ESB-2020.3772 – [Debian] openjdk-8: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.3772
                         openjdk-8 security update
                              2 November 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           openjdk-8
Publisher:         Debian
Operating System:  Debian GNU/Linux
Impact/Access:     Modify Arbitrary Files   -- Remote/Unauthenticated
                   Denial of Service        -- Remote/Unauthenticated
                   Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-14803 CVE-2020-14798 CVE-2020-14797
                   CVE-2020-14796 CVE-2020-14792 CVE-2020-14782
                   CVE-2020-14781 CVE-2020-14779 

Reference:         ASB-2020.0175
                   ESB-2020.3664
                   ESB-2020.3771

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2412-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/               Emilio Pozuelo Monfort
October 23, 2020                              https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------

Package        : openjdk-8
Version        : 8u272-b10-0+deb9u1
CVE ID         : CVE-2020-14779 CVE-2020-14781 CVE-2020-14782 CVE-2020-14792
                 CVE-2020-14796 CVE-2020-14797 CVE-2020-14798 CVE-2020-14803

Several vulnerabilities have been discovered in the OpenJDK Java runtime,
resulting in denial of service, bypass of sandbox restrictions or
information disclosure.

For Debian 9 stretch, these problems have been fixed in version
8u272-b10-0+deb9u1.

We recommend that you upgrade your openjdk-8 packages.

For the detailed security status of openjdk-8 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openjdk-8

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAl+b2UgACgkQnUbEiOQ2
gwKmMQ//UpsuIgrZlPtO5vsQ0cGna/0XeVg+6XPVN3PhxhCSP6ynl5LO+kAOIYS4
TxDKb2HZsgx39pnZy1bFZ2tbnhYUutkmvbnnzyRaILoS+FW7AjVEg+opTjQCNP/K
T7D2DHuolXEce9iR47IZrCm1czs50I+XU0XlfACE/jDCB2a9B9mVLhcK9aXwSrD/
/dBeJaAQ79rKrI7u3ujqq1bwaIR2h0Y4nDl+K3XBN7pxu0lgpC3PX5rR3p69/OKY
z2fApb+9f9lCM5FYyaDUu0u4lnvHhWTEttupakyPBrjWtEql7UtBMVtln/JKpz6n
VWUI0jPiBcB/CvCYeyJ1nkadjnlzqdIr34HxB0jbObHIvBN/r0/6aRiu/BcBPGa8
+2UWsTnCNiQ5w5u/Vn5ZBiF3Y5P82aPnKl6EAI2GbCjun1jWwYxzLiwStQTqa0UC
cKt/d1GdFxgmtzid5gqMDk9uBI/yNn163TIcc6W2ite9ZrthjhMZPko0Y1JAc6o2
N3rmaE2TEsRZbksUigmChXN/dY4rFThN6dz+lp3pXzfWBf9CW39k2C8VnPfSF1/P
xkyCnCAiedTGA3zYNmfYMPNIw174dRtDTWKMzi5WTbIFuGag4wlWA7YLh5lNYi9I
FCpCX9VvQUGXvQrQVnkf3paa8N5riRuWi7ba6CkjVyEyCjIyDho=
=8OG0
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBX5+JLeNLKJtyKPYoAQjFwA//cyVKDCcWgSkaeO8qszXAvStwwl20Sllc
5BJvq7c5jR2O3RZrkUgF/npNXPTi6h2on7MBoIR0pORW531QoanB6700t89zNCpo
QKWg/pZKQl/4Syy+T129/seysjFuYKwt86XvbTq/661Cnb/3n6BXZYZ65tQWmyoG
C5ueBpJ/CBp7Fq0h5hLN7yjbyd1ck1Zu0PUaiEH67lWjLVsD9p3acmfIgmlFAuuF
pRBYNQqcsG2J0riPz+fWIuaVcW7mjjmuBghILcdXY7tqUt5q2Qjnz9A3y5x70kXB
Mx/sv+BBIwDGyFDg8Ray7spRZKfHfxWHLPF3TvDIm5ONCiH1a3aVgF15nmrEdo8U
pn4spcXCO4NLXSOEwdHablsI3bocc6Qg++BXPcr04O0GOqKI7N7Tjs5A5KY1sRgF
ySuSabmh0M3AGL7xgIoisGhaMTxkkCK5A1qJGIblLuC5bC6eQ5KelwmqeXSJqCYx
Aapbx7u0tJ2jft25stA2rkVDzuHUg1hr/stNTl8QqO//zNQn8++WEOIKwOyXBFMD
m0Aj3VuHStkdYv+EOxr+ePIg3jWC0gk/3h581zEgUvbA3GPGwQcxjboWAVmsm2jl
t0JUIPbVwYE/zjCfqPt3maf9e3xiGnDHJvy3LSNAB9kKZLYR8uRbYJcKqtZf+hK0
J/mSbhb6htI=
=N2Qz
-----END PGP SIGNATURE-----

Read More

The post ESB-2020.3772 – [Debian] openjdk-8: Multiple vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2020/11/02/esb-2020-3772-debian-openjdk-8-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-3772-debian-openjdk-8-multiple-vulnerabilities