Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427

It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0686) It was discovered that the Hotspot component of OpenJDK did not properly handle byte types. An untrusted Java application or applet could use this flaw to corrupt Java virtual machine memory and possibly execute arbitrary code, bypassing Java sandbox restrictions. (CVE-2016-0687) It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427) It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425) It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695) It was discovered that the GCM (Galois/Counter Mode) implementation in the JCE component of OpenJDK used non-constant time comparison when comparing GCM authentication tag. A remote attacker could possibly use this flaw to determine correct value of the authentication tag and bypass authentication protections of GCM. (CVE-2016-3426)

Source

ALAS-2016-688

Amazon Linux AMI Security Advisory: ALAS-2016-688
Advisory Release Date: 2016-04-21 16:00 Pacific
Advisory Updated Date: 2016-04-21 16:00 Pacific

Severity: Critical

References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427

Issue Overview:

It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0686)

It was discovered that the Hotspot component of OpenJDK did not properly handle byte types. An untrusted Java application or applet could use this flaw to corrupt Java virtual machine memory and possibly execute arbitrary code, bypassing Java sandbox restrictions. (CVE-2016-0687)

It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427)

It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425)

It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695)

It was discovered that the GCM (Galois/Counter Mode) implementation in the JCE component of OpenJDK used non-constant time comparison when comparing GCM authentication tag. A remote attacker could possibly use this flaw to determine correct value of the authentication tag and bypass authentication protections of GCM. (CVE-2016-3426)

Affected Packages:

java-1.8.0-openjdk

Issue Correction:
Run yum update java-1.8.0-openjdk to update your system.

New Packages:

i686:
    java-1.8.0-openjdk-headless-1.8.0.91-0.b14.10.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.91-0.b14.10.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.91-0.b14.10.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.91-0.b14.10.amzn1.i686
    java-1.8.0-openjdk-demo-1.8.0.91-0.b14.10.amzn1.i686
    java-1.8.0-openjdk-1.8.0.91-0.b14.10.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-1.8.0.91-0.b14.10.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.91-0.b14.10.amzn1.src

x86_64:
    java-1.8.0-openjdk-headless-1.8.0.91-0.b14.10.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.91-0.b14.10.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.91-0.b14.10.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.91-0.b14.10.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.91-0.b14.10.amzn1.x86_64
    java-1.8.0-openjdk-demo-1.8.0.91-0.b14.10.amzn1.x86_64

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS-2016-688

ALAS-2016-688

Vulmon Search

About

Products

Connect