ESB-2018.0719 - [SUSE] java-1_8_0-ibm: Multiple vulnerabilities 2018-03-13

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0719
                      SUSE 12 gets IBM Java 8 update
                               13 March 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           java-1_8_0-ibm
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Access Privileged Data          -- Remote/Unauthenticated      
                   Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Modify Arbitrary Files          -- Remote/Unauthenticated      
                   Denial of Service               -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-2678 CVE-2018-2677 CVE-2018-2663
                   CVE-2018-2641 CVE-2018-2639 CVE-2018-2638
                   CVE-2018-2637 CVE-2018-2634 CVE-2018-2633
                   CVE-2018-2618 CVE-2018-2603 CVE-2018-2602
                   CVE-2018-2599 CVE-2018-2588 CVE-2018-2582
                   CVE-2018-2579  

Reference:         ASB-2018.0024
                   ESB-2018.0705
                   ESB-2018.0674
                   ESB-2018.0565
                   ESB-2018.0180

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2018/suse-su-20180665-1

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for java-1_8_0-ibm
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:0665-1
Rating:             important
References:         #1076390 #1082810 #929900 #955131 
Cross-References:   CVE-2018-2579 CVE-2018-2582 CVE-2018-2588
                    CVE-2018-2599 CVE-2018-2602 CVE-2018-2603
                    CVE-2018-2618 CVE-2018-2633 CVE-2018-2634
                    CVE-2018-2637 CVE-2018-2638 CVE-2018-2639
                    CVE-2018-2641 CVE-2018-2663 CVE-2018-2677
                    CVE-2018-2678
Affected Products:
                    SUSE OpenStack Cloud 6
                    SUSE Linux Enterprise Software Development Kit 12-SP3
                    SUSE Linux Enterprise Software Development Kit 12-SP2
                    SUSE Linux Enterprise Server for SAP 12-SP1
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Server 12-SP2
                    SUSE Linux Enterprise Server 12-SP1-LTSS
______________________________________________________________________________

   An update that fixes 16 vulnerabilities is now available.

Description:



   This update for java-1_8_0-ibm fixes the following issues:

   - Removed java-1_8_0-ibm-alsa and java-1_8_0-ibm-plugin entries in
     baselibs.conf due to errors in osc source_validator

   Version update to 8.0.5.10 [bsc#1082810]

   * Security fixes:

       CVE-2018-2639 CVE-2018-2638 CVE-2018-2633 CVE-2018-2637 CVE-2018-2634
   CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2603 CVE-2018-2599
   CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588
   CVE-2018-2579

   * Defect fixes:

       - IJ02608 Class Libraries: Change of namespace definitions with
         handlers that implement javax.xml.ws.handler.soap.soaphandler
       - IJ04280 Class Libraries: Deploy Upgrade to Oracle level 8u161-b12
       - IJ03390 Class Libraries: JCL Upgrade to Oracle level 8u161-b12
       - IJ04001 Class Libraries: Performance improvement with child process
         on AIX
       - IJ04281 Class Libraries: Startup time increase after applying apar
         IV96905
       - IJ03822 Class Libraries: Update timezone information to tzdata2017c
       - IJ03440 Java Virtual Machine: Assertion failure during class creation
       - IJ03717 Java Virtual Machine: Assertion for gencon with concurrent
         scavenger on ZOS64
       - IJ03513 Java Virtual Machine: Assertion in concurrent scavenger if
         initial heap memory size -Xms is set too low
       - IJ03994 Java Virtual Machine: Class.getmethods() does not return all
         methods
       - IJ03413 Java Virtual Machine: Hang creating thread after redefining
         classes
       - IJ03852 Java Virtual Machine: ICH408I message when groupaccess is
         specified with -xshareclasses
       - IJ03716 Java Virtual Machine: java/lang/linkageerror from
         sun/misc/unsafe.definean onymousclass()
       - IJ03116 Java Virtual Machine: java.fullversion string contains an
         extra space
       - IJ03347 Java Virtual Machine: java.lang.IllegalStateException in
         related class MemoryMXBean
       - IJ03878 Java Virtual Machine: java.lang.StackOverflowError is thrown
         when custom security manager in place
       - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump,
         trace, log was not enabled by default
       - IJ04248 JIT Compiler: ArrayIndexOutOfBoundsException is thrown when
         converting BigDecimal to String
       - IJ04250 JIT Compiler: Assertion failure with concurrentScavenge on
         Z14
       - IJ03606 JIT Compiler: Java crashes with -version
       - IJ04251 JIT Compiler: JIT compiled method that takes advantage of
         AutoSIMD produces an incorrect result on x86
       - IJ03854 JIT Compiler: JVM info message appears in stdout
       - IJ03607 JIT Compiler: Result String contains a redundant dot when
         converted from BigDecimal with 0 on all platforms
       - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01
       - IJ03715 Security: Add additional support for the IBMJCEPlus
         provider, add support for new IBMJCEPlusFIPS provider
       - IJ03800 Security: A fix in CMS provider for KDB integrity
       - IJ04282 Security: Change in location and default of jurisdiction
         policy files
       - IJ03853 Security: IBMCAC provider does not support SHA224
       - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated
         internally
       - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated
         internally
       - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot
         specification attribute
       - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception
       - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with
         stash, JKS Chain issue and JVM argument parse issue with iKeyman
       - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE
       - PI93233 z/OS Extentions: Cipher.doFinal() fails when using
         AES/GCM/nopadding with AAD data of 13 bytes and a block size
   	      of 4081 to 4096

   * Fixes in 8.0.5.7:

       - IJ02605 Class Libraries: Update IBM-1371 charset with new
         specification support
       - IJ02541 Java Virtual Machine: Assertions in GC when jvmti runs with
         Concurrent Scavenger
       - IJ02443 Java Virtual Machine: Committed eden region size is bigger
         than maximum eden region size
       - IJ02378 Java Virtual Machine: Existing signal action for
         SIG_IGN/SIG_DFL is not detected properly
       - IJ02758 JIT Compiler: Crash in JIT module during method compilation
       - IJ02733 JIT Compiler: Crash in jit module when compiling in
         non-default configuration

   * Fixes in 8.0.5.6:

       - IJ02283 Java Virtual Machine: IllegalAccessException due to a
         missing access check for the same class in MethodHandle apis
       - IJ02082 Java Virtual Machine: The default value for class unloading
         kick
         	      off threshold is not set
       - IJ02018 JIT Compiler: Crash or assertion while attempting to acquire
         VM access
       - IJ02284 JIT Compiler: Division by zero in JIT compiler
       - IV88941 JIT Compiler: JIT compiler takes far too long to compile a
         method
       - IJ02285 JIT Compiler: Performance degradation during class unloading
         in Java 8 SR5

   - Support Java jnlp files run from Firefox. [bsc#1076390]


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 6:

      zypper in -t patch SUSE-OpenStack-Cloud-6-2018-447=1

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-447=1

   - SUSE Linux Enterprise Software Development Kit 12-SP2:

      zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-447=1

   - SUSE Linux Enterprise Server for SAP 12-SP1:

      zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-447=1

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-447=1

   - SUSE Linux Enterprise Server 12-SP2:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-447=1

   - SUSE Linux Enterprise Server 12-SP1-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-447=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE OpenStack Cloud 6 (x86_64):

      java-1_8_0-ibm-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64):

      java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64):

      java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64):

      java-1_8_0-ibm-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64):

      java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64):

      java-1_8_0-ibm-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server 12-SP3 (x86_64):

      java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64):

      java-1_8_0-ibm-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server 12-SP2 (x86_64):

      java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64):

      java-1_8_0-ibm-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1

   - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64):

      java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1
      java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1


References:

   https://www.suse.com/security/cve/CVE-2018-2579.html
   https://www.suse.com/security/cve/CVE-2018-2582.html
   https://www.suse.com/security/cve/CVE-2018-2588.html
   https://www.suse.com/security/cve/CVE-2018-2599.html
   https://www.suse.com/security/cve/CVE-2018-2602.html
   https://www.suse.com/security/cve/CVE-2018-2603.html
   https://www.suse.com/security/cve/CVE-2018-2618.html
   https://www.suse.com/security/cve/CVE-2018-2633.html
   https://www.suse.com/security/cve/CVE-2018-2634.html
   https://www.suse.com/security/cve/CVE-2018-2637.html
   https://www.suse.com/security/cve/CVE-2018-2638.html
   https://www.suse.com/security/cve/CVE-2018-2639.html
   https://www.suse.com/security/cve/CVE-2018-2641.html
   https://www.suse.com/security/cve/CVE-2018-2663.html
   https://www.suse.com/security/cve/CVE-2018-2677.html
   https://www.suse.com/security/cve/CVE-2018-2678.html
   https://bugzilla.suse.com/1076390
   https://bugzilla.suse.com/1082810
   https://bugzilla.suse.com/929900
   https://bugzilla.suse.com/955131

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWqcS+4x+lLeg9Ub1AQgYfA//Vgx4pUi8VduaBJPs54GAkct3zpTCIUsU
/+FMpBlNLOK64Q417xkbMbrZ3/KzQBFySTLyw+qoILqgXLcEu4ivKB5Du6z16rO0
Jzbo5K6DOQpBN5+UEKVlUwvfIt04BRC7vU979b0NHvL9dw59PTQOolTGqhKSGyoh
bSBopJl9o3kfIhO543+SxUbvoRMq1TYzKCFk0uA3vkP+iuZnjT1Oir7g7uf2kw9W
R/pJqoLuQlzEIwCU+aFDDDclC8n+84fetJIz0Myg3uDfcPLhhsVgfEhPO8N7ANr0
FfBkDFKQzODueRUw3jH56sUQD2MCC/Nb3PiM13jLSRLyJZ58pYiGsG8zDNEsW2tn
1EzJ17I//QmwKnAvljNX3nbrQl0IPEnc+bdzprJKFFRBIojpyy56qeaAtQvX4ihm
pnsqZ1+c9DpfUisyVg/ATWNFa8c3xVbWMnRBhWuZou9l4ldrgdHcsps12gSQlqjS
5BCvgRp9XFNqoJGHGhMkjqwo27POMdI8lfEY69zqkEsemWXlqC4okQk58GdIRUXL
+F5ou2O7lHXNWRlnyFbOQyNE4kJbNgzXxdF75RVAuF4Yix3u4zFawrUqxv1QoY/U
k7LR+qT06S6V5VRPuk3PvYD+wIYQSpVYX9WRePHTEB76GI7EoSSNPpPpw61Povb5
6/mKAEzeEHM=
=3ID4
-----END PGP SIGNATURE-----

« Back to bulletins