CVE-2016-5542 Ubuntu Security Notification for Openjdk-6 Vulnerabilities (USN-3154-1)

2016年12月15日 1238点热度 0人点赞 0条评论

漏洞类别：Ubuntu

漏洞等级：

漏洞信息

It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification.

It was discovered that the JMX component of OpenJDK did not sufficiently perform classloader consistency checks.

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets.

It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases.

It was discovered that OpenJDK did not properly handle HTTP proxy authentication.

漏洞危害

An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. (CVE-2016-5542)

An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5554)

An attacker could use this to send debugging commands to a Java application with debugging enabled. (CVE-2016-5573)

An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5582)

An attacker could use this to expose HTTPS server authentication credentials. (CVE-2016-5597)

解决方案

Refer to Ubuntu advisory USN-3154-1 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

0day