File _patchinfo of Package patchinfo.8501

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.8501

<patchinfo incident="8501">
  <issue tracker="bnc" id="1101645">VUL-0: CVE-2018-2940: java-1_7_0-openjdk, java-1_8_0-openjdk, java-10-openjdk: Unspecified vulnerability in subcomponent Libraries</issue>
  <issue tracker="bnc" id="1101655">VUL-0: CVE-2018-2972: java-10-openjdk: Unspecified vulnerability in subcomponent Security</issue>
  <issue tracker="bnc" id="1096420">[Build 665.1] no javac alternative support for java-1_8_0-ibm after the migration from SLES12SP3 to SLE15</issue>
  <issue tracker="bnc" id="1101651">VUL-0: CVE-2018-2952: java-1_7_0-openjdk, java-1_8_0-openjdk, java-10-openjdk: Unspecified vulnerability in subcomponent Concurrency</issue>
  <issue tracker="bnc" id="1101656">VUL-0: CVE-2018-2973: java-1_7_0-openjdk, java-1_8_0-openjdk, java-10-openjdk: Unspecified vulnerability in subcomponent JSSE</issue>
  <issue tracker="cve" id="2018-2952"/>
  <issue tracker="cve" id="2018-2940"/>
  <issue tracker="cve" id="2018-2973"/>
  <issue tracker="cve" id="2018-2972"/>
  <category>security</category>
  <rating>important</rating>
  <packager>fstrba</packager>
  <description>
This update for OpenJDK 10.0.2 fixes the following security issues:

- CVE-2018-2940: the libraries sub-component contained an easily exploitable
  vulnerability that allowed attackers to compromise Java SE or Java SE
  Embedded over the network, potentially gaining unauthorized read access to
  data that's accessible to the server. [bsc#1101645]

- CVE-2018-2952: the concurrency sub-component contained a difficult to exploit
  vulnerability that allowed attackers to compromise Java SE, Java SE Embedded,
  or JRockit over the network. This issue could have been abused to mount a
  partial denial-of-service attack on the server. [bsc#1101651]

- CVE-2018-2972: the security sub-component contained a difficult to exploit
  vulnerability that allowed attackers to compromise Java SE over the network,
  potentially gaining unauthorized access to critical data or complete access
  to all Java SE accessible data. [bsc#1101655)

- CVE-2018-2973: the JSSE sub-component contained a difficult to exploit
  vulnerability allowed attackers to compromise Java SE or Java SE Embedded
  over the network, potentially gaining the ability to create, delete or modify
  critical data or all Java SE, Java SE Embedded accessible data without
  authorization. [bsc#1101656]

Furthemore, the following bugs were fixed:

- Properly remove the existing alternative for java before reinstalling it.
  [bsc#1096420]

- idlj was moved to the *-devel package. [bsc#1096420]

This update was imported from the SUSE:SLE-15:Update update project.</description>
  <summary>Security update for java-10-openjdk</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.8501

Places