Security update for java-1_8_0-openjdk

Announcement ID:	SUSE-SU-2016:1248-1
Rating:	important
References:	bsc#976340
Cross-References:	CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427
CVSS scores:	CVE-2016-0686 ( NVD ): 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2016-0687 ( NVD ): 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2016-0695 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-3425 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2016-3426 ( NVD ): 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2016-3427 ( NVD ): 9.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1

An update that solves six vulnerabilities can now be installed.

Description:

This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340):

• CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.
• CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component
• CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component
• CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP
• CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE
• CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP1
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-724=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-724=1
• SUSE Linux Enterprise Server 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-724=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
  • java-1_8_0-openjdk-debugsource-1.8.0.91-11.1
  • java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-headless-1.8.0.91-11.1
  • java-1_8_0-openjdk-1.8.0.91-11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
  • java-1_8_0-openjdk-debugsource-1.8.0.91-11.1
  • java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-demo-1.8.0.91-11.1
  • java-1_8_0-openjdk-devel-1.8.0.91-11.1
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-headless-1.8.0.91-11.1
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-1.8.0.91-11.1
• SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
  • java-1_8_0-openjdk-debugsource-1.8.0.91-11.1
  • java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-demo-1.8.0.91-11.1
  • java-1_8_0-openjdk-devel-1.8.0.91-11.1
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-headless-1.8.0.91-11.1
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-11.1
  • java-1_8_0-openjdk-1.8.0.91-11.1

References:

• https://www.suse.com/security/cve/CVE-2016-0686.html
• https://www.suse.com/security/cve/CVE-2016-0687.html
• https://www.suse.com/security/cve/CVE-2016-0695.html
• https://www.suse.com/security/cve/CVE-2016-3425.html
• https://www.suse.com/security/cve/CVE-2016-3426.html
• https://www.suse.com/security/cve/CVE-2016-3427.html
• https://bugzilla.suse.com/show_bug.cgi?id=976340