Security update for java-1_8_0-ibm

Announcement ID:	SUSE-SU-2017:1386-1
Rating:	important
References:	bsc#1038505
Cross-References:	CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2017-1289 CVE-2017-3509 CVE-2017-3511 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544
CVSS scores:	CVE-2016-9840 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2016-9840 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2016-9841 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-9841 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-9842 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2016-9842 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2016-9843 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-9843 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-1289 ( SUSE ): 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CVE-2017-1289 ( NVD ): 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CVE-2017-3509 ( NVD ): 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2017-3511 ( NVD ): 7.7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2017-3533 ( NVD ): 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2017-3539 ( NVD ): 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2017-3544 ( NVD ): 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products:	SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 12-SP2 SUSE Linux Enterprise Software Development Kit 12 SP1

An update that solves 10 vulnerabilities can now be installed.

Description:

This update for java-1_8_0-ibm fixes the following issues:

Version update bsc#1038505:

• CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
• CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
• CVE-2016-9842: zlib: Undefined left shift of negative number
• CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
• CVE-2017-3544: OpenJDK: newline injection in the SMTP client
• CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
• CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher
• CVE-2017-3533: OpenJDK: newline injection in the FTP client
• CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
• CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Software Development Kit 12 SP1
  zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-844=1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2
  zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-844=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-844=1
• SUSE Linux Enterprise Server 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-844=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-844=1
• SUSE Linux Enterprise Server 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-844=1
• SUSE Linux Enterprise High Performance Computing 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-844=1

Package List:

• SUSE Linux Enterprise Software Development Kit 12 SP1 (nosrc)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Software Development Kit 12 SP1 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2 (nosrc)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1
  • java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server 12 SP1 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server 12 SP1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1
  • java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1
  • java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server 12 SP2 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise Server 12 SP2 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1
  • java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr4.5-29.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1
  • java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1

References:

• https://www.suse.com/security/cve/CVE-2016-9840.html
• https://www.suse.com/security/cve/CVE-2016-9841.html
• https://www.suse.com/security/cve/CVE-2016-9842.html
• https://www.suse.com/security/cve/CVE-2016-9843.html
• https://www.suse.com/security/cve/CVE-2017-1289.html
• https://www.suse.com/security/cve/CVE-2017-3509.html
• https://www.suse.com/security/cve/CVE-2017-3511.html
• https://www.suse.com/security/cve/CVE-2017-3533.html
• https://www.suse.com/security/cve/CVE-2017-3539.html
• https://www.suse.com/security/cve/CVE-2017-3544.html
• https://bugzilla.suse.com/show_bug.cgi?id=1038505