[SECURITY] [DLA 451-1] openjdk-7 security update

2016-05-0310:37:41

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

Low

EPSS

0.495

Percentile

97.5%

JSON

Package : openjdk-7
Version : 7u101-2.6.6-2~deb7u1
CVE ID : CVE-2016-0636 CVE-2016-0686 CVE-2016-0687
CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in breakouts of
the Java sandbox, denial of service or information disclosure.

For Debian 7 "Wheezy", these problems have been fixed in version
7u101-2.6.6-2~deb7u1.

We recommend that you upgrade your openjdk-7 packages.

Please note that OpenJDK 7 will be made the new default Java
implementation on 26 June 2016. For further information please refer to

https://wiki.debian.org/LTS/Wheezy

OSVersionArchitecturePackageVersionFilename
Debian8amd64openjdk-7-dbg< 7u101-2.6.6-1~deb8u1openjdk-7-dbg_7u101-2.6.6-1~deb8u1_amd64.deb
Debian8kfreebsd-i386openjdk-7-dbg< 7u101-2.6.6-1~deb8u1openjdk-7-dbg_7u101-2.6.6-1~deb8u1_kfreebsd-i386.deb
Debian8amd64openjdk-7-jre-zero< 7u101-2.6.6-1~deb8u1openjdk-7-jre-zero_7u101-2.6.6-1~deb8u1_amd64.deb
Debian8amd64openjdk-7-demo< 7u101-2.6.6-1~deb8u1openjdk-7-demo_7u101-2.6.6-1~deb8u1_amd64.deb
Debian8mipselopenjdk-7-jre< 7u101-2.6.6-1~deb8u1openjdk-7-jre_7u101-2.6.6-1~deb8u1_mipsel.deb
Debian7armelopenjdk-7-jdk< 7u101-2.6.6-2~deb7u1openjdk-7-jdk_7u101-2.6.6-2~deb7u1_armel.deb
Debian7armelopenjdk-7-jre-headless< 7u101-2.6.6-2~deb7u1openjdk-7-jre-headless_7u101-2.6.6-2~deb7u1_armel.deb
Debian8i386icedtea-7-jre-jamvm< 7u101-2.6.6-1~deb8u1icedtea-7-jre-jamvm_7u101-2.6.6-1~deb8u1_i386.deb
Debian8amd64openjdk-7-jre-headless< 7u101-2.6.6-1~deb8u1openjdk-7-jre-headless_7u101-2.6.6-1~deb8u1_amd64.deb
Debian8kfreebsd-amd64openjdk-7-jre< 7u101-2.6.6-1~deb8u1openjdk-7-jre_7u101-2.6.6-1~deb8u1_kfreebsd-amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	openjdk-7-dbg	< 7u101-2.6.6-1~deb8u1	openjdk-7-dbg_7u101-2.6.6-1~deb8u1_amd64.deb
Debian	8	kfreebsd-i386	openjdk-7-dbg	< 7u101-2.6.6-1~deb8u1	openjdk-7-dbg_7u101-2.6.6-1~deb8u1_kfreebsd-i386.deb
Debian	8	amd64	openjdk-7-jre-zero	< 7u101-2.6.6-1~deb8u1	openjdk-7-jre-zero_7u101-2.6.6-1~deb8u1_amd64.deb
Debian	8	amd64	openjdk-7-demo	< 7u101-2.6.6-1~deb8u1	openjdk-7-demo_7u101-2.6.6-1~deb8u1_amd64.deb
Debian	8	mipsel	openjdk-7-jre	< 7u101-2.6.6-1~deb8u1	openjdk-7-jre_7u101-2.6.6-1~deb8u1_mipsel.deb
Debian	7	armel	openjdk-7-jdk	< 7u101-2.6.6-2~deb7u1	openjdk-7-jdk_7u101-2.6.6-2~deb7u1_armel.deb
Debian	7	armel	openjdk-7-jre-headless	< 7u101-2.6.6-2~deb7u1	openjdk-7-jre-headless_7u101-2.6.6-2~deb7u1_armel.deb
Debian	8	i386	icedtea-7-jre-jamvm	< 7u101-2.6.6-1~deb8u1	icedtea-7-jre-jamvm_7u101-2.6.6-1~deb8u1_i386.deb
Debian	8	amd64	openjdk-7-jre-headless	< 7u101-2.6.6-1~deb8u1	openjdk-7-jre-headless_7u101-2.6.6-1~deb8u1_amd64.deb
Debian	8	kfreebsd-amd64	openjdk-7-jre	< 7u101-2.6.6-1~deb8u1	openjdk-7-jre_7u101-2.6.6-1~deb8u1_kfreebsd-amd64.deb