CVE-2016-10165

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-1_8_0-openjdk fixes the following issues:

• Update to version jdk8u151 (icedtea 3.6.0)

Security issues fixed:

• CVE-2017-10274: Handle smartcard clean up better (bsc#1064071)
• CVE-2017-10281: Better queuing priorities (bsc#1064072)
• CVE-2017-10285: Unreferenced references (bsc#1064073)
• CVE-2017-10295: Better URL connections (bsc#1064075)
• CVE-2017-10388: Correct Kerberos ticket grants (bsc#1064086)
• CVE-2017-10346: Better invokespecial checks (bsc#1064078)
• CVE-2017-10350: Better Base Exceptions (bsc#1064082)
• CVE-2017-10347: Better timezone processing (bsc#1064079)
• CVE-2017-10349: Better X processing (bsc#1064081)
• CVE-2017-10345: Better keystore handling (bsc#1064077)
• CVE-2017-10348: Better processing of unresolved permissions (bsc#1064080)
• CVE-2017-10357: Process Proxy presentation (bsc#1064085)
• CVE-2017-10355: More stable connection processing (bsc#1064083)
• CVE-2017-10356: Update storage implementations (bsc#1064084)
• CVE-2016-10165: Improve CMS header processing (bsc#1064069)
• CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843: Upgrade compression library (bsc#1064070)

Bug fixes:

• Fix bsc#1032647, bsc#1052009 with btrfs subvolumes and overlayfs

This update for java-1_8_0-ibm fixes the following issues:

Security issues fixed:

• Security update to version 8.0.5.5 (bsc#1070162)
  • CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10309 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2016-10165 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345

This update for java-1_7_1-ibm fixes the following issues:

• CVE-2017-10349: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

• CVE-2017-10348: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

• CVE-2017-10388: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

• CVE-2016-9841: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be…

This update for java-1_7_1-ibm fixes the following issues:

• Security update to version 7.1.4.15 [bsc#1070162]

  • CVE-2017-10349: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  • CVE-2017-10348: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  • CVE-2017-10388: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  • CVE-2016-9841: 'Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java…

This update for java-1_7_0-openjdk fixes the following issues:

Security issues fixed:

• CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084).
• CVE-2017-10274: Fix issue inside subcomponent Smart Card IO (bsc#1064071).
• CVE-2017-10281: Fix issue inside subcomponent Serialization (bsc#1064072).
• CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073).
• CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075).
• CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086).
• CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078).
• CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082).
• CVE-2017-10347: Fix issue inside subcomponent Serialization (bsc#1064079).
• CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081).
• CVE-2017-10345: Fix issue inside subcomponent Serialization (bsc#1064077).
• CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080).
• CVE-2017-10357: Fix issue inside subcomponent Serialization (bsc#1064085).
• CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083).
• CVE-2017-10102: Fix incorrect handling of references in DGC (bsc#1049316).
• CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader (bsc#1049305).
• CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest (bsc#1049306).
• CVE-2017-10081: Fix incorrect bracket processing in function signature handling (bsc#1049309).
• CVE-2017-10087: Fix insufficient access control checks in ThreadPoolExecutor (bsc#1049311).
• CVE-2017-10089: Fix insufficient access control checks in ServiceRegistry (bsc#1049312).
• CVE-2017-10090: Fix insufficient access control checks in AsynchronousChannelGroupImpl (bsc#1049313).
• CVE-2017-10096: Fix insufficient access control checks in XML transformations (bsc#1049314).
• CVE-2017-10101: Fix unrestricted access to com.sun.org.apache.xml.internal.resolver (bsc#1049315).
• CVE-2017-10107: Fix insufficient access control checks in ActivationID (bsc#1049318).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10110: Fix insufficient access control checks in ImageWatched (bsc#1049321).
• CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute deserialization (bsc#1049319).
• CVE-2017-10109: Fix unbounded memory allocation in CodeSource deserialization (bsc#1049320).
• CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE (bsc#1049324).
• CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326).
• CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL (bsc#1049325).
• CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328).
• CVE-2017-10176: Fix incorrect handling of certain EC points (bsc#1049329).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322).
• CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS (bsc#1049332).
• CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment (bsc#1049327).
• CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX (bsc#1049323).
• CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment (bsc#1049317).
• CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310).
• CVE-2017-10198: Fix incorrect enforcement of certificate path restrictions (bsc#1049331).
• CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330).

Bug fixes:

• Drop Exec Shield workaround to fix crashes on recent kernels, where Exec Shield is gone (bsc#1052318).

This update for java-1_7_0-ibm fixes the following issues:

• Security update to version 7.0.10.15 (bsc#1070162):
  • CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2016-10165 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345

This update for lcms2 fixes the following security issues:

• CVE-2016-10165: The Type_MLU_Read function allowed remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggered an out-of-bounds heap read (bsc#1021364).
• CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813)
• Ensure that LUT stages match channel count (bsc#1026649).
• sanitize input and output channels on MPE profiles (bsc#1026650).

Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-10165)

Quang Nguyen discovered that Little CMS incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-16435)