CVE-2017-3260

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0):

• S8138725: Add options for Javadoc generation
• S8140353: Improve signature checking
• S8151934, CVE-2017-3231: Resolve class resolution
• S8156804, CVE-2017-3241: Better constraint checking
• S8158406: Limited Parameter Processing
• S8158997: JNDI Protocols Switch
• S8159507: RuntimeVisibleAnnotation validation
• S8161218: Better bytecode loading
• S8161743, CVE-2017-3252: Provide proper login context
• S8162577: Standardize logging levels
• S8162973: Better component components
• S8164143, CVE-2017-3260: Improve components for menu items
• S8164147, CVE-2017-3261: Improve streaming socket output
• S8165071, CVE-2016-2183: Expand TLS support
• S8165344, CVE-2017-3272: Update concurrency support
• S8166988, CVE-2017-3253: Improve image processing performance
• S8167104, CVE-2017-3289: Additional class construction refinements
• S8167223, CVE-2016-5552: URL handling improvements
• S8168705, CVE-2016-5547: Better ObjectIdentifier validation
• S8168714, CVE-2016-5546: Tighten ECDSA validation
• S8168728, CVE-2016-5548: DSA signing improvements
• S8168724, CVE-2016-5549: ECDSA signing improvements

This update for java-1_7_0-openjdk fixes the following issues:

• Oracle Critical Patch Update of January 2017 to OpenJDK 7u131 (bsc#1020905):
  • Security Fixes
    • S8138725: Add options for Javadoc generation
    • S8140353: Improve signature checking
    • S8151934, CVE-2017-3231: Resolve class resolution
    • S8156804, CVE-2017-3241: Better constraint checking
    • S8158406: Limited Parameter Processing
    • S8158997: JNDI Protocols Switch
    • S8159507: RuntimeVisibleAnnotation validation
    • S8161218: Better bytecode loading
    • S8161743, CVE-2017-3252: Provide proper login context
    • S8162577: Standardize logging levels
    • S8162973: Better component components
    • S8164143, CVE-2017-3260: Improve components for menu items
    • S8164147, CVE-2017-3261: Improve streaming socket output
    • S8165071, CVE-2016-2183: Expand TLS support
    • S8165344, CVE-2017-3272: Update concurrency support
    • S8166988, CVE-2017-3253: Improve image processing performance
    • S8167104, CVE-2017-3289: Additional class construction refinements
    • S8167223, CVE-2016-5552: URL handling improvements
    • S8168705, CVE-2016-5547: Better ObjectIdentifier validation
    • S8168714, CVE-2016-5546: Tighten ECDSA validation
    • S8168728, CVE-2016-5548: DSA signing improvments
    • S8168724, CVE-2016-5549: ECDSA signing improvments
    • S6253144: Long narrowing conversion should describe the algorithm used and implied 'risks'
    • S6328537: Improve javadocs for Socket class by adding references to SocketOptions
    • S6978886: javadoc shows stacktrace after print error resulting from disk full
    • S6995421: Eliminate the static dependency to sun.security.ec.ECKeyFactory
    • S6996372: synchronizing handshaking hash
    • S7027045: (doc) java/awt/Window.java has several typos in javadoc
    • S7054969: Null-check-in-finally pattern in java/security documentation
    • S7072353: JNDI libraries do not build with javac -Xlint:all -Werror
    • S7075563: Broken link in 'javax.swing.SwingWorker'
    • S7077672: jdk8_tl nightly fail in step-2 build on 8/10/11
    • S7088502: Security libraries don't build with javac -Werror
    • S7092447: Clarify the default locale used in each locale sensitive operation
    • S7093640: Enable client-side TLS 1.2 by default
    • S7103570: AtomicIntegerFieldUpdater does not work when SecurityManager is installed
    • S7117360: Warnings in java.util.concurrent.atomic package
    • S7117465: Warning cleanup for IMF classes
    • S7187144: JavaDoc for ScriptEngineFactory.getProgram() contains an error
    • S8000418: javadoc should used a standard 'generated by javadoc' string
    • S8000666: javadoc should write directly to Writer instead of composing strings
    • S8000673: remove dead code from HtmlWriter and subtypes
    • S8000970: break out auxiliary classes that will prevent multi-core compilation of the JDK
    • S8001669: javadoc internal DocletAbortException should set cause when appropriate
    • S8008949: javadoc stopped copying doc-files
    • S8011402: Move blacklisting certificate logic from hard code to data
    • S8011547: Update XML Signature implementation to Apache Santuario 1.5.4
    • S8012288: XML DSig API allows wrong tag names and extra elements in SignedInfo
    • S8016217: More javadoc warnings
    • S8017325: Cleanup of the javadoc <code> tag in java.security.cert
    • S8017326: Cleanup of the javadoc <code> tag in java.security.spec
    • S8019772: Fix doclint issues in javax.crypto and javax.security subpackages
    • S8020557: javadoc cleanup in javax.security
    • S8020688: Broken links in documentation at http://docs.oracle.com/javase/6/docs/api/index.
    • S8021108: Clean up doclint warnings and errors in java.text package
    • S8021417: Fix doclint issues in java.util.concurrent
    • S8021833: javadoc cleanup in java.net
    • S8022120: JCK test api/javax_xml/crypto/dsig/TransformService/index_ParamMethods fails
    • S8022175: Fix doclint warnings…