Add GLSA 201603-14

1 files changed, 135 insertions, 0 deletions

diff --git a/glsa-201603-14.xml b/glsa-201603-14.xml
new file mode 100644
index 00000000..94c1808d
--- /dev/null
+++ b/glsa-201603-14.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201603-14">
+  <title>IcedTea: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in IcedTea allowing remote
+    attackers to affect confidentiality, integrity, and availability through
+    various vectors.
+  </synopsis>
+  <product type="ebuild"></product>
+  <announced>March 12, 2016</announced>
+  <revised>March 12, 2016: 1</revised>
+  <bug>537940</bug>
+  <bug>559532</bug>
+  <bug>565842</bug>
+  <bug>567850</bug>
+  <bug>572716</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/icedtea" auto="yes" arch="*">
+      <unaffected range="ge">7.2.6.4</unaffected>
+      <unaffected range="rge">6.1.13.9</unaffected>
+      <vulnerable range="lt">7.2.6.4</vulnerable>
+    </package>
+    <package name="dev-java/icedtea-bin" auto="yes" arch="*">
+      <unaffected range="ge">7.2.6.4</unaffected>
+      <unaffected range="rge">6.1.13.9</unaffected>
+      <vulnerable range="lt">7.2.6.4</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>IcedTea’s aim is to provide OpenJDK in a form suitable for easy
+      configuration, compilation and distribution with the primary goal of
+      allowing inclusion in GNU/Linux distributions.
+    </p>
+  </background>
+  <description>
+    <p>Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,
+      Libraries, and JAXP, exist which allows remote attackers to affect the
+      confidentiality, integrity, and availability of vulnerable systems.  This
+      includes the possibility of remote execution of arbitrary code,
+      information disclosure, or Denial of Service.  Many of the
+      vulnerabilities can only be exploited through sandboxed Java Web Start
+      applications and java applets.  Please reference the CVEs listed for
+      specific details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>Remote attackers may remotely execute arbitrary code, compromise
+      information, or cause Denial of Service.
+    </p>
+  </impact>
+  <workaround>
+    <p>There is no known work around at this time.</p>
+  </workaround>
+  <resolution>
+    <p>IcedTea 7.x users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-java/icedtea-7.2.6.4"
+    </code>
+    
+    <p>IcedTea bin 7.x users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-java/icedtea-bin-7.2.6.4"
+    </code>
+    
+    <p>IcedTea 6.x users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-java/icedtea-6.1.13.9"
+    </code>
+    
+    <p>IcedTea bin 6.x users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose "&gt;=dev-java/icedtea-bin-6.1.13.9"
+    </code>
+  </resolution>
+  <references>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6585">CVE-2014-6585</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6587">CVE-2014-6587</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6591">CVE-2014-6591</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6593">CVE-2014-6593</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6601">CVE-2014-6601</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0383">CVE-2015-0383</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0395">CVE-2015-0395</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0400">CVE-2015-0400</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0407">CVE-2015-0407</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0408">CVE-2015-0408</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0412">CVE-2015-0412</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2590">CVE-2015-2590</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2601">CVE-2015-2601</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2613">CVE-2015-2613</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2621">CVE-2015-2621</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2625">CVE-2015-2625</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2628">CVE-2015-2628</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2632">CVE-2015-2632</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4731">CVE-2015-4731</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4732">CVE-2015-4732</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4733">CVE-2015-4733</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4734">CVE-2015-4734</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4748">CVE-2015-4748</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4749">CVE-2015-4749</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4760">CVE-2015-4760</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4803">CVE-2015-4803</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4805">CVE-2015-4805</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4806">CVE-2015-4806</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4835">CVE-2015-4835</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4840">CVE-2015-4840</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4842">CVE-2015-4842</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4843">CVE-2015-4843</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4844">CVE-2015-4844</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4860">CVE-2015-4860</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4871">CVE-2015-4871</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4872">CVE-2015-4872</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4881">CVE-2015-4881</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4882">CVE-2015-4882</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4883">CVE-2015-4883</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4893">CVE-2015-4893</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4903">CVE-2015-4903</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4911">CVE-2015-4911</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0402">CVE-2016-0402</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0448">CVE-2016-0448</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0466">CVE-2016-0466</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0483">CVE-2016-0483</uri>
+    <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0494">CVE-2016-0494</uri>
+  </references>
+  <metadata tag="requester" timestamp="Thu, 16 Jul 2015 14:44:12 +0000">K_F</metadata>
+  <metadata tag="submitter" timestamp="Sat, 12 Mar 2016 23:37:32 +0000">b-man</metadata>
+</glsa>