Bug 567850 – <dev-java/icedtea{,-bin}-7.2.6.3: Vulnerability (CVE-2015-4871)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description James Le Cuirot 2015-12-09 13:09:19 UTC]

I'm going to bump icedtea and icedtea-bin now. icedtea doesn't get marked stable so the vulnerable versions will be cleared immediately.

[Comment 1 James Le Cuirot 2015-12-09 13:17:29 UTC]

amd64, x86, ppc, and ppc64 arch teams, please stabilise:
dev-java/icedtea-bin-7.2.6.3

ppc64 has never had icedtea-bin:7 before but I wish for this to be stabilised immediately because it's blocking the removal of Java 6, which is next on my list. I haven't yet keyworded plain icedtea for ppc64 because the default HotSpot VM suffers from a race condition, at least on timberdoodle. This icedtea-bin has been built with CACAO instead.

[Comment 2 Agostino Sarubbo 2015-12-09 13:27:39 UTC]

(In reply to James Le Cuirot from comment #1)
> ppc64 has never had icedtea-bin:7 before but I wish for this to be
> stabilised immediately because it's blocking the removal of Java 6

Ok but that's not happen here.

[Comment 3 James Le Cuirot 2015-12-09 13:39:47 UTC]

(In reply to Agostino Sarubbo from comment #2)
> (In reply to James Le Cuirot from comment #1)
> > ppc64 has never had icedtea-bin:7 before but I wish for this to be
> > stabilised immediately because it's blocking the removal of Java 6
> 
> Ok but that's not happen here.

Actually what I said isn't strictly true, it has had 7 since 22nd Nov but so it is affected by this but it's never been stable before. You want me to file another bug?

[Comment 4 Agostino Sarubbo 2015-12-09 14:49:16 UTC]

(In reply to James Le Cuirot from comment #3)
> You want me to file another bug?
Yes

[Comment 5 Yury German 2015-12-11 04:59:04 UTC]

Just to be clear: 
=dev-java/icedtea-bin-7.2.6.3
Target Keywords : "amd64 ppc x86"

[Comment 6 James Le Cuirot 2015-12-11 10:05:48 UTC]

(In reply to Yury German from comment #5)
> Just to be clear: 
> =dev-java/icedtea-bin-7.2.6.3
> Target Keywords : "amd64 ppc x86"

Yes.

[Comment 7 Agostino Sarubbo 2015-12-11 10:40:35 UTC]

amd64 stable

[Comment 8 Agostino Sarubbo 2015-12-11 10:41:21 UTC]

x86 stable

[Comment 9 Agostino Sarubbo 2015-12-26 12:04:35 UTC]

ppc stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 10 James Le Cuirot 2015-12-26 12:15:49 UTC]

Thanks, old removed.

[Comment 11 Yury German 2015-12-30 21:31:43 UTC]

Arches and Maintainer(s), Thank you for your work.

Added to an existing GLSA Request.

[Comment 12 GLSAMaker/CVETool Bot 2016-03-12 23:41:26 UTC]

This issue was resolved and addressed in
 GLSA 201603-14 at https://security.gentoo.org/glsa/201603-14
by GLSA coordinator Kristian Fiskerstrand (K_F).