GLSA-201406-32

http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html

TA11-201A

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Icedtea as included in java-1_6_0-openjdk was updated to fix several security issues :

dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent disabled get still selected for read ops (win) dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S6618658, CVE-2011-0865: Vulnerability in deserialization dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7012520, CVE-2011-0815: Heap overflow vulnerability in FileDialog.show() dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D code dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7013969, CVE-2011-0867: NetworkInterface.toString can reveal bindings dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7013971, CVE-2011-0869: Vulnerability in SAAJ dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7016340, CVE-2011-0870: Vulnerability in SAAJ dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7016495, CVE-2011-0868: Crash in Java 2D transforming an image with scale close to zero dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7020198, CVE-2011-0871: ImageIcon creates Component with null acc dbg114-icedtea-web-4788 icedtea-web-4788 new_updateinfo S7020373, CVE-2011-0864: JSR rewriting can overflow memory address size

Icedtea as included in java-1_6_0-openjdk was updated to fix several security issues :

  - S6213702, CVE-2011-0872: (so) non-blocking sockets with     TCP urgent disabled get still selected for read ops     (win)

  - S6618658, CVE-2011-0865: Vulnerability in     deserialization

  - S7012520, CVE-2011-0815: Heap overflow vulnerability in     FileDialog.show()

  - S7013519, CVE-2011-0822, CVE-2011-0862: Integer     overflows in 2D code

  - S7013969, CVE-2011-0867: NetworkInterface.toString can     reveal bindings

  - S7013971, CVE-2011-0869: Vulnerability in SAAJ

  - S7016340, CVE-2011-0870: Vulnerability in SAAJ

  - S7016495, CVE-2011-0868: Crash in Java 2D transforming     an image with scale close to zero

  - S7020198, CVE-2011-0871: ImageIcon creates Component     with null acc

  - S7020373, CVE-2011-0864: JSR rewriting can overflow     memory address size

The remote Oracle database server is missing the July 2011 Critical Patch Update (CPU) and therefore is potentially affected by security issues in the following components :

  - Core RDBMS (CVE-2011-0832, CVE-2011-0835, CVE-2011-0838,     CVE-2011-0880, CVE-2011-2230, CVE-2011-2239,     CVE-2011-2243, CVE-2011-2253)

  - Content Management (CVE-2011-0882)

  - Database Target Type Menus (CVE-2011-2257)

  - SQL Performance Advisories/UIs (CVE-2011-2248)

  - Schema Management (CVE-2011-0870)

  - Security Framework (CVE-2011-0848, CVE-2011-2244)

  - Security Management (CVE-2011-0852)

  - Streams, AQ & Replication Management (CVE-2011-0822)

  - XML Developer Kit (CVE-2011-2231, CVE-2011-2232)

  - CMDB Metadata & Instance APIs (CVE-2011-0816)

  - EMCTL (CVE-2011-0875, CVE-2011-0881)

  - Enterprise Config Management (CVE-2011-0811,     CVE-2011-0831)

  - Enterprise Manager Console (CVE-2011-0876)

  - Event Management (CVE-2011-0830)

  - Instance Management (CVE-2011-0877, CVE-2011-0879)

  - Database Vault (CVE-2011-2238)

  - Oracle Universal Installer (CVE-2011-2240)

It was discovered that a heap overflow in the AWT FileDialog.show() method could allow an attacker to cause a denial of service through an application crash or possibly execute arbitrary code. (CVE-2011-0815)

It was dicovered that integer overflows in the JPEGImageReader readImage() function and the SunLayoutEngine nativeLayout() function could allow an attacker to cause a denial of service through an application crash or possibly execute arbitrary code. (CVE-2011-0822, CVE-2011-0862)

It was discovered that memory corruption could occur when interpreting bytecode in the HotSpot VM. This could allow an attacker to cause a denial of service through an application crash or possibly execute arbitrary code. (CVE-2011-0864)

It was discovered that the deserialization code allowed the creation of mutable SignedObjects. This could allow an attacker to possibly execute code with elevated privileges. (CVE-2011-0865)

It was discovered that the toString method in the NetworkInterface class would reveal multiple addresses if they were bound to the interface. This could give an attacker more information about the networking environment. (CVE-2011-0867)

It was discovered that the Java 2D code to transform an image with a scale close to 0 could trigger an integer overflow. This could allow an attacker to cause a denial of service through an application crash or possibly execute arbitrary code. (CVE-2011-0868)

It was discovered that the SOAP with Attachments API for Java (SAAJ) implementation allowed the modification of proxy settings via unprivileged SOAP messages. (CVE-2011-0869, CVE-2011-0870)

It was the discovered that the Swing ImageIcon class created MediaTracker objects that potentially leaked privileged ApplicationContexts. This could possibly allow an attacker access to restricted resources or services. (CVE-2011-0871)

It was discovered that non-blocking sockets marked as not urgent could still get selected for read operations. This could allow an attacker to cause a denial of service. (CVE-2011-0872).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	critical
75863	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:0706-1)	Nessus	SuSE Local Security Checks	critical
75527	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:0706-1)	Nessus	SuSE Local Security Checks	critical
55632	Oracle Database Multiple Vulnerabilities (July 2011 CPU)	Nessus	Databases	high
55172	Ubuntu 10.04 LTS / 10.10 / 11.04 : openjdk-6, openjdk-6b18 vulnerabilities (USN-1154-1)	Nessus	Ubuntu Local Security Checks	critical

CVE-2011-0822

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins