Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 578160 (CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0475, CVE-2016-0483, CVE-2016-0494, CVE-2016-0603, CVE-2016-0636, CVE-2016-3426) - <dev-java/oracle-{jdk, jre}-bin-1.8.0.77: Multiple vulnerabilities (CVE-2016-{0402,0448,0466,0475,0483,0494,0603,0636,3426})
Summary: <dev-java/oracle-{jdk, jre}-bin-1.8.0.77: Multiple vulnerabilities (CVE-2016-...
Status: RESOLVED FIXED
Alias: CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0475, CVE-2016-0483, CVE-2016-0494, CVE-2016-0603, CVE-2016-0636, CVE-2016-3426
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-24 09:27 UTC by Agostino Sarubbo
Modified: 2016-10-15 12:18 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 James Le Cuirot gentoo-dev 2016-03-25 22:37:40 UTC
Bumped. Fortunately arm(64) shares the same version as the others now. 1.8.0.73 has already been removed since it wasn't stable.

amd64 and x86 teams, please stabilize:
dev-java/oracle-jdk-bin-1.8.0.77
dev-java/oracle-jre-bin-1.8.0.77
Comment 2 Agostino Sarubbo gentoo-dev 2016-03-26 16:02:40 UTC
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-03-26 16:03:13 UTC
x86 stable.

Maintainer(s), please cleanup.
Comment 4 James Le Cuirot gentoo-dev 2016-03-26 16:34:28 UTC
Old removed. Security team, please continue.
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2016-03-28 10:43:29 UTC
CVE-2016-0636 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0636):
  Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows
  remote attackers to affect confidentiality, integrity, and availability via
  unknown vectors related to the Hotspot sub-component.
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2016-07-16 10:25:15 UTC
CVE-2016-3426 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3426):
  Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77
  allows remote attackers to affect confidentiality via vectors related to
  JCE.

CVE-2016-0603 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0603):
  Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111,
  7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to
  affect confidentiality, integrity, and availability via unknown vectors
  related to Install.  NOTE: the previous information is from Oracle's
  Security Alert for CVE-2016-0603. Oracle has not commented on third-party
  claims that this is an untrusted search path issue that allows local users
  to gain privileges via a Trojan horse dll in the "application directory."

CVE-2016-0494 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0494):
  Unspecified vulnerability in the Java SE and Java SE Embedded components in
  Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote
  attackers to affect confidentiality, integrity, and availability via unknown
  vectors related to 2D.

CVE-2016-0483 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0483):
  Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE
  Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to AWT. 
  NOTE: the previous information is from the January 2016 CPU. Oracle has not
  commented on third-party claims that this is a heap-based buffer overflow in
  the readImage function, which allows remote attackers to execute arbitrary
  code via crafted image data.

CVE-2016-0475 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0475):
  Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit
  components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit
  R28.3.8 allows remote attackers to affect confidentiality and integrity via
  unknown vectors related to Libraries.

CVE-2016-0466 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0466):
  Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit
  components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65;
  and JRockit R28.3.8 allows remote attackers to affect availability via
  vectors related to JAXP.

CVE-2016-0448 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0448):
  Unspecified vulnerability in the Java SE and Java SE Embedded components in
  Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows
  remote authenticated users to affect confidentiality via vectors related to
  JMX.

CVE-2016-0402 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0402):
  Unspecified vulnerability in the Java SE and Java SE Embedded components in
  Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote
  attackers to affect integrity via unknown vectors related to Networking.
Comment 7 Aaron Bauman (RETIRED) gentoo-dev 2016-07-16 10:36:35 UTC
New GLSA request filed.
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2016-10-15 12:18:49 UTC
This issue was resolved and addressed in
 GLSA 201610-08 at https://security.gentoo.org/glsa/201610-08
by GLSA coordinator Aaron Bauman (b-man).