Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3496
Security update for java-1_7_0-openjdk
9 October 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: java-1_7_0-openjdk
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
CVE-2020-14581 CVE-2020-14579 CVE-2020-14578
CVE-2020-14577
Reference: ASB-2020.0128
ESB-2020.3042
ESB-2020.3015
ESB-2020.2807
ESB-2020.2748
Original Bulletin:
https://www.suse.com/support/update/announcement/2020/suse-su-20202861-1
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________
Announcement ID: SUSE-SU-2020:2861-1
Rating: important
References: #1174157
Cross-References: CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
CVE-2020-14583 CVE-2020-14593 CVE-2020-14621
Affected Products:
SUSE OpenStack Cloud Crowbar 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 7
SUSE Linux Enterprise Server for SAP 12-SP4
SUSE Linux Enterprise Server for SAP 12-SP3
SUSE Linux Enterprise Server for SAP 12-SP2
SUSE Linux Enterprise Server 12-SP5
SUSE Linux Enterprise Server 12-SP4-LTSS
SUSE Linux Enterprise Server 12-SP3-LTSS
SUSE Linux Enterprise Server 12-SP3-BCL
SUSE Linux Enterprise Server 12-SP2-LTSS
SUSE Linux Enterprise Server 12-SP2-BCL
SUSE Enterprise Storage 5
HPE Helion Openstack 8
______________________________________________________________________________
An update that fixes 7 vulnerabilities is now available.
Description:
This update for java-1_7_0-openjdk fixes the following issues:
o java-1_7_0-openjdk was updated to 2.6.23 (July 2020 CPU, bsc#1174157) -
JDK-8028431, CVE-2020-14579: NullPointerException in - DerValue.equals
(DerValue) - JDK-8028591, CVE-2020-14578: NegativeArraySizeException in -
sun.security.util.DerInputStream.getUnalignedBitString() - JDK-8230613:
Better ASCII conversions - JDK-8231800: Better listing of arrays -
JDK-8232014: Expand DTD support - JDK-8233255: Better Swing Buttons -
JDK-8234032: Improve basic calendar services - JDK-8234042: Better factory
production of certificates - JDK-8234418: Better parsing with
CertificateFactory - JDK-8234836: Improve serialization handling -
JDK-8236191: Enhance OID processing - JDK-8237592, CVE-2020-14577: Enhance
certificate verification - JDK-8238002, CVE-2020-14581: Better matrix
operations - JDK-8238804: Enhance key handling process - JDK-8238842:
AIOOBE in GIFImageReader.initializeStringTable - JDK-8238843: Enhanced font
handing - JDK-8238920, CVE-2020-14583: Better Buffer support - JDK-8238925:
Enhance WAV file playback - JDK-8240119, CVE-2020-14593: Less Affine
Transformations - JDK-8240482: Improved WAV file playback - JDK-8241379:
Update JCEKS support - JDK-8241522: Manifest improved jar headers redux -
JDK-8242136, CVE-2020-14621: Better XML namespace handling - JDK-8040113:
File not initialized in src/share/native/sun/awt/giflib/dgif_lib.c -
JDK-8054446: Repeated offer and remove on ConcurrentLinkedQueue lead to an
OutOfMemoryError - JDK-8077982: GIFLIB upgrade - JDK-8081315: 8077982
giflib upgrade breaks system giflib builds with earlier versions -
JDK-8147087: Race when reusing PerRegionTable bitmaps may result in dropped
remembered set entries - JDK-8151582: (ch) test java/nio/channels/
AsyncCloseAndInterrupt.java failing due to "Connection succeeded" -
JDK-8155691: Update GIFlib library to the latest up-to-date - JDK-8181841:
A TSA server returns timestamp with precision higher than milliseconds -
JDK-8203190: SessionId.hashCode generates too many collisions -
JDK-8217676: Upgrade libpng to 1.6.37 - JDK-8220495: Update GIFlib library
to the 5.1.8 - JDK-8226892: ActionListeners on JRadioButtons don't get
notified when selection is changed with arrow keys - JDK-8229899: Make
java.io.File.isInvalid() less racy - JDK-8230597: Update GIFlib library to
the 5.2.1 - JDK-8230769: BufImg_SetupICM add ReleasePrimitiveArrayCritical
call in early return - JDK-8243541: (tz) Upgrade time-zone data to
tzdata2020a - JDK-8244548: JDK 8u: sun.misc.Version.jdkUpdateVersion()
returns wrong result
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE OpenStack Cloud Crowbar 9:
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2020-2861=1
o SUSE OpenStack Cloud Crowbar 8:
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-2861=1
o SUSE OpenStack Cloud 9:
zypper in -t patch SUSE-OpenStack-Cloud-9-2020-2861=1
o SUSE OpenStack Cloud 8:
zypper in -t patch SUSE-OpenStack-Cloud-8-2020-2861=1
o SUSE OpenStack Cloud 7:
zypper in -t patch SUSE-OpenStack-Cloud-7-2020-2861=1
o SUSE Linux Enterprise Server for SAP 12-SP4:
zypper in -t patch SUSE-SLE-SAP-12-SP4-2020-2861=1
o SUSE Linux Enterprise Server for SAP 12-SP3:
zypper in -t patch SUSE-SLE-SAP-12-SP3-2020-2861=1
o SUSE Linux Enterprise Server for SAP 12-SP2:
zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-2861=1
o SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-2861=1
o SUSE Linux Enterprise Server 12-SP4-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2020-2861=1
o SUSE Linux Enterprise Server 12-SP3-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2020-2861=1
o SUSE Linux Enterprise Server 12-SP3-BCL:
zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2020-2861=1
o SUSE Linux Enterprise Server 12-SP2-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-2861=1
o SUSE Linux Enterprise Server 12-SP2-BCL:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-2861=1
o SUSE Enterprise Storage 5:
zypper in -t patch SUSE-Storage-5-2020-2861=1
o HPE Helion Openstack 8:
zypper in -t patch HPE-Helion-OpenStack-8-2020-2861=1
Package List:
o SUSE OpenStack Cloud Crowbar 9 (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE OpenStack Cloud Crowbar 8 (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE OpenStack Cloud 9 (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE OpenStack Cloud 8 (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE OpenStack Cloud 7 (s390x x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server for SAP 12-SP2 (ppc64le x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server 12-SP3-LTSS (aarch64 ppc64le s390x x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server 12-SP3-BCL (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server 12-SP2-LTSS (ppc64le s390x x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o SUSE Enterprise Storage 5 (aarch64 x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
o HPE Helion Openstack 8 (x86_64):
java-1_7_0-openjdk-1.7.0.271-43.41.1
java-1_7_0-openjdk-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-debugsource-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-1.7.0.271-43.41.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-1.7.0.271-43.41.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-1.7.0.271-43.41.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.271-43.41.1
References:
o https://www.suse.com/security/cve/CVE-2020-14577.html
o https://www.suse.com/security/cve/CVE-2020-14578.html
o https://www.suse.com/security/cve/CVE-2020-14579.html
o https://www.suse.com/security/cve/CVE-2020-14581.html
o https://www.suse.com/security/cve/CVE-2020-14583.html
o https://www.suse.com/security/cve/CVE-2020-14593.html
o https://www.suse.com/security/cve/CVE-2020-14621.html
o https://bugzilla.suse.com/1174157
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX3/23eNLKJtyKPYoAQiWxRAAi/tm9Z6eet9sVgaytBx//pmGzzkKZQHb
nQ2vKyWFNq25PTLjaBWsRwEJutmk10WGeQvsMg2hca7ewC7RFWs3muk3IscxHBTZ
E0YKvGCuEt0KtF8y0Wzrhy3UxJT3oBJnrZXrHC5mykAyCEoUIqdA1bt9frGgvrNg
1ZigpZzgzmhFWkXho0ZM9Rat0A9L/irHbAVmhZamLCHxTMMXV3aiqcwXgVE1NjtL
RmGuxUb2L+iLywsxjACcMSGcFOAgIIh1ikT1tyQVWcdyL7QwJCm0mkyjeBb5Dyht
rEDOQsSz15lJd32fCzpUHkX2T5Uaf1043pxvB/qBOYl9ZcP3ofZjQrviHPRPi8JF
bu/8lQEc5Xf9Q2nSAaGOIjqUGz2FuEJ5x7ySkQ/TcdCFiKDdQrwGCn/Pz3GKFaZ7
lz8QrcGhag/TmW9iCTycyHSjzSwVhbWsD3xCHsYZX3FWp3Kp0ek3JVLyxakdoqKm
yQGxqD3yxj8fxM68JfGsfOVkRYj+kJVmQHsxLWi85459yv+S0COpzP+5eNRcL2lO
yFDrxPMcT1XCuDYWlJGZ8UmbQCM7sOnEOMRrWJD88MTaxXxAO7W+2IPdbQkZ1SLJ
1NbhwY0P5hOQDkKof9egkXLYG0Ue13IhkvTCabfQ34F30bhbUe2glSdt2uvLmF+4
RuOM2HOQ5zQ=
=guCc
-----END PGP SIGNATURE-----