openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-444)

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

The OpenJDK Java java-1_7_0-openjdk was updated to 2.6.5 to fix the
following issues :

Update to 2.6.5 - OpenJDK 7u99 (bsc#972468)

- Security fixes

- S8152335, CVE-2016-0636: Improve MethodHandle
consistency

- Import of OpenJDK 7 u99 build 0

- S6425769, PR2858: Allow specifying an address to bind
JMX remote connector

- S6961123: setWMClass fails to null-terminate WM_CLASS
string

- S8145982, PR2858: JMXInterfaceBindingTest is failing
intermittently

- S8146015, PR2858: JMXInterfaceBindingTest is failing
intermittently for IPv6 addresses

- Backports

- S8028727, PR2814: [parfait] warnings from b116 for
jdk.src.share.native.sun.security.ec: JNI pending
exceptions

- S8048512, PR2814: Uninitialised memory in
jdk/src/share/native/sun/security/ec/ECC_JNI.cpp

- S8071705. PR2819, RH1182694: Java application menu
misbehaves when running multiple screen stacked
vertically

- S8150954, PR2866, RH1176206: AWT Robot not compatible
with GNOME Shell

- Bug fixes

- PR2803: Make system CUPS optional

- PR2886: Location of 'stap' executable is hard-coded

- PR2893: test/tapset/jstaptest.pl should be executable

- PR2894: Add missing test directory in make check.

- CACAO

- PR2781, CA195: typeinfo.cpp: typeinfo_merge_nonarrays:
Assertion `dest && result && x.any && y.any' failed

- AArch64 port

- PR2852: Add support for large code cache

- PR2852: Apply ReservedCodeCacheSize default limiting to
AArch64 only.

- S8081289, PR2852: aarch64: add support for
RewriteFrequentPairs in interpreter

- S8131483, PR2852: aarch64: illegal stlxr instructions

- S8133352, PR2852: aarch64: generates constrained
unpredictable instructions

- S8133842, PR2852: aarch64: C2 generates illegal
instructions with int shifts >=32

- S8134322, PR2852: AArch64: Fix several errors in C2
biased locking implementation

- S8136615, PR2852: aarch64: elide DecodeN when followed
by CmpP 0

- S8138575, PR2852: Improve generated code for profile
counters

- S8138641, PR2852: Disable C2 peephole by default for
aarch64

- S8138966, PR2852: Intermittent SEGV running ParallelGC

- S8143067, PR2852: aarch64: guarantee failure in javac

- S8143285, PR2852: aarch64: Missing load acquire when
checking if ConstantPoolCacheEntry is resolved

- S8143584, PR2852: Load constant pool tag and class
status with load acquire

- S8144201, PR2852: aarch64:
jdk/test/com/sun/net/httpserver/Test6a.java fails with

--enable-unlimited-crypto

- S8144582, PR2852: AArch64 does not generate correct
branch profile data

- S8146709, PR2852: AArch64: Incorrect use of ADRP for
byte_map_base

- S8147805, PR2852: aarch64: C1 segmentation fault due to
inline Unsafe.getAndSetObject

- S8148240, PR2852: aarch64: random infrequent NULL
pointer exceptions in javac

- PPC & AIX port

- S8034797, PR2851: AIX: Fix os::naked_short_sleep() in
os_aix.cpp after 8028280

- S8139258, PR2851: PPC64LE: argument passing problem when
passing 15 floats in native call

- S8139421, PR2851: PPC64LE:
MacroAssembler::bxx64_patchable kill register R12

Update to 2.6.5 - OpenJDK 7u99 (bsc#972468)

- Security fixes

- S8152335, CVE-2016-0636: Improve MethodHandle
consistency

- Import of OpenJDK 7 u99 build 0

- S6425769, PR2858: Allow specifying an address to bind
JMX remote connector

- S6961123: setWMClass fails to null-terminate WM_CLASS
string

- S8145982, PR2858: JMXInterfaceBindingTest is failing
intermittently

- S8146015, PR2858: JMXInterfaceBindingTest is failing
intermittently for IPv6 addresses

- Backports

- S8028727, PR2814: [parfait] warnings from b116 for
jdk.src.share.native.sun.security.ec: JNI pending
exceptions

- S8048512, PR2814: Uninitialised memory in
jdk/src/share/native/sun/security/ec/ECC_JNI.cpp

- S8071705. PR2819, RH1182694: Java application menu
misbehaves when running multiple screen stacked
vertically

- S8150954, PR2866, RH1176206: AWT Robot not compatible
with GNOME Shell

- Bug fixes

- PR2803: Make system CUPS optional

- PR2886: Location of 'stap' executable is hard-coded

- PR2893: test/tapset/jstaptest.pl should be executable

- PR2894: Add missing test directory in make check.

- CACAO

- PR2781, CA195: typeinfo.cpp: typeinfo_merge_nonarrays:
Assertion `dest && result && x.any && y.any' failed

- AArch64 port

- PR2852: Add support for large code cache

- PR2852: Apply ReservedCodeCacheSize default limiting to
AArch64 only.

- S8081289, PR2852: aarch64: add support for
RewriteFrequentPairs in interpreter

- S8131483, PR2852: aarch64: illegal stlxr instructions

- S8133352, PR2852: aarch64: generates constrained
unpredictable instructions

- S8133842, PR2852: aarch64: C2 generates illegal
instructions with int shifts >=32

- S8134322, PR2852: AArch64: Fix several errors in C2
biased locking implementation

- S8136615, PR2852: aarch64: elide DecodeN when followed
by CmpP 0

- S8138575, PR2852: Improve generated code for profile
counters

- S8138641, PR2852: Disable C2 peephole by default for
aarch64

- S8138966, PR2852: Intermittent SEGV running ParallelGC

- S8143067, PR2852: aarch64: guarantee failure in javac

- S8143285, PR2852: aarch64: Missing load acquire when
checking if ConstantPoolCacheEntry is resolved

- S8143584, PR2852: Load constant pool tag and class
status with load acquire

- S8144201, PR2852: aarch64:
jdk/test/com/sun/net/httpserver/Test6a.java fails with

--enable-unlimited-crypto

- S8144582, PR2852: AArch64 does not generate correct
branch profile data

- S8146709, PR2852: AArch64: Incorrect use of ADRP for
byte_map_base

- S8147805, PR2852: aarch64: C1 segmentation fault due to
inline Unsafe.getAndSetObject

- S8148240, PR2852: aarch64: random infrequent NULL
pointer exceptions in javac

- PPC & AIX port

- S8034797, PR2851: AIX: Fix os::naked_short_sleep() in
os_aix.cpp after 8028280

- S8139258, PR2851: PPC64LE: argument passing problem when
passing 15 floats in native call

- S8139421, PR2851: PPC64LE:
MacroAssembler::bxx64_patchable kill register R12

This update was imported from the SUSE:SLE-12:Update update project.

See also :

https://bugzilla.opensuse.org/show_bug.cgi?id=972468

Solution :

Update the affected java-1_7_0-openjdk packages.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 90481 ()

Bugtraq ID:

CVE ID: CVE-2016-0636

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now