CVE-2016-3587

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610).

Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed (CVE-2016-3500, CVE-2016-3508).

Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2016-3458, CVE-2016-3550).

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.111-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-1_8_0-openjdk fixes the following issues:

• Upgrade to version jdk8u101 (icedtea 3.1.0)
• New in release 3.1.0 (2016-07-25):
  • Security fixes
    • S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)
    • S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)
    • S8146514: Enforce GCM limits
    • S8147771: Construction of static protection domains under Javax custom policy
    • S8148872, CVE-2016-3500: Complete name checking (bsc#989730)
    • S8149070: Enforce update ordering
    • S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)
    • S8150752: Share Class Data
    • S8151925: Font reference improvements
    • S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)
    • S8153312: Constrain AppCDS behavior
    • S8154475, CVE-2016-3587: Clean up lookup visibility (bsc#989721)
    • S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)
    • S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)
    • S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)
    • CVE-2016-3552 (bsc#989726)
    • CVE-2016-3511 (bsc#989727)
    • CVE-2016-3503 (bsc#989728)
    • CVE-2016-3498 (bsc#989729)
  • New features
    • S8145547, PR1061: [AWT/Swing] Conditional support for GTK 3 on Linux
    • PR2821: Support building OpenJDK with --disable-headful
    • PR2931, G478960: Provide Infinality Support via fontconfig
    • PR3079: Provide option to build Shenandoah on x86_64
  • Import of OpenJDK 8 u92 build 14
    • S6869327: Add new C2 flag to keep safepoints in counted loops.
    • S8022865: [TESTBUG] Compressed Oops testing needs to be revised
    • S8029630: Thread id should be displayed as a hex number in error report
    • S8029726: On OS X some dtrace probe names are mismatched with Solaris
    • S8029727: On OS X dtrace probes Call<type>MethodA/Call<type>MethodV are not fired.
    • S8029728: On OS X dtrace probes SetStaticBooleanField are not fired
    • S8038184: XMLSignature throws StringIndexOutOfBoundsException if ID attribute value is empty String
    • S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits
    • S8041501: ImageIO reader is not capable of reading JPEGs without JFIF header
    • S8041900: [macosx] Java forces the use of discrete GPU
    • S8044363: Remove special build options for unpack200 executable
    • S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy value for hotspot ARCH
    • S8046611: Build errors with gcc on sparc/fastdebug
    • S8047763: Recognize sparc64 as a sparc platform
    • S8048232: Fix for 8046471 breaks PPC64 build
    • S8052396: Catch exceptions resulting from missing font cmap
    • S8058563: InstanceKlass::_dependencies list isn't cleared from empty nmethodBucket entries
    • S8061624: [TESTBUG] Some tests cannot be ran under compact profiles and therefore shall be excluded
    • S8062901: Iterators is spelled incorrectly in the Javadoc for Spliterator
    • S8064330: Remove SHA224 from the default support list if SunMSCAPI enabled
    • S8065579: WB method to start G1 concurrent mark cycle should be introduced
    • S8065986: Compiler fails to NullPointerException when calling super with Object<>()
    • S8066974: Compiler doesn't infer method's generic type information in lambda body
    • S8067800: Clarify java.time.chrono.Chronology.isLeapYear for out of range years
    • S8068033: JNI exception pending in jdk/src/share/bin/java.c
    • S8068042: Check jdk/src/share/native/sun/misc/URLClassPath.c for JNI pending
    • S8068162: jvmtiRedefineClasses.cpp: guarantee(false) failed: OLD and/or OBSOLETE method(s) found
    • S8068254: Method reference uses wrong qualifying type
    • S8074696: Remote debugging session hangs for several minutes …

This update for php5 fixes the following security issues:

• CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
• CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
• CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
• CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
• CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
• CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
• CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
• CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
• CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
• CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
• CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
• CVE-2014-3587: Integer overflow in the cdf_read_property_info affecting SLES11 SP3 [bsc#987530]
• CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433]
• CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
• CVE-2016-7125: PHP Session Data Injection Vulnerability
• CVE-2016-7126: select_colors write out-of-bounds
• CVE-2016-7127: imagegammacorrect allowed arbitrary write access
• CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
• CVE-2016-7129: wddx_deserialize allowed illegal memory access
• CVE-2016-7130: wddx_deserialize null dereference
• CVE-2016-7131: wddx_deserialize null dereference with invalid xml
• CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
• CVE-2016-7134: Heap overflow in the function curl_escape

Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrary code. (CVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)

A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit this to expose sensitive data over the network or possibly execute arbitrary code. (CVE-2016-3458)

Multiple vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2016-3500, CVE-2016-3508)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit this to expose sensitive data over the network. (CVE-2016-3550)