[SECURITY] Fedora 9 Update: java-1.6.0-openjdk-1.6.0.0-0.20.b09.fc9

updates at fedoraproject.org updates at fedoraproject.org
Sun Dec 7 04:27:51 UTC 2008


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2008-10860
2008-12-07 02:16:19
--------------------------------------------------------------------------------

Name        : java-1.6.0-openjdk
Product     : Fedora 9
Version     : 1.6.0.0
Release     : 0.20.b09.fc9
URL         : http://icedtea.classpath.org/
Summary     : OpenJDK Runtime Environment
Description :
The OpenJDK runtime environment.

--------------------------------------------------------------------------------
Update Information:

OpenJDK security patches applied.
--------------------------------------------------------------------------------
ChangeLog:

* Tue Dec  2 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.20.b09
- Set runtests to 0.
* Tue Dec  2 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.20.b09
- Added new security patch.
- Resolves: rhbz#472234 
- Resolves: rhbz#472233  
- Resolves: rhbz#472231  
- Resolves: rhbz#472228  
- Resolves: rhbz#472224  
- Resolves: rhbz#472218  
- Resolves: rhbz#472213  
- Resolves: rhbz#472212  
- Resolves: rhbz#472211  
- Resolves: rhbz#472209  
- Resolves: rhbz#472208  
- Resolves: rhbz#472206  
- Resolves: rhbz#472201
* Mon Sep 22 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.19.b09
- Removed update-desktop-database dependency.
- Resolves: rhbz#463046
* Mon Sep  8 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.18.b09
- Moved hotspot patch to only be applied to jit_arches.
* Mon Sep  8 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.18.b09
- Added hotspot patch (Patch11) to fix eclipse crashing bug.
- Resolves: rhbz#460205
* Mon Sep  8 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.18.b09
- Added rhino requirement.
- Resolves: rhbz#461336
* Wed Jul 16 2008 Dennis Gilmore <dennis at ausil.us> - 1:1.6.0-0.17.b09
- bump the release to sync all arches
* Wed Jul  9 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.16.b09
- Add runtests define.
- Run test suites on JIT architectures only.
* Tue Jul  8 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.16.b09
- Only apply hotspot security patch of jitarches.
* Wed Jul  2 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0-0.16.b09
- Added OpenJDK security patches.
* Sat Jun  7 2008 Tom "spot" Callaway <tcallawa at redhat.com> - 1:1.6.0-0.16.b09
- enable sparc/sparc64 builds
* Sat May 31 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Fix keytool location passed to generate-cacerts.pl.
* Fri May 30 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Generate cacerts file.
* Fri May 30 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Remove jhat patch.
* Fri May 30 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Remove makefile patch.
- Update generate-fedora-zip.sh.
* Fri May 30 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Formatting cleanups.
* Fri May 30 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Group all Mauve commands.
* Fri May 30 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Formatting cleanups.
- Add jtreg_output to src subpackage.
* Wed May 28 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.15.b09
- Updated icedteasnapshot for new release.
* Tue May 27 2008 Thomas Fitzsimmons <fitzsim at redhat.com> - 1:1.6.0.0-0.15.b09
- Require ca-certificates.
- Symlink to ca-certificates cacerts.
- Remove cacerts from files list.
- Resolves: rhbz#444260
* Mon May 26 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.14.b09
- Added eclipse-ecj build requirement for mauve.
- Updated icedteasnapshot.
* Fri May 23 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.14.b09
- Fixed jtreg testing.
* Fri May 23 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.14.b09
- Updated icedteasnapshot.
- Updated release.
- Added jtreg testing.
* Thu May 22 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.13.b09
- Added new patch java-1.6.0-openjdk-java-access-bridge-tck.patch.
- Updated release.
* Mon May  5 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.12.b09
- Updated release.
- Updated icedteasnapshot.
- Resolves: rhbz#445182
- Resolves: rhbz#445183
* Tue Apr 29 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.11.b09
- Fixed javaws.desktop installation.
* Tue Apr 29 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.11.b09
- Updated icedteasnapshot.
- Removed java-1.6.0-openjdk-jconsole.desktop and
  java-1.6.0-openjdk-policytool.desktop files.
* Tue Apr 29 2008 Lillian Angel <langel at redhat.com> - 1:1.6.0.0-0.11.b09
- Updated release.
- Added archbuild and archinstall definitions for ia64.
- Resolves: rhbz#433843
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #472201 - CVE-2008-5350 OpenJDK allows to list files within the user home directory (6484091)
        https://bugzilla.redhat.com/show_bug.cgi?id=472201
  [ 2 ] Bug #472206 - CVE-2008-5349 OpenJDK RSA public key length denial-of-service (6497740)
        https://bugzilla.redhat.com/show_bug.cgi?id=472206
  [ 3 ] Bug #472208 - CVE-2008-5347 OpenJDK applet privilege escalation via JAX package access (6592792)
        https://bugzilla.redhat.com/show_bug.cgi?id=472208
  [ 4 ] Bug #472209 - CVE-2008-5348 OpenJDK Denial-Of-Service in kerberos authentication (6588160)
        https://bugzilla.redhat.com/show_bug.cgi?id=472209
  [ 5 ] Bug #472211 - CVE-2008-5360 OpenJDK temporary files have guessable file names (6721753)
        https://bugzilla.redhat.com/show_bug.cgi?id=472211
  [ 6 ] Bug #472212 - CVE-2008-5359 OpenJDK Buffer overflow in image processing (6726779)
        https://bugzilla.redhat.com/show_bug.cgi?id=472212
  [ 7 ] Bug #472213 - CVE-2008-5351 OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841)
        https://bugzilla.redhat.com/show_bug.cgi?id=472213
  [ 8 ] Bug #472218 - CVE-2008-5356 OpenJDK Font processing vulnerability (6733336)
        https://bugzilla.redhat.com/show_bug.cgi?id=472218
  [ 9 ] Bug #472233 - CVE-2008-5352 OpenJDK Jar200 Decompression buffer overflow (6755943)
        https://bugzilla.redhat.com/show_bug.cgi?id=472233
  [ 10 ] Bug #472234 - CVE-2008-5358 OpenJDK Buffer Overflow in GIF image processing (6766136)
        https://bugzilla.redhat.com/show_bug.cgi?id=472234
  [ 11 ] Bug #472224 - CVE-2008-5353 OpenJDK calender object deserialization allows privilege escalation (6734167)
        https://bugzilla.redhat.com/show_bug.cgi?id=472224
  [ 12 ] Bug #472228 - CVE-2008-5354 OpenJDK Privilege escalation in command line applications (6733959)
        https://bugzilla.redhat.com/show_bug.cgi?id=472228
  [ 13 ] Bug #472231 - CVE-2008-5357 OpenJDK Truetype Font processing vulnerability (6751322)
        https://bugzilla.redhat.com/show_bug.cgi?id=472231
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update java-1.6.0-openjdk' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------




More information about the Fedora-package-announce mailing list