, CVE-2020-2593: Normalize normalization for all - S8229951, CVE-2020-2601: Better Ticket Granting Services - S8230279: Improve Pack200 file reading - S8230318: Better trust store usage - S8230967: Improve Registry support of clients - S8231129: More glyph images - S8231139: Improved keystore support - S8231422, CVE-2020-2604: Better serial filter handling - S8231795, CVE-2020-2659: Enhance datagram socket support - S8232419: Improve Registry registration - S8234037, CVE-2020-2654: Improve Object Identifier Processing dev-java/icedtea-3.15.0 imported to ::gentoo, building images for -bin (In reply to Georgy Yakovlev from comment #2) > dev-java/icedtea-3.15.0 imported to ::gentoo, building images for -bin Any updates on this? The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0a99a9ca5278c4af455aed0acca4d5105fa12184 commit 0a99a9ca5278c4af455aed0acca4d5105fa12184 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2020-03-28 04:42:00 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2020-03-28 05:05:00 +0000 dev-java/icedtea-bin: bump to 3.15.0 Bug: https://bugs.gentoo.org/705992 Closes: https://bugs.gentoo.org/612414 Closes: https://bugs.gentoo.org/707552 Package-Manager: Portage-2.3.96, Repoman-2.3.22 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> dev-java/icedtea-bin/Manifest | 14 +++ dev-java/icedtea-bin/icedtea-bin-3.15.0.ebuild | 139 +++++++++++++++++++++++++ 2 files changed, 153 insertions(+) @maintainer(s), please advise if ready for stabilisation, or call yourself. (In reply to Sam James (sam_c) (security padawan) from comment #5) > @maintainer(s), please advise if ready for stabilisation, or call yourself. arches please stabilize icedtea-bin-3.15.0 arm64 stable (updating summary to reflect openjdk{-bin} affected). amd64 stable ppc64 stable x86 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one. cleanup done, no old versions in the tree Resetting sanity check; package list is empty or all packages are done. Unable to check for sanity:
> no match for package: dev-java/icedtea-bin-3.15.0
This issue was resolved and addressed in GLSA 202101-19 at https://security.gentoo.org/glsa/202101-19 by GLSA coordinator Aaron Bauman (b-man). |