CVE-2016-3508

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.

Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610).

Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed (CVE-2016-3500, CVE-2016-3508).

Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2016-3458, CVE-2016-3550).

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.111-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-1_7_0-openjdk fixes the following issues:

• Update to 2.6.7 - OpenJDK 7u111
  • Security fixes
    • S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)
    • S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)
    • S8147771: Construction of static protection domains under Javax custom policy
    • S8148872, CVE-2016-3500: Complete name checking (bsc#989730)
    • S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)
    • S8150752: Share Class Data
    • S8151925: Font reference improvements
    • S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)
    • S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)
    • S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)
    • S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)
    • CVE-2016-3511 (bsc#989727)
    • CVE-2016-3503 (bsc#989728)
    • CVE-2016-3498 (bsc#989729)
  • Import of OpenJDK 7 u111 build 0
    • S6953295: Move few sun.security.{util, x509, pkcs} classes used by keytool/jarsigner to another package
    • S7060849: Eliminate pack200 build warnings
    • S7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
    • S7069870: Parts of the JDK erroneously rely on generic array initializers with diamond
    • S7102686: Restructure timestamp code so that jars and modules can more easily share the same code
    • S7105780: Add SSLSocket client/SSLEngine server to templates directory
    • S7142339: PKCS7.java is needlessly creating SHA1PRNG SecureRandom instances when timestamping is not done
    • S7152582: PKCS11 tests should use the NSS libraries available in the OS
    • S7192202: Make sure keytool prints both unknown and unparseable extensions
    • S7194449: String resources for Key Tool and Policy Tool should be in their respective packages
    • S7196855: autotest.sh fails on ubuntu because libsoftokn.so not found
    • S7200682: TEST_BUG: keytool/autotest.sh still has problems with libsoftokn.so
    • S8002306: (se) Selector.open fails if invoked with thread interrupt status set [win]
    • S8009636: JARSigner including TimeStamp PolicyID (TSAPolicyID) as defined in RFC3161
    • S8019341: Update CookieHttpsClientTest to use the newer framework.
    • S8022228: Intermittent test failures in sun/security/ssl/javax/net/ssl/NewAPIs
    • S8022439: Fix lint warnings in sun.security.ec
    • S8022594: Potential deadlock in <clinit> of sun.nio.ch.Util/IOUtil
    • S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently
    • S8036612: [parfait] JNI exception pending in jdk/src/windows/native/sun/security/mscapi/security.cpp
    • S8037557: test SessionCacheSizeTests.java timeout
    • S8038837: Add support to jarsigner for specifying timestamp hash algorithm
    • S8079410: Hotspot version to share the same update and build version from JDK
    • S8130735: javax.swing.TimerQueue: timer fires late when another timer starts
    • S8139436: sun.security.mscapi.KeyStore might load incomplete data
    • S8144313: Test SessionTimeOutTests can be timeout
    • S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out
    • S8146669: Test SessionTimeOutTests fails intermittently
    • S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811
    • S8147857: [TEST] RMIConnector logs attribute names incorrectly
    • S8151841, PR3098: Build needs additional flags to compile with GCC 6
    • S8151876: (tz) Support tzdata2016d
    • S8157077: 8u101 L10n resource file updates
    • S8161262: Fix jdk build with gcc 4.1.2: -fno-strict-overflow not known.
  • Import of OpenJDK 7 u111 build 1
    • S7081817:…

This update for java-1_8_0-openjdk fixes the following issues:

• Upgrade to version jdk8u101 (icedtea 3.1.0)
• New in release 3.1.0 (2016-07-25):
  • Security fixes
    • S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)
    • S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)
    • S8146514: Enforce GCM limits
    • S8147771: Construction of static protection domains under Javax custom policy
    • S8148872, CVE-2016-3500: Complete name checking (bsc#989730)
    • S8149070: Enforce update ordering
    • S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)
    • S8150752: Share Class Data
    • S8151925: Font reference improvements
    • S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)
    • S8153312: Constrain AppCDS behavior
    • S8154475, CVE-2016-3587: Clean up lookup visibility (bsc#989721)
    • S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)
    • S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)
    • S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)
    • CVE-2016-3552 (bsc#989726)
    • CVE-2016-3511 (bsc#989727)
    • CVE-2016-3503 (bsc#989728)
    • CVE-2016-3498 (bsc#989729)
  • New features
    • S8145547, PR1061: [AWT/Swing] Conditional support for GTK 3 on Linux
    • PR2821: Support building OpenJDK with --disable-headful
    • PR2931, G478960: Provide Infinality Support via fontconfig
    • PR3079: Provide option to build Shenandoah on x86_64
  • Import of OpenJDK 8 u92 build 14
    • S6869327: Add new C2 flag to keep safepoints in counted loops.
    • S8022865: [TESTBUG] Compressed Oops testing needs to be revised
    • S8029630: Thread id should be displayed as a hex number in error report
    • S8029726: On OS X some dtrace probe names are mismatched with Solaris
    • S8029727: On OS X dtrace probes Call<type>MethodA/Call<type>MethodV are not fired.
    • S8029728: On OS X dtrace probes SetStaticBooleanField are not fired
    • S8038184: XMLSignature throws StringIndexOutOfBoundsException if ID attribute value is empty String
    • S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits
    • S8041501: ImageIO reader is not capable of reading JPEGs without JFIF header
    • S8041900: [macosx] Java forces the use of discrete GPU
    • S8044363: Remove special build options for unpack200 executable
    • S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy value for hotspot ARCH
    • S8046611: Build errors with gcc on sparc/fastdebug
    • S8047763: Recognize sparc64 as a sparc platform
    • S8048232: Fix for 8046471 breaks PPC64 build
    • S8052396: Catch exceptions resulting from missing font cmap
    • S8058563: InstanceKlass::_dependencies list isn't cleared from empty nmethodBucket entries
    • S8061624: [TESTBUG] Some tests cannot be ran under compact profiles and therefore shall be excluded
    • S8062901: Iterators is spelled incorrectly in the Javadoc for Spliterator
    • S8064330: Remove SHA224 from the default support list if SunMSCAPI enabled
    • S8065579: WB method to start G1 concurrent mark cycle should be introduced
    • S8065986: Compiler fails to NullPointerException when calling super with Object<>()
    • S8066974: Compiler doesn't infer method's generic type information in lambda body
    • S8067800: Clarify java.time.chrono.Chronology.isLeapYear for out of range years
    • S8068033: JNI exception pending in jdk/src/share/bin/java.c
    • S8068042: Check jdk/src/share/native/sun/misc/URLClassPath.c for JNI pending
    • S8068162: jvmtiRedefineClasses.cpp: guarantee(false) failed: OLD and/or OBSOLETE method(s) found
    • S8068254: Method reference uses wrong qualifying type
    • S8074696: Remote debugging session hangs for several minutes …

Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrary code. (CVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)

A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit this to expose sensitive data over the network or possibly execute arbitrary code. (CVE-2016-3458)

Multiple vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2016-3500, CVE-2016-3508)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit this to expose sensitive data over the network. (CVE-2016-3550)

Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrary code. (CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)

A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit this to expose sensitive data over the network or possibly execute arbitrary code. (CVE-2016-3458)

Multiple vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2016-3500, CVE-2016-3508)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit this to expose sensitive data over the network. (CVE-2016-3550)