Home / mailings [gentoo-announce] [ GLSA 201711-14 ] IcedTea: Multiple vulnerabilities
Posted on 19 November 2017
Gentoo-announce--=-MeuUbK3M22xgf07dOU26
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2==A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0==C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0GLSA 201711-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2==A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0==C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2==A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
=C2=A0Severity: Normal
=C2=A0=C2=A0=C2=A0=C2=A0Title: IcedTea: Multiple vulnerabilities
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Date: November 19, 2017
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Bugs: #636522
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0ID: 201711-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in IcedTea, the worst of which
may allow execution of arbitrary code.
Background
==========
IcedTea=E2=80=99s aim is to provide OpenJDK in a form suitable for easy
configuration, compilation and distribution with the primary goal of
allowing inclusion in GNU/Linux distributions.
Affected packages
=================
=C2=A0=C2=A0=C2=A0=C2=A0---------------------------------------------------=----------------
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Package=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0==C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/=C2=A0=C2=A0=C2=A0=C2=A0==C2=A0Vulnerable=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/=C2=A0=C2=A0=C2=A0=C2=A0=C2==A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Unaffected
=C2=A0=C2=A0=C2=A0=C2=A0---------------------------------------------------=----------------
=C2=A0 1=C2=A0=C2=A0dev-java/icedtea-bin=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2==A0=C2=A0=C2=A0=C2=A0< 3.6.0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2==A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=>= 3.6.0=C2=A0
Description
===========
Multiple vulnerabilities have been discovered in IcedTea. Please review
the referenced CVE identifiers for details.
Impact
======
A remote attacker could possibly execute arbitrary code with the
privileges of the process, cause a Denial of Service condition, or gain
access to information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All IcedTea binary users should upgrade to the latest version:
=C2=A0 # emerge --sync
=C2=A0 # emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-3.6.0"
References
==========
[=C2=A0=C2=A01 ] CVE-2017-10274
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10274
[=C2=A0=C2=A02 ] CVE-2017-10281
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10281
[=C2=A0=C2=A03 ] CVE-2017-10285
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10285
[=C2=A0=C2=A04 ] CVE-2017-10295
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10295
[=C2=A0=C2=A05 ] CVE-2017-10345
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10345
[=C2=A0=C2=A06 ] CVE-2017-10346
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10346
[=C2=A0=C2=A07 ] CVE-2017-10347
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10347
[=C2=A0=C2=A08 ] CVE-2017-10348
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10348
[=C2=A0=C2=A09 ] CVE-2017-10349
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10349
[ 10 ] CVE-2017-10350
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10350
[ 11 ] CVE-2017-10355
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10355
[ 12 ] CVE-2017-10356
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10356
[ 13 ] CVE-2017-10357
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10357
[ 14 ] CVE-2017-10388
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://nvd.nist.gov/nvd.cfm?cven=ame=CVE-2017-10388
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
=C2=A0https://security.gentoo.org/glsa/201711-14
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2017 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--=-MeuUbK3M22xgf07dOU26
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit
