업데이트 : 2017.01.22
이름     : java-1.8.0-openjdk-5:1.8.0.121-0.b13.el7_3
벤더     : AnNyung Packaging Team

설명     :

    The OpenJDK runtime environment.

변경사항

    - update 1.8.0-121.b13
    - security fix
      . CVE-2016-5546
        It was discovered that the Libraries component of OpenJDK accepted ECSDA
        signatures using non-canonical DER encoding. This could cause a Java application
        to accept signature in an incorrect format not accepted by other cryptographic
        tools.
      . CVE-2016-5547
        It was discovered that the Libraries component of OpenJDK did not validate the
        length of the object identifier read from the DER input before allocating memory
        to store the OID. An attacker able to make a Java application decode a specially
        crafted DER input could cause the application to consume an excessive amount of
        memory.
      . CVE-2016-5548
        A covert timing channel flaw was found in the DSA implementation in the
        Libraries component of OpenJDK. A remote attacker could possibly use this flaw
        to extract certain information about the used key via a timing side channel.
      . CVE-2016-5552
        It was discovered that the Networking component of OpenJDK failed to properly
        parse user info from the URL. A remote attacker could cause a Java application
        to incorrectly parse an attacker supplied URL and interpret it differently from
        other applications processing the same URL.
      . CVE-2017-3231, CVE-2017-3261
        Multiple flaws were found in the Networking components in OpenJDK. An
        untrusted Java application or applet could use these flaws to bypass certain
        Java sandbox restrictions.
      . CVE-2017-3241
        It was discovered that the RMI registry and DCG implementations in the RMI
        component of OpenJDK performed deserialization of untrusted inputs. A remote
        attacker could possibly use this flaw to execute arbitrary code with the
        privileges of RMI registry or a Java RMI application.
      . CVE-2017-3252
        It was discovered that the JAAS component of OpenJDK did not use the correct
        way to extract user DN from the result of the user search LDAP query. A
        specially crafted user LDAP entry could cause the application to use an
        incorrect DN.
      . CVE-2017-3253
        It was discovered that the 2D component of OpenJDK performed parsing of iTXt
        and zTXt PNG image chunks even when configured to ignore metadata. An attacker
        able to make a Java application parse a specially crafted PNG image could cause
        the application to consume an excessive amount of memory.
      . CVE-2017-3272, CVE-2017-3289
        Multiple flaws were discovered in the Libraries and Hotspot components in
        OpenJDK. An untrusted Java application or applet could use these flaws to
        completely bypass Java sandbox restrictions.
      . CVE-2016-2183
        A flaw was found in the way the DES/3DES cipher was used as part of the
        TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover
        some plaintext data by capturing large amounts of encrypted traffic between
        TLS/SSL server and client if the communication used a DES/3DES based
        ciphersuite.

업데이트 패키지

    SRPMS:
        . java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.src.rpm

    x86_64:
        . java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.x86_64.rpm
        . java-1.8.0-openjdk-accessibility-1.8.0.121-0.b13.el7_3.x86_64.rpm
        . java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el7_3.x86_64.rpm
        . java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.x86_64.rpm
        . java-1.8.0-openjdk-devel-gui-1.8.0.121-0.b13.el7_3.x86_64.rpm
        . java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.x86_64.rpm
        . java-1.8.0-openjdk-src-1.8.0.121-0.b13.el7_3.x86_64.rpm

    noarch:
        . java-1.8.0-openjdk-javadoc-1.8.0.121-0.b13.el7_3.noarch.rpm