[ubuntu/bionic-proposed] openjdk-8 8u151-b12-1 (Accepted)

Matthias Klose doko at ubuntu.com
Wed Nov 1 06:30:28 UTC 2017 

openjdk-8 (8u151-b12-1) unstable; urgency=high

  * Update to 8u151-b12. Hotspot 8u144-b01 for aarch32 with 8u151 hotspot
    patches.

  [ Tiago Stürmer Daitx ]
  * Security patches:
    - CVE-2017-10274, S8169026: Handle smartcard clean up better. If a
      CardImpl can be recovered via finalization, then separate instances
      pointing to the same device can be created.
    - CVE-2017-10281, S8174109: Better queuing priorities. PriorityQueue's
      readObject allocates an array based on data in the stream which could
      cause an OOM.
    - CVE-2017-10285, S8174966: Unreferenced references. RMI's Unreferenced
      thread can be used as the root of a Trusted Method Chain.
    - CVE-2017-10295, S8176751: Better URL connections. On Ubuntu (and
      possibly other Linux flavors) CR-NL in the host field are ignored and
      can be used to inject headers in an HTTP request stream.
    - CVE-2017-10388, S8178794: Correct Kerberos ticket grants. Kerberos
      implementations can incorrectly take information from the unencrypted
      portion of the ticket from the KDC. This can lead to an MITM attack
      impersonating Kerberos services.
    - CVE-2017-10346, S8180711: Better alignment of special invocations. A
      missing load constraint for some invokespecial cases can allow invoking
      a method from an unrelated class.
    - CVE-2017-10350, S8181100: Better Base Exceptions. An array is allocated
      based on data in the serial stream without a limit onthe size.
    - CVE-2017-10347, S8181323: Better timezone processing. An array is
      allocated based on data in the serial stream without a limit on the
      size.
    - CVE-2017-10349, S8181327: Better Node predications. An array is
      allocated based on data in the serial stream without a limit onthe size.
    - CVE-2017-10345, S8181370: Better keystore handling. A malicious
      serialized object in a keystore can cause a DoS when using keytool.
    - CVE-2017-10348, S8181432: Better processing of unresolved permissions.
      An array is allocated based on data in the serial stream without a limit
      onthe size.
    - CVE-2017-10357, S8181597: Process Proxy presentation. A malicious
      serialized stream could cause an OOM due to lack on checking on the
      number of interfaces read from the stream for a Proxy.
    - CVE-2017-10355, S8181612: More stable connection processing. If an
      attack can cause an application to open a connection to a malicious FTP
      server (e.g., via XML), then a thread can be tied up indefinitely in
      accept(2).
    - CVE-2017-10356, S8181692: Update storage implementations. JKS and JCEKS
      keystores should be retired from common use in favor of more modern
      keystore protections.
    - CVE-2016-10165, S8183028: Improve CMS header processing. Missing bounds
      check could lead to leaked memory contents.
    - CVE-2016-9841, S8184682: Upgrade compression library. There were four
      off by one errors found in the zlib library. Two of them are long typed
      which could lead to RCE.
  * debian/rules:
    - openjdk8 now ships limited and unlimited policy.jar files (S8157561)
      into their own directories under jre/lib/security/policy.
  * debian/rules, d/p/sec-webrev-8u151-hotspot-8179084.patch,
    d/p/sec-webrev-8u151-hotspot-8180711.patch: Apply hotspot security updates
    to both aarch32 and aarch64.
  * d/p/gcc6.diff, d/p/aarch64.diff, d/p/aarch32.diff, d/p/m68k-support.diff,
    d/p/system-libjpeg.diff: Remove hunks related to the generated configure
    file generated during the build.
  * d/p/hotspot-ppc64el-S8168318-cmpldi.patch: Use cmpldi instead of li/cmpld.
    LP: #1723893.
  * d/p/hotspot-ppc64el-S8170328-andis.patch: Use andis instead of lis/and.
    LP: #1723862.
  * d/p/hotspot-ppc64el-S8145913-montgomery-multiply-intrinsic.patch: Add
    Montgomery multiply intrinsic. LP: #1723860.
  * d/p/hotspot-ppc64el-S8181810-leverage-extrdi.patch: Leverage extrdi for
    bitfield extract is absent in OpenJDK 8. LP: #1723861.
  * d/p/jdk-S8165852-overlayfs.patch: Mount point not found for a file which
    is present in overlayfs.

  [ Matthias Klose ]
  * Bump standards version.

Date: Wed, 01 Nov 2017 07:12:56 +0100
Changed-By: Matthias Klose <doko at ubuntu.com>
Maintainer: OpenJDK Team <openjdk at lists.launchpad.net>
https://launchpad.net/ubuntu/+source/openjdk-8/8u151-b12-1
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 01 Nov 2017 07:12:56 +0100
Source: openjdk-8
Binary: openjdk-8-jdk-headless openjdk-8-jre-headless openjdk-8-jdk openjdk-8-jre openjdk-8-demo openjdk-8-source openjdk-8-doc openjdk-8-dbg openjdk-8-jre-zero
Architecture: source
Version: 8u151-b12-1
Distribution: bionic
Urgency: high
Maintainer: OpenJDK Team <openjdk at lists.launchpad.net>
Changed-By: Matthias Klose <doko at ubuntu.com>
Description:
 openjdk-8-dbg - Java runtime based on OpenJDK (debugging symbols)
 openjdk-8-demo - Java runtime based on OpenJDK (demos and examples)
 openjdk-8-doc - OpenJDK Development Kit (JDK) documentation
 openjdk-8-jdk - OpenJDK Development Kit (JDK)
 openjdk-8-jdk-headless - OpenJDK Development Kit (JDK) (headless)
 openjdk-8-jre - OpenJDK Java runtime, using
 openjdk-8-jre-headless - OpenJDK Java runtime, using  (headless)
 openjdk-8-jre-zero - Alternative JVM for OpenJDK, using Zero/Shark
 openjdk-8-source - OpenJDK Development Kit (JDK) source files
Changes:
 openjdk-8 (8u151-b12-1) unstable; urgency=high
 .
   * Update to 8u151-b12. Hotspot 8u144-b01 for aarch32 with 8u151 hotspot
     patches.
 .
   [ Tiago Stürmer Daitx ]
   * Security patches:
     - CVE-2017-10274, S8169026: Handle smartcard clean up better. If a
       CardImpl can be recovered via finalization, then separate instances
       pointing to the same device can be created.
     - CVE-2017-10281, S8174109: Better queuing priorities. PriorityQueue's
       readObject allocates an array based on data in the stream which could
       cause an OOM.
     - CVE-2017-10285, S8174966: Unreferenced references. RMI's Unreferenced
       thread can be used as the root of a Trusted Method Chain.
     - CVE-2017-10295, S8176751: Better URL connections. On Ubuntu (and
       possibly other Linux flavors) CR-NL in the host field are ignored and
       can be used to inject headers in an HTTP request stream.
     - CVE-2017-10388, S8178794: Correct Kerberos ticket grants. Kerberos
       implementations can incorrectly take information from the unencrypted
       portion of the ticket from the KDC. This can lead to an MITM attack
       impersonating Kerberos services.
     - CVE-2017-10346, S8180711: Better alignment of special invocations. A
       missing load constraint for some invokespecial cases can allow invoking
       a method from an unrelated class.
     - CVE-2017-10350, S8181100: Better Base Exceptions. An array is allocated
       based on data in the serial stream without a limit onthe size.
     - CVE-2017-10347, S8181323: Better timezone processing. An array is
       allocated based on data in the serial stream without a limit on the
       size.
     - CVE-2017-10349, S8181327: Better Node predications. An array is
       allocated based on data in the serial stream without a limit onthe size.
     - CVE-2017-10345, S8181370: Better keystore handling. A malicious
       serialized object in a keystore can cause a DoS when using keytool.
     - CVE-2017-10348, S8181432: Better processing of unresolved permissions.
       An array is allocated based on data in the serial stream without a limit
       onthe size.
     - CVE-2017-10357, S8181597: Process Proxy presentation. A malicious
       serialized stream could cause an OOM due to lack on checking on the
       number of interfaces read from the stream for a Proxy.
     - CVE-2017-10355, S8181612: More stable connection processing. If an
       attack can cause an application to open a connection to a malicious FTP
       server (e.g., via XML), then a thread can be tied up indefinitely in
       accept(2).
     - CVE-2017-10356, S8181692: Update storage implementations. JKS and JCEKS
       keystores should be retired from common use in favor of more modern
       keystore protections.
     - CVE-2016-10165, S8183028: Improve CMS header processing. Missing bounds
       check could lead to leaked memory contents.
     - CVE-2016-9841, S8184682: Upgrade compression library. There were four
       off by one errors found in the zlib library. Two of them are long typed
       which could lead to RCE.
   * debian/rules:
     - openjdk8 now ships limited and unlimited policy.jar files (S8157561)
       into their own directories under jre/lib/security/policy.
   * debian/rules, d/p/sec-webrev-8u151-hotspot-8179084.patch,
     d/p/sec-webrev-8u151-hotspot-8180711.patch: Apply hotspot security updates
     to both aarch32 and aarch64.
   * d/p/gcc6.diff, d/p/aarch64.diff, d/p/aarch32.diff, d/p/m68k-support.diff,
     d/p/system-libjpeg.diff: Remove hunks related to the generated configure
     file generated during the build.
   * d/p/hotspot-ppc64el-S8168318-cmpldi.patch: Use cmpldi instead of li/cmpld.
     LP: #1723893.
   * d/p/hotspot-ppc64el-S8170328-andis.patch: Use andis instead of lis/and.
     LP: #1723862.
   * d/p/hotspot-ppc64el-S8145913-montgomery-multiply-intrinsic.patch: Add
     Montgomery multiply intrinsic. LP: #1723860.
   * d/p/hotspot-ppc64el-S8181810-leverage-extrdi.patch: Leverage extrdi for
     bitfield extract is absent in OpenJDK 8. LP: #1723861.
   * d/p/jdk-S8165852-overlayfs.patch: Mount point not found for a file which
     is present in overlayfs.
 .
   [ Matthias Klose ]
   * Bump standards version.
Checksums-Sha1:
 d811bdaf2a49677cc0c3ebeb7a65c4b4a4551708 4456 openjdk-8_8u151-b12-1.dsc
 88d3574f63bd94c1e32c130c1b71e273e5a28ae5 70121877 openjdk-8_8u151-b12.orig.tar.gz
 794f8c6980956bdcfcb19efb58413f611de8cc86 252832 openjdk-8_8u151-b12-1.debian.tar.xz
 57583480b8e6709b68dd6f9d26fc290d83aa6a78 15733 openjdk-8_8u151-b12-1_source.buildinfo
Checksums-Sha256:
 96f2d6982f2de7d9006d851b7cbf9dfebb300c57bb65e3090c03e339cd2388eb 4456 openjdk-8_8u151-b12-1.dsc
 3a81eb858ceadaab9a14190aae800aace0f1b5f86b2e9707b9a9e30b7aca248c 70121877 openjdk-8_8u151-b12.orig.tar.gz
 eb56f974b8761e9287037b40d1eefb8ebd4773739c3d13a5f7e9b65ae69ace1a 252832 openjdk-8_8u151-b12-1.debian.tar.xz
 89074e77d48765244c1a0cbfaa5b6e5405927edd90c7bae6a10e04e94a1b4c02 15733 openjdk-8_8u151-b12-1_source.buildinfo
Files:
 e756f4c7b1cd8fe4060924df284738d5 4456 java optional openjdk-8_8u151-b12-1.dsc
 5d5befdaf8f6df93befa5fc8c69e786d 70121877 java optional openjdk-8_8u151-b12.orig.tar.gz
 234de2af1b6b18d223d7add1f09b9598 252832 java optional openjdk-8_8u151-b12-1.debian.tar.xz
 4e4d2ee238124add8325035773f362b5 15733 java optional openjdk-8_8u151-b12-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQItBAEBCAAXBQJZ+Wk1EBxkb2tvQHVidW50dS5jb20ACgkQvX6qYHePpvVFXQ//
S3wP0LOkoebIXVoyMlkSeEgfgG69H245Si3kf8VGJrVbt2IVOTZGr4jU8Pe1pH+9
KpycU7SuDcCXJ/1PJCK/E+/xQqu7sUdCBBAf3Q1d0Rg90zxeSFKh9dN/e+rTFMSM
FpbDIxug2ib0D99eHq6qYJVFm7OeCejn10TNXZjf8e5RqarNQBDJODCFSLUJBSMA
VlRVs+08VSpzvEEt5PDsYJJB6n4al+dWzj4ZqC836szwYf/oSx0NtEVYo61iTBiu
rIzSOZA9DqpUGuvuRI1TybHIHPXzbo4XWyulW+hq9fXOnr3md8+bztOVU1vLjMGb
70wQ9C5MbOFeZCWqQybhlqnPwLlAJkHppKNGDEk3/tsIbkoTf3v0KoFtm8NqKpf2
3S4DmSri5CY3dbdlFj5Jn2PejGEyleP4I8ADebhOIiUTDZxCdy7lNmuVAHsg3vI8
Yhq5+5zMp/GuYWFf9a3kj7rT8Bd2VTO+5lRqYO4FRRXzbOM/csFwlpHszt8YGLx3
+x+MLP5WI3BvI0Mz1ti4dErRBCRXgynH1f51Zh5TYU1oso4Wi+THK7BeNB+VAcSE
AbncOhIY7175MTQsdKMWg9tLT7Zs5q/Uv2WvAut81ZMCmMLY3Ndwn51e5IdWnHu6
HLnAtoUPp+TPJgZwBSypdzUwnvZ8pYf2shOMJ1uMgek=
=d1bt
-----END PGP SIGNATURE-----

More information about the Bionic-changes mailing list