Security update for java-1_8_0-openjdk

Announcement ID:	SUSE-SU-2016:0256-1
Rating:	critical
References:	bsc#960996 bsc#962743
Cross-References:	CVE-2015-7575 CVE-2015-8126 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0475 CVE-2016-0483 CVE-2016-0494
CVSS scores:
Affected Products:	SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1

An update that solves eight vulnerabilities can now be installed.

Description:

java-1_8_0-openjdk was updated to version 7u95 to fix several security issues. (bsc#962743)

The following vulnerabilities were fixed:

• CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996)
• CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays
• CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix
• CVE-2016-0402: Vulnerability in the Networking component related to URL processing
• CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing
• CVE-2016-0466: Vulnerability in the JAXP component, related to limits
• CVE-2016-0483: Vulnerability in the AWT component related to image decoding
• CVE-2016-0494: Vulnerability in 2D component related to font actions

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP1
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-160=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-160=1
• SUSE Linux Enterprise Server 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-160=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-headless-1.8.0.72-3.2
  • java-1_8_0-openjdk-1.8.0.72-3.2
  • java-1_8_0-openjdk-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-debugsource-1.8.0.72-3.2
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-devel-1.8.0.72-3.2
  • java-1_8_0-openjdk-headless-1.8.0.72-3.2
  • java-1_8_0-openjdk-1.8.0.72-3.2
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-demo-1.8.0.72-3.2
  • java-1_8_0-openjdk-debugsource-1.8.0.72-3.2
• SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-devel-1.8.0.72-3.2
  • java-1_8_0-openjdk-headless-1.8.0.72-3.2
  • java-1_8_0-openjdk-1.8.0.72-3.2
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-debuginfo-1.8.0.72-3.2
  • java-1_8_0-openjdk-demo-1.8.0.72-3.2
  • java-1_8_0-openjdk-debugsource-1.8.0.72-3.2

References:

• https://www.suse.com/security/cve/CVE-2015-7575.html
• https://www.suse.com/security/cve/CVE-2015-8126.html
• https://www.suse.com/security/cve/CVE-2016-0402.html
• https://www.suse.com/security/cve/CVE-2016-0448.html
• https://www.suse.com/security/cve/CVE-2016-0466.html
• https://www.suse.com/security/cve/CVE-2016-0475.html
• https://www.suse.com/security/cve/CVE-2016-0483.html
• https://www.suse.com/security/cve/CVE-2016-0494.html
• https://bugzilla.suse.com/show_bug.cgi?id=960996
• https://bugzilla.suse.com/show_bug.cgi?id=962743