[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

ALAS-2016-688 ---- java-1.8.0-openjdk

ID: oval:org.secpod.oval:def:1600395Date: (C)2016-05-19   (M)2024-01-29
Class: PATCHFamily: unix




It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. It was discovered that the Hotspot component of OpenJDK did not properly handle byte types. An untrusted Java application or applet could use this flaw to corrupt Java virtual machine memory and possibly execute arbitrary code, bypassing Java sandbox restrictions. It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. It was discovered that the GCM implementation in the JCE component of OpenJDK used non-constant time comparison when comparing GCM authentication tag. A remote attacker could possibly use this flaw to determine correct value of the authentication tag and bypass authentication protections of GCM

Platform:
Amazon Linux AMI
Product:
java-1.8.0-openjdk
Reference:
ALAS-2016-688
CVE-2016-0695
CVE-2016-0686
CVE-2016-0687
CVE-2016-3425
CVE-2016-3427
CVE-2016-3426
CVE    6
CVE-2016-0686
CVE-2016-0695
CVE-2016-0687
CVE-2016-3426
...
CPE    2
cpe:/o:amazon:linux
cpe:/a:oracle:java-1.8.0-openjdk

© SecPod Technologies