1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
<define-tag description>LTS security update</define-tag>
<define-tag moreinfo>
<p>Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in breakouts of
the Java sandbox, information disclosure, denial of service and insecure
cryptography.</p>
<ul>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2015-7575">CVE-2015-7575</a>
<p>A flaw was found in the way TLS 1.2 could use the MD5 hash
function for signing ServerKeyExchange and Client
Authentication packets during a TLS handshake.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2015-8126">CVE-2015-8126</a>
<p>Multiple buffer overflows in the (1) png_set_PLTE and (2)
png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x
before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before
1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause
a denial of service (application crash) or possibly have
unspecified other impact via a small bit-depth value in an IHDR
(aka image header) chunk in a PNG image.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2015-8472">CVE-2015-8472</a>
<p>Buffer overflow in the png_set_PLTE function in libpng before
1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before
1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows
remote attackers to cause a denial of service (application
crash) or possibly have unspecified other impact via a small
bit-depth value in an IHDR (aka image header) chunk in a PNG
image. NOTE: this vulnerability exists because of an incomplete
fix for <a href="https://security-tracker.debian.org/tracker/CVE-2015-8126">CVE-2015-8126</a>.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2016-0402">CVE-2016-0402</a>
<p>Unspecified vulnerability in the Java SE and Java SE Embedded
components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE
Embedded 8u65 allows remote attackers to affect integrity via
unknown vectors related to Networking.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2016-0448">CVE-2016-0448</a>
<p>Unspecified vulnerability in the Java SE and Java SE Embedded
components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE
Embedded 8u65 allows remote authenticated users to affect
confidentiality via vectors related to JMX.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2016-0466">CVE-2016-0466</a>
<p>It was discovered that the JAXP component in OpenJDK did not
properly enforce the totalEntitySizeLimit limit. An attacker
able to make a Java application process a specially crafted XML
file could use this flaw to make the application consume an
excessive amount of memory.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2016-0483">CVE-2016-0483</a>
<p>Unspecified vulnerability in the Java SE, Java SE Embedded, and
JRockit components in Oracle Java SE 6u105, 7u91, and 8u66;
Java SE Embedded 8u65; and JRockit R28.3.8 allows remote
attackers to affect confidentiality, integrity, and
availability via vectors related to AWT.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2016-0494">CVE-2016-0494</a>
<p>Unspecified vulnerability in the Java SE and Java SE Embedded
components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE
Embedded 8u65 allows remote attackers to affect
confidentiality, integrity, and availability via
unknown vectors related to 2D.</p></li>
</ul>
<p>For Debian 6 <q>Squeeze</q>, these problems have been fixed in version
6b38-1.13.10-1~deb6u1.</p>
<p>We recommend that you upgrade your openjdk-6 packages.</p>
</define-tag>
# do not modify the following line
#include "$(ENGLISHDIR)/lts/security/2016/dla-410.data"
# $Id$
|
