CVE-2017-10176

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This java-1_8_0-openjdk update to version jdk8u141 (icedtea 3.5.0) fixes the following issues:

Security issues fixed:

• CVE-2017-10053: Improved image post-processing steps (bsc#1049305)
• CVE-2017-10067: Additional jar validation steps (bsc#1049306)
• CVE-2017-10074: Image conversion improvements (bsc#1049307)
• CVE-2017-10078: Better script accessibility for JavaScript (bsc#1049308)
• CVE-2017-10081: Right parenthesis issue (bsc#1049309)
• CVE-2017-10086: Unspecified vulnerability in subcomponent JavaFX (bsc#1049310)
• CVE-2017-10087: Better Thread Pool execution (bsc#1049311)
• CVE-2017-10089: Service Registration Lifecycle (bsc#1049312)
• CVE-2017-10090: Better handling of channel groups (bsc#1049313)
• CVE-2017-10096: Transform Transformer Exceptions (bsc#1049314)
• CVE-2017-10101: Better reading of text catalogs (bsc#1049315)
• CVE-2017-10102: Improved garbage collection (bsc#1049316)
• CVE-2017-10105: Unspecified vulnerability in subcomponent deployment (bsc#1049317)
• CVE-2017-10107: Less Active Activations (bsc#1049318)
• CVE-2017-10108: Better naming attribution (bsc#1049319)
• CVE-2017-10109: Better sourcing of code (bsc#1049320)
• CVE-2017-10110: Better image fetching (bsc#1049321)
• CVE-2017-10111: Rearrange MethodHandle arrangements (bsc#1049322)
• CVE-2017-10114: Unspecified vulnerability in subcomponent JavaFX (bsc#1049323)
• CVE-2017-10115: Higher quality DSA operations (bsc#1049324)
• CVE-2017-10116: Proper directory lookup processing (bsc#1049325)
• CVE-2017-10118: Higher quality ECDSA operations (bsc#1049326)
• CVE-2017-10125: Unspecified vulnerability in subcomponent deployment (bsc#1049327)
• CVE-2017-10135: Better handling of PKCS8 material (bsc#1049328)
• CVE-2017-10176: Additional elliptic curve support (bsc#1049329)
• CVE-2017-10193: Improve algorithm constraints implementation (bsc#1049330)
• CVE-2017-10198: Clear certificate chain connections (bsc#1049331)
• CVE-2017-10243: Unspecified vulnerability in subcomponent JAX-WS (bsc#1049332)

Bug fixes:

• Check registry registration location
• Improved certificate processing
• JMX diagnostic improvements
• Update to libpng 1.6.28
• Import of OpenJDK 8 u141 build 15 (bsc#1049302)

New features:

• Support using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider

This update for java-1_7_0-openjdk fixes the following issues:

Security issues fixed:

• CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084).
• CVE-2017-10274: Fix issue inside subcomponent Smart Card IO (bsc#1064071).
• CVE-2017-10281: Fix issue inside subcomponent Serialization (bsc#1064072).
• CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073).
• CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075).
• CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086).
• CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078).
• CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082).
• CVE-2017-10347: Fix issue inside subcomponent Serialization (bsc#1064079).
• CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081).
• CVE-2017-10345: Fix issue inside subcomponent Serialization (bsc#1064077).
• CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080).
• CVE-2017-10357: Fix issue inside subcomponent Serialization (bsc#1064085).
• CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083).
• CVE-2017-10102: Fix incorrect handling of references in DGC (bsc#1049316).
• CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader (bsc#1049305).
• CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest (bsc#1049306).
• CVE-2017-10081: Fix incorrect bracket processing in function signature handling (bsc#1049309).
• CVE-2017-10087: Fix insufficient access control checks in ThreadPoolExecutor (bsc#1049311).
• CVE-2017-10089: Fix insufficient access control checks in ServiceRegistry (bsc#1049312).
• CVE-2017-10090: Fix insufficient access control checks in AsynchronousChannelGroupImpl (bsc#1049313).
• CVE-2017-10096: Fix insufficient access control checks in XML transformations (bsc#1049314).
• CVE-2017-10101: Fix unrestricted access to com.sun.org.apache.xml.internal.resolver (bsc#1049315).
• CVE-2017-10107: Fix insufficient access control checks in ActivationID (bsc#1049318).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10110: Fix insufficient access control checks in ImageWatched (bsc#1049321).
• CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute deserialization (bsc#1049319).
• CVE-2017-10109: Fix unbounded memory allocation in CodeSource deserialization (bsc#1049320).
• CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE (bsc#1049324).
• CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326).
• CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL (bsc#1049325).
• CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328).
• CVE-2017-10176: Fix incorrect handling of certain EC points (bsc#1049329).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322).
• CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS (bsc#1049332).
• CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment (bsc#1049327).
• CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX (bsc#1049323).
• CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment (bsc#1049317).
• CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310).
• CVE-2017-10198: Fix incorrect enforcement of certificate path restrictions (bsc#1049331).
• CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330).

Bug fixes:

• Drop Exec Shield workaround to fix crashes on recent kernels, where Exec Shield is gone (bsc#1052318).

It was discovered that the JPEGImageReader class in OpenJDK would incorrectly read unused image data. An attacker could use this to specially construct a jpeg image file that when opened by a Java application would cause a denial of service. (CVE-2017-10053)

It was discovered that the JAR verifier in OpenJDK did not properly handle archives containing files missing digests. An attacker could use this to modify the signed contents of a JAR file. (CVE-2017-10067)

It was discovered that integer overflows existed in the Hotspot component of OpenJDK when generating range check loop predicates. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions and cause a denial of service or possibly execute arbitrary code. (CVE-2017-10074)

It was discovered that the JavaScript Scripting component of OpenJDK incorrectly allowed access to Java APIs. An attacker could use this to specially craft JavaScript code to bypass access restrictions. (CVE-2017-10078)

It was discovered that OpenJDK did not properly process parentheses in function signatures. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10081)

It was discovered that the ThreadPoolExecutor class in OpenJDK did not properly perform access control checks when cleaning up threads. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions and possibly execute arbitrary code. (CVE-2017-10087)

It was discovered that the ServiceRegistry implementation in OpenJDK did not perform access control checks in certain situations. An attacker could use this to specially construct an untrusted Java application or applet that escaped sandbox restrictions. (CVE-2017-10089)

It was discovered that the channel groups implementation in OpenJDK did not properly perform access control checks in some situations. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10090)

It was discovered that the DTM exception handling code in the JAXP component of OpenJDK did not properly perform access control checks. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10096)

It was discovered that the JAXP component of OpenJDK incorrectly granted access to some internal resolvers. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10101)

It was discovered that the Distributed Garbage Collector (DGC) in OpenJDK did not properly track references in some situations. A remote attacker could possibly use this to execute arbitrary code. (CVE-2017-10102)

It was discovered that the Activation ID implementation in the RMI component of OpenJDK did not properly check access control permissions in some situations. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10107)

It was discovered that the BasicAttribute class in OpenJDK did not properly bound memory allocation when de-serializing objects. An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-10108)

It was discovered that the CodeSource class in OpenJDK did not properly bound memory allocations when de-serializing object instances. An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-10109)

It was discovered that the AWT ImageWatched class in OpenJDK did not properly perform access control checks, An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions (CVE-2017-10110)

Jackson Davis discovered that the LambdaFormEditor class in the Libraries…

It was discovered that the JPEGImageReader class in OpenJDK would incorrectly read unused image data. An attacker could use this to specially construct a jpeg image file that when opened by a Java application would cause a denial of service. (CVE-2017-10053)

It was discovered that the JAR verifier in OpenJDK did not properly handle archives containing files missing digests. An attacker could use this to modify the signed contents of a JAR file. (CVE-2017-10067)

It was discovered that integer overflows existed in the Hotspot component of OpenJDK when generating range check loop predicates. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions and cause a denial of service or possibly execute arbitrary code. (CVE-2017-10074)

It was discovered that OpenJDK did not properly process parentheses in function signatures. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10081)

It was discovered that the ThreadPoolExecutor class in OpenJDK did not properly perform access control checks when cleaning up threads. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions and possibly execute arbitrary code. (CVE-2017-10087)

It was discovered that the ServiceRegistry implementation in OpenJDK did not perform access control checks in certain situations. An attacker could use this to specially construct an untrusted Java application or applet that escaped sandbox restrictions. (CVE-2017-10089)

It was discovered that the channel groups implementation in OpenJDK did not properly perform access control checks in some situations. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10090)

It was discovered that the DTM exception handling code in the JAXP component of OpenJDK did not properly perform access control checks. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10096)

It was discovered that the JAXP component of OpenJDK incorrectly granted access to some internal resolvers. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10101)

It was discovered that the Distributed Garbage Collector (DGC) in OpenJDK did not properly track references in some situations. A remote attacker could possibly use this to execute arbitrary code. (CVE-2017-10102)

It was discovered that the Activation ID implementation in the RMI component of OpenJDK did not properly check access control permissions in some situations. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2017-10107)

It was discovered that the BasicAttribute class in OpenJDK did not properly bound memory allocation when de-serializing objects. An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-10108)

It was discovered that the CodeSource class in OpenJDK did not properly bound memory allocations when de-serializing object instances. An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-10109)

It was discovered that the AWT ImageWatched class in OpenJDK did not properly perform access control checks, An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions (CVE-2017-10110)

It was discovered that a timing side-channel vulnerability existed in the DSA implementation in OpenJDK. An attacker could use this to expose sensitive information. (CVE-2017-10115)

It was discovered that the LDAP implementation in OpenJDK incorrectly followed references to non-LDAP URLs. An…