Security update for java-1_6_0-ibm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1389-1 Final 1 1 2017-05-23T13:36:48Z current 2017-05-23T13:36:48Z 2017-05-23T13:36:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for java-1_6_0-ibm This update for java-1_6_0-ibm fixes the following issues: - Version update to 6.0-16.45 bsc#1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client - Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Legacy-12-2017-843 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ Link for SUSE-SU-2017:1389-1 https://lists.suse.com/pipermail/sle-security-updates/2017-May/002914.html E-Mail link for SUSE-SU-2017:1389-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027038 SUSE Bug 1027038 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://www.suse.com/security/cve/CVE-2016-2183/ SUSE CVE CVE-2016-2183 page https://www.suse.com/security/cve/CVE-2016-9840/ SUSE CVE CVE-2016-9840 page https://www.suse.com/security/cve/CVE-2016-9841/ SUSE CVE CVE-2016-9841 page https://www.suse.com/security/cve/CVE-2016-9842/ SUSE CVE CVE-2016-9842 page https://www.suse.com/security/cve/CVE-2016-9843/ SUSE CVE CVE-2016-9843 page https://www.suse.com/security/cve/CVE-2017-1289/ SUSE CVE CVE-2017-1289 page https://www.suse.com/security/cve/CVE-2017-3509/ SUSE CVE CVE-2017-3509 page https://www.suse.com/security/cve/CVE-2017-3514/ SUSE CVE CVE-2017-3514 page https://www.suse.com/security/cve/CVE-2017-3533/ SUSE CVE CVE-2017-3533 page https://www.suse.com/security/cve/CVE-2017-3539/ SUSE CVE CVE-2017-3539 page https://www.suse.com/security/cve/CVE-2017-3544/ SUSE CVE CVE-2017-3544 page SUSE Linux Enterprise Module for Legacy 12 java-1_6_0-ibm-1.6.0_sr16.45-49.1 java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 java-1_6_0-ibm-1.6.0_sr16.45-49.1 as a component of SUSE Linux Enterprise Module for Legacy 12 java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 as a component of SUSE Linux Enterprise Module for Legacy 12 java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 as a component of SUSE Linux Enterprise Module for Legacy 12 java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 as a component of SUSE Linux Enterprise Module for Legacy 12 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. CVE-2016-2183 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2016-2183.html CVE-2016-2183 https://bugzilla.suse.com/1001912 SUSE Bug 1001912 https://bugzilla.suse.com/1024218 SUSE Bug 1024218 https://bugzilla.suse.com/1027038 SUSE Bug 1027038 https://bugzilla.suse.com/1034689 SUSE Bug 1034689 https://bugzilla.suse.com/1056614 SUSE Bug 1056614 https://bugzilla.suse.com/1171693 SUSE Bug 1171693 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995359 SUSE Bug 995359 inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9840 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 critical 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2016-9840.html CVE-2016-9840 https://bugzilla.suse.com/1003579 SUSE Bug 1003579 https://bugzilla.suse.com/1022633 SUSE Bug 1022633 https://bugzilla.suse.com/1023215 SUSE Bug 1023215 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1062104 SUSE Bug 1062104 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 https://bugzilla.suse.com/1184301 SUSE Bug 1184301 inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 critical 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2016-9841.html CVE-2016-9841 https://bugzilla.suse.com/1003579 SUSE Bug 1003579 https://bugzilla.suse.com/1022633 SUSE Bug 1022633 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1064070 SUSE Bug 1064070 https://bugzilla.suse.com/1070162 SUSE Bug 1070162 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9842 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 low 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2016-9842.html CVE-2016-9842 https://bugzilla.suse.com/1003580 SUSE Bug 1003580 https://bugzilla.suse.com/1022633 SUSE Bug 1022633 https://bugzilla.suse.com/1023215 SUSE Bug 1023215 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1062104 SUSE Bug 1062104 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 https://bugzilla.suse.com/1184301 SUSE Bug 1184301 The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. CVE-2016-9843 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2016-9843.html CVE-2016-9843 https://bugzilla.suse.com/1003580 SUSE Bug 1003580 https://bugzilla.suse.com/1013882 SUSE Bug 1013882 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1062104 SUSE Bug 1062104 https://bugzilla.suse.com/1116686 SUSE Bug 1116686 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 https://bugzilla.suse.com/1184301 SUSE Bug 1184301 IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150. CVE-2017-1289 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2017-1289.html CVE-2017-1289 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). CVE-2017-3509 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 moderate 4 AV:N/AC:H/Au:N/C:P/I:P/A:N 4 AV:N/AC:H/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2017-3509.html CVE-2017-3509 https://bugzilla.suse.com/1034849 SUSE Bug 1034849 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). CVE-2017-3514 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2017-3514.html CVE-2017-3514 https://bugzilla.suse.com/1034849 SUSE Bug 1034849 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2017-3533 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2017-3533.html CVE-2017-3533 https://bugzilla.suse.com/1034849 SUSE Bug 1034849 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2017-3539 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2017-3539.html CVE-2017-3539 https://bugzilla.suse.com/1005522 SUSE Bug 1005522 https://bugzilla.suse.com/1034849 SUSE Bug 1034849 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2017-3544 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-fonts-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-jdbc-1.6.0_sr16.45-49.1 SUSE Linux Enterprise Module for Legacy 12:java-1_6_0-ibm-plugin-1.6.0_sr16.45-49.1 important 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171389-1/ https://www.suse.com/security/cve/CVE-2017-3544.html CVE-2017-3544 https://bugzilla.suse.com/1034849 SUSE Bug 1034849 https://bugzilla.suse.com/1038505 SUSE Bug 1038505