CVE-2018-2941

Debian Bug report logs - #905215
CVE-2018-2941

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2018-2941

Date: Wed, 01 Aug 2018 16:45:30 +0200

Source: openjfx
Severity: grave
Tags: security

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
fixed CVE-2018-2941 in JavaFX, which should affect our openjfx package.

Cheers,
        Moritz

Message #10 received at 905215@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>

Cc: 905215@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: CVE-2018-2941

Date: Sun, 7 Oct 2018 13:04:38 +0200

[Message part 1 (text/plain, inline)]

Hi,

On Wed, 01 Aug 2018 16:45:30 +0200 Moritz Muehlenhoff <jmm@debian.org>
wrote:
> Source: openjfx
> Severity: grave
> Tags: security
> 
> http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
> fixed CVE-2018-2941 in JavaFX, which should affect our openjfx package.

We have recently upgraded OpenJFX to version 11. It is not listed as a
vulnerable version in Oracle's security advisory. I presume if it has
been vulnerable they would have fixed it in OpenJFX 11 too by now. Do
you have more information about this vulnerability because I can't find
any details on the web.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 905215@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Markus Koschany <apo@debian.org>

Cc: 905215@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: CVE-2018-2941

Date: Sun, 7 Oct 2018 13:16:07 +0200

On Sun, Oct 07, 2018 at 01:04:38PM +0200, Markus Koschany wrote:
> Hi,
> 
> On Wed, 01 Aug 2018 16:45:30 +0200 Moritz Muehlenhoff <jmm@debian.org>
> wrote:
> > Source: openjfx
> > Severity: grave
> > Tags: security
> > 
> > http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
> > fixed CVE-2018-2941 in JavaFX, which should affect our openjfx package.
> 
> We have recently upgraded OpenJFX to version 11. It is not listed as a
> vulnerable version in Oracle's security advisory. I presume if it has
> been vulnerable they would have fixed it in OpenJFX 11 too by now. Do
> you have more information about this vulnerability because I can't find
> any details on the web.

No, unfortunately it's the same "we fix, but don't tell" bullshit policy
as with all other Oracle products.

Given that mediathekview is our only reverse dependency in stretch we
can probably mark it as ignored for stretch anyway?

Cheers,
        Moritz

Message #20 received at 905215@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Moritz Muehlenhoff <jmm@inutil.org>

Cc: 905215@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: CVE-2018-2941

Date: Sun, 7 Oct 2018 13:29:01 +0200

[Message part 1 (text/plain, inline)]

Am 07.10.18 um 13:16 schrieb Moritz Muehlenhoff:
[...]
> No, unfortunately it's the same "we fix, but don't tell" bullshit policy
> as with all other Oracle products.
> 
> Given that mediathekview is our only reverse dependency in stretch we
> can probably mark it as ignored for stretch anyway?
> 
> Cheers,
>         Moritz

Ok. MediathekView in Stretch only uses JavaFX to create some better
integrated Panel messages or to improve performance. If I read the
advisory correctly CVE-2018-2941 affects Java Web Start or Java applets
but MediathekView is a desktop application and doesn't use those
classes, so I believe it cannot be exploited. Ignored for Stretch makes
sense.

Cheers,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #25 received at 905215-done@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: 905215-done@bugs.debian.org

Subject: Re: CVE-2018-2941

Date: Wed, 31 Oct 2018 12:59:40 +0100

[Message part 1 (text/plain, inline)]

Version: 11+26-1

As previously stated I believe this issue was fixed in OpenJFX 11.
However there is no way to prove it because Oracle didn't release any
publicly available information about the details. I am going to close
this bug report now but feel free to reopen it, if you can share more
information about CVE-2018-2941.

Markus

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.