CVE-2016-5582

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573.

It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions (CVE-2016-5582).

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application (CVE-2016-5573).

It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm (CVE-2016-5542).

Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms.

A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions (CVE-2016-5554).

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication (CVE-2016-5597).

Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.111-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.

OpenJDK Java was updated to jdk8u111 (icedtea 3.2.0) to fix the following issues:

• Security fixes
  • S8146490: Direct indirect CRL checks
  • S8151921: Improved page resolution
  • S8155968: Update command line options
  • S8155973, CVE-2016-5542: Tighten jar checks (bsc#1005522)
  • S8156794: Extend data sharing
  • S8157176: Improved classfile parsing
  • S8157739, CVE-2016-5554: Classloader Consistency Checking (bsc#1005523)
  • S8157749: Improve handling of DNS error replies
  • S8157753: Audio replay enhancement
  • S8157759: LCMS Transform Sampling Enhancement
  • S8157764: Better handling of interpolation plugins
  • S8158302: Handle contextual glyph substitutions
  • S8158993, CVE-2016-5568: Service Menu services (bsc#1005525)
  • S8159495: Fix index offsets
  • S8159503: Amend Annotation Actions
  • S8159511: Stack map validation
  • S8159515: Improve indy validation
  • S8159519, CVE-2016-5573: Reformat JDWP messages (bsc#1005526)
  • S8160090: Better signature handling in pack200
  • S8160094: Improve pack200 layout
  • S8160098: Clean up color profiles
  • S8160591, CVE-2016-5582: Improve internal array handling (bsc#1005527)
  • S8160838, CVE-2016-5597: Better HTTP service (bsc#1005528)
  • PR3206, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read()
  • CVE-2016-5556 (bsc#1005524)
• New features
  • PR1370: Provide option to build without debugging
  • PR1375: Provide option to strip and link debugging info after build
  • PR1537: Handle alternative Kerberos credential cache locations
  • PR1978: Allow use of system PCSC
  • PR2445: Support system libsctp
  • PR3182: Support building without pre-compiled headers
  • PR3183: Support Fedora/RHEL system crypto policy
  • PR3221: Use pkgconfig to detect Kerberos CFLAGS and libraries
• Import of OpenJDK 8 u102 build 14
  • S4515292: ReferenceType.isStatic() returns true for arrays
  • S4858370: JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command
  • S6976636: JVM/TI test ex03t001 fails assertion
  • S7185591: jcmd-big-script.sh ERROR: could not find app's Java pid.
  • S8017462: G1: guarantee fails with UseDynamicNumberOfGCThreads
  • S8034168: ThreadMXBean/Locks.java failed, blocked on wrong object
  • S8036006: [TESTBUG] sun/tools/native2ascii/NativeErrors.java fails: Process exit code was 0, but error was expected.
  • S8041781: Need new regression tests for PBE keys
  • S8041787: Need new regressions tests for buffer handling for PBE algorithms
  • S8043836: Need new tests for AES cipher
  • S8044199: Tests for RSA keys and key specifications
  • S8044772: TempDirTest.java still times out with -Xcomp
  • S8046339: sun.rmi.transport.DGCAckHandler leaks memory
  • S8047031: Add SocketPermission tests for legacy socket types
  • S8048052: Permission tests for setFactory
  • S8048138: Tests for JAAS callbacks
  • S8048147: Privilege tests with JAAS Subject.doAs
  • S8048356: SecureRandom default provider tests
  • S8048357: PKCS basic tests
  • S8048360: Test signed jar files
  • S8048362: Tests for doPrivileged with accomplice
  • S8048596: Tests for AEAD ciphers
  • S8048599: Tests for key wrap and unwrap operations
  • S8048603: Additional tests for MAC algorithms
  • S8048604: Tests for strong crypto ciphers
  • S8048607: Test key generation of DES and DESEDE
  • S8048610: Implement regression test for bug fix of 4686632 in JCE
  • S8048617: Tests for PKCS12 read operations
  • S8048618: Tests for PKCS12 write operations.
  • S8048619: Implement tests for converting PKCS12 keystores
  • S8048624: Tests for SealedObject
  • S8048819: Implement reliability test for DH algorithm
  • S8048820: Implement tests for SecretKeyFactory
  • S8048830: Implement tests for new functionality provided in JEP 166
  • S8049237: Need…

This update for java-1_7_0-openjdk fixes the following issues:

• Update to 2.6.8 - OpenJDK 7u121
  • Security fixes
    • S8151921: Improved page resolution
    • S8155968: Update command line options
    • S8155973, CVE-2016-5542: Tighten jar checks (bsc#1005522)
    • S8157176: Improved classfile parsing
    • S8157739, CVE-2016-5554: Classloader Consistency Checking (bsc#1005523)
    • S8157749: Improve handling of DNS error replies
    • S8157753: Audio replay enhancement
    • S8157759: LCMS Transform Sampling Enhancement
    • S8157764: Better handling of interpolation plugins
    • S8158302: Handle contextual glyph substitutions
    • S8158993, CVE-2016-5568: Service Menu services (bsc#1005525)
    • S8159495: Fix index offsets
    • S8159503: Amend Annotation Actions
    • S8159511: Stack map validation
    • S8159515: Improve indy validation
    • S8159519, CVE-2016-5573: Reformat JDWP messages (bsc#1005526)
    • S8160090: Better signature handling in pack200
    • S8160094: Improve pack200 layout
    • S8160098: Clean up color profiles
    • S8160591, CVE-2016-5582: Improve internal array handling (bsc#1005527)
    • S8160838, CVE-2016-5597: Better HTTP service (bsc#1005528)
    • PR3207, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read()
    • CVE-2016-5556 (bsc#1005524)
  • Import of OpenJDK 7 u121 build 0
    • S6624200: Regression test fails: test/closed/javax/swing/JMenuItem/4654927/bug4654927.java
    • S6882559: new JEditorPane('text/plain','') fails for null context class loader
    • S7090158: Networking Libraries don't build with javac -Werror
    • S7125055: ContentHandler.getContent API changed in error
    • S7145960: sun/security/mscapi/ShortRSAKey1024.sh failing on windows
    • S7187051: ShortRSAKeynnn.sh tests should do cleanup before start test
    • S8000626: Implement dead key detection for KeyEvent on Linux
    • S8003890: corelibs test scripts should pass TESTVMOPTS
    • S8005629: javac warnings compiling java.awt.EventDispatchThread and sun.awt.X11.XIconWindow
    • S8010297: Missing isLoggable() checks in logging code
    • S8010782: clean up source files containing carriage return characters
    • S8014431: cleanup warnings indicated by the -Wunused-value compiler option on linux
    • S8015265: revise the fix for 8007037
    • S8016747: Replace deprecated PlatformLogger isLoggable(int) with isLoggable(Level)
    • S8020708: NLS mnemonics missing in SwingSet2/JInternalFrame demo
    • S8024756: method grouping tabs are not selectable
    • S8026741: jdk8 l10n resource file translation update 5
    • S8048147: Privilege tests with JAAS Subject.doAs
    • S8048357: PKCS basic tests
    • S8049171: Additional tests for jarsigner's warnings
    • S8059177: jdk8u40 l10n resource file translation update 1
    • S8075584: test for 8067364 depends on hardwired text advance
    • S8076486: [TESTBUG] javax/security/auth/Subject/doAs/NestedActions.java fails if extra VM options are given
    • S8077953: [TEST_BUG] com/sun/management/OperatingSystemMXBean/TestTotalSwap.java Compilation failed after JDK-8077387
    • S8080628: No mnemonics on Open and Save buttons in JFileChooser
    • S8083601: jdk8u60 l10n resource file translation update 2
    • S8140530: Creating a VolatileImage with size 0,0 results in no longer working g2d.drawString
    • S8142926: OutputAnalyzer's shouldXXX() calls return this
    • S8143134: L10n resource file translation update
    • S8147077: IllegalArgumentException thrown by api/java_awt/Component/FlipBufferStrategy/indexTGF_General
    • S8148127: IllegalArgumentException thrown by JCK test api/java_awt/Component/FlipBufferStrategy/indexTGF_General in opengl pipeline
    • S8150611: Security problem on sun.misc.resources.Messages*
    • S8157653: [Parfait] Uninitialised variable in awt_Font.cpp
    • S8158734:…

It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5582)

It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. (CVE-2016-5542)

It was discovered that the JMX component of OpenJDK did not sufficiently perform classloader consistency checks. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5554)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could use this to send debugging commands to a Java application with debugging enabled. (CVE-2016-5573)

It was discovered that OpenJDK did not properly handle HTTP proxy authentication. An attacker could use this to expose HTTPS server authentication credentials. (CVE-2016-5597)

It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. (CVE-2016-5542)

It was discovered that the JMX component of OpenJDK did not sufficiently perform classloader consistency checks. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5554)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could use this to send debugging commands to a Java application with debugging enabled. (CVE-2016-5573)

It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5582)

It was discovered that OpenJDK did not properly handle HTTP proxy authentication. An attacker could use this to expose HTTPS server authentication credentials. (CVE-2016-5597)