Bug 578160 – <dev-java/oracle-{jdk, jre}-bin-1.8.0.77: Multiple vulnerabilities (CVE-2016-{0402,0448,0466,0475,0483,0494,0603,0636,3426})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-03-24 09:27:29 UTC]

http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-2949497.html

[Comment 1 James Le Cuirot 2016-03-25 22:37:40 UTC]

Bumped. Fortunately arm(64) shares the same version as the others now. 1.8.0.73 has already been removed since it wasn't stable.

amd64 and x86 teams, please stabilize:
dev-java/oracle-jdk-bin-1.8.0.77
dev-java/oracle-jre-bin-1.8.0.77

[Comment 2 Agostino Sarubbo 2016-03-26 16:02:40 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2016-03-26 16:03:13 UTC]

x86 stable.

Maintainer(s), please cleanup.

[Comment 4 James Le Cuirot 2016-03-26 16:34:28 UTC]

Old removed. Security team, please continue.

[Comment 5 GLSAMaker/CVETool Bot 2016-03-28 10:43:29 UTC]

CVE-2016-0636 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0636):
  Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows
  remote attackers to affect confidentiality, integrity, and availability via
  unknown vectors related to the Hotspot sub-component.

[Comment 6 GLSAMaker/CVETool Bot 2016-07-16 10:25:15 UTC]

CVE-2016-3426 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3426):
  Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77
  allows remote attackers to affect confidentiality via vectors related to
  JCE.

CVE-2016-0603 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0603):
  Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111,
  7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to
  affect confidentiality, integrity, and availability via unknown vectors
  related to Install.  NOTE: the previous information is from Oracle's
  Security Alert for CVE-2016-0603. Oracle has not commented on third-party
  claims that this is an untrusted search path issue that allows local users
  to gain privileges via a Trojan horse dll in the "application directory."

CVE-2016-0494 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0494):
  Unspecified vulnerability in the Java SE and Java SE Embedded components in
  Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote
  attackers to affect confidentiality, integrity, and availability via unknown
  vectors related to 2D.

CVE-2016-0483 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0483):
  Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE
  Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to AWT. 
  NOTE: the previous information is from the January 2016 CPU. Oracle has not
  commented on third-party claims that this is a heap-based buffer overflow in
  the readImage function, which allows remote attackers to execute arbitrary
  code via crafted image data.

CVE-2016-0475 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0475):
  Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit
  components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit
  R28.3.8 allows remote attackers to affect confidentiality and integrity via
  unknown vectors related to Libraries.

CVE-2016-0466 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0466):
  Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit
  components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65;
  and JRockit R28.3.8 allows remote attackers to affect availability via
  vectors related to JAXP.

CVE-2016-0448 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0448):
  Unspecified vulnerability in the Java SE and Java SE Embedded components in
  Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows
  remote authenticated users to affect confidentiality via vectors related to
  JMX.

CVE-2016-0402 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0402):
  Unspecified vulnerability in the Java SE and Java SE Embedded components in
  Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote
  attackers to affect integrity via unknown vectors related to Networking.

[Comment 7 Aaron Bauman (RETIRED) 2016-07-16 10:36:35 UTC]

New GLSA request filed.

[Comment 8 GLSAMaker/CVETool Bot 2016-10-15 12:18:49 UTC]

This issue was resolved and addressed in
 GLSA 201610-08 at https://security.gentoo.org/glsa/201610-08
by GLSA coordinator Aaron Bauman (b-man).