openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-578)

Critical Nessus Plugin ID 40238

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 9.4

Synopsis

The remote openSUSE host is missing a security update.

Description

OpenJDK Java 1.6.0 was upgraded to build b14, fixing quite a lot of security issues.

It fixes at least: 4486841 UTF8 decoder should adhere to corrigendum to Unicode 3.0.1 CVE-2008-5351 6484091 FileSystemView leaks directory info CVE-2008-5350 aka SUN SOLVE 246266 6497740 Limit the size of RSA public keys CVE-2008-5349 6588160 jaas krb5 client leaks OS-level UDP sockets (all platforms) CVE-2008-5348 6592792 Add com.sun.xml.internal to the 'package.access' property in $JAVA_HOME/lib/security/java.security CVE-2008-5347 aka SUN SOLVE 246366 6721753 File.createTempFile produces guessable file names CVE-2008-5360 6726779 ConvolveOp on USHORT raster can cause the JVM crash. CVE-2008-5359 aka SUN SOLVE 244987 6733336 Crash on malformed font CVE-2008-5356 aka SUN SOLVE 244987 6733959 Insufficient checks for 'Main-Class' manifest entry in JAR files CVE-2008-5354 aka SUN SOLVE 244990 6734167 Calendar.readObject allows elevation of privileges CVE-2008-5353 6751322 Vulnerability report: Sun Java JRE TrueType Font Parsing Heap Overflow CVE-2008-5357 aka SUN SOLVE 244987 6755943 Java JAR Pack200 Decompression should enforce stricter header checks CVE-2008-5352 aka SUN SOLVE 244992 6766136 corrupted gif image may cause crash in java splashscreen library. CVE-2008-5358 aka SUN SOLVE 244987

Solution

Update the affected java-1_6_0-openjdk packages.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=471829

Plugin Details

Severity: Critical

ID: 40238

File Name: suse_11_1_java-1_6_0-openjdk-090303.nasl

Version: 1.14

Type: local

Agent: unix

Published: 2009/07/21

Updated: 2019/10/25

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 9.4

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:java-1_6_0-openjdk, p-cpe:/a:novell:opensuse:java-1_6_0-openjdk-demo, p-cpe:/a:novell:opensuse:java-1_6_0-openjdk-devel, p-cpe:/a:novell:opensuse:java-1_6_0-openjdk-javadoc, p-cpe:/a:novell:opensuse:java-1_6_0-openjdk-plugin, p-cpe:/a:novell:opensuse:java-1_6_0-openjdk-src, cpe:/o:novell:opensuse:11.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2009/03/03

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Sun Java Calendar Deserialization Privilege Escalation)

Reference Information

CVE: CVE-2008-5347, CVE-2008-5348, CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352, CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357, CVE-2008-5358, CVE-2008-5359, CVE-2008-5360

CWE: 119, 189, 200, 264