[SECURITY] [DLA 2193-1] openjdk-7 security update

2020-04-2900:48:53

lists.debian.org

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.4

Confidence

Low

EPSS

0.004

Percentile

72.0%

JSON

Package : openjdk-7
Version : 7u261-2.6.22-1~deb8u1
CVE ID : CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781
CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830

Several vulnerabilities have been discovered in the OpenJDK Java
runtime, resulting in denial of service, insecure TLS handshakes, bypass
of sandbox restrictions or HTTP response splitting attacks.

For Debian 8 "Jessie", these problems have been fixed in version
7u261-2.6.22-1~deb8u1.

We recommend that you upgrade your openjdk-7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian9mips64elopenjdk-8-demo< 8u252-b09-1~deb9u1openjdk-8-demo_8u252-b09-1~deb9u1_mips64el.deb
Debian9arm64openjdk-8-jre< 8u252-b09-1~deb9u1openjdk-8-jre_8u252-b09-1~deb9u1_arm64.deb
Debian10amd64openjdk-11-jre-headless< 11.0.7+10-3~deb10u1openjdk-11-jre-headless_11.0.7+10-3~deb10u1_amd64.deb
Debian9mipsopenjdk-8-demo< 8u252-b09-1~deb9u1openjdk-8-demo_8u252-b09-1~deb9u1_mips.deb
Debian10amd64openjdk-11-jdk-headless< 11.0.7+10-3~deb10u1openjdk-11-jdk-headless_11.0.7+10-3~deb10u1_amd64.deb
Debian8allopenjdk-7-jre-lib< 7u261-2.6.22-1~deb8u1openjdk-7-jre-lib_7u261-2.6.22-1~deb8u1_all.deb
Debian9amd64openjdk-8-jre-headless< 8u252-b09-1~deb9u1openjdk-8-jre-headless_8u252-b09-1~deb9u1_amd64.deb
Debian10arm64openjdk-11-jdk< 11.0.7+10-3~deb10u1openjdk-11-jdk_11.0.7+10-3~deb10u1_arm64.deb
Debian9mipselopenjdk-8-jdk< 8u252-b09-1~deb9u1openjdk-8-jdk_8u252-b09-1~deb9u1_mipsel.deb
Debian9i386openjdk-8-dbg< 8u252-b09-1~deb9u1openjdk-8-dbg_8u252-b09-1~deb9u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips64el	openjdk-8-demo	< 8u252-b09-1~deb9u1	openjdk-8-demo_8u252-b09-1~deb9u1_mips64el.deb
Debian	9	arm64	openjdk-8-jre	< 8u252-b09-1~deb9u1	openjdk-8-jre_8u252-b09-1~deb9u1_arm64.deb
Debian	10	amd64	openjdk-11-jre-headless	< 11.0.7+10-3~deb10u1	openjdk-11-jre-headless_11.0.7+10-3~deb10u1_amd64.deb
Debian	9	mips	openjdk-8-demo	< 8u252-b09-1~deb9u1	openjdk-8-demo_8u252-b09-1~deb9u1_mips.deb
Debian	10	amd64	openjdk-11-jdk-headless	< 11.0.7+10-3~deb10u1	openjdk-11-jdk-headless_11.0.7+10-3~deb10u1_amd64.deb
Debian	8	all	openjdk-7-jre-lib	< 7u261-2.6.22-1~deb8u1	openjdk-7-jre-lib_7u261-2.6.22-1~deb8u1_all.deb
Debian	9	amd64	openjdk-8-jre-headless	< 8u252-b09-1~deb9u1	openjdk-8-jre-headless_8u252-b09-1~deb9u1_amd64.deb
Debian	10	arm64	openjdk-11-jdk	< 11.0.7+10-3~deb10u1	openjdk-11-jdk_11.0.7+10-3~deb10u1_arm64.deb
Debian	9	mipsel	openjdk-8-jdk	< 8u252-b09-1~deb9u1	openjdk-8-jdk_8u252-b09-1~deb9u1_mipsel.deb
Debian	9	i386	openjdk-8-dbg	< 8u252-b09-1~deb9u1	openjdk-8-dbg_8u252-b09-1~deb9u1_i386.deb