| Summary: | java-1.8.0-openjdk new security issues | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | brtians1, nicolas.salguero, sysadmin-bugs |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/684597/ | ||
| Whiteboard: | has_procedure advisory MGA5-64-OK MGA5-32-OK | ||
| Source RPM: | java-1.8.0-openjdk-1.8.0.77-1.b03.1.mga5.src.rpm | CVE: | |
| Status comment: | |||
| Attachments: | Shell script to download the missing files | ||
|
Description
David Walser
2016-04-21 20:43:58 CEST
See https://bugs.mageia.org/show_bug.cgi?id=14051#c4 for useful links to test java Whiteboard:
(none) =>
has_procedure Same problem as last time. Nicolas, can you help with this again? Maybe rather than regenerating the whole tarball, just make an additional source that includes the missing files. CC:
(none) =>
nicolas.salguero Created attachment 7691 [details]
Shell script to download the missing files
Hi,
The additional source would also need to be updated because the missing files may have been updated since the previous version.
I made a little shell script (which requires mercurial and wget packages to work) to get the missing files from the corresponding version.
I think that, if we use that script, we should add this command in %prep section, after the line "%setup ...":
"tar xjf %{SOURCEx} -C openjdk/jdk --strip-components=1 --overwrite".
Best regards,
Nico.
I think it could be constructed in such a way that it could be added as an additional source argument to %setup so that it wouldn't need another command. I was not able to find the right syntax for %setup macro so I used the "tar ..." command given in comment 3, sorry. I also added "%patch400" in Cauldron version otherwise build failed on "make zip-docs" (I put the line at the same place as in fedora SPEC file). Now, the build is successful. OK, thanks again for the help Nicolas! Whiteboard:
has_procedure feedback =>
has_procedure [brian@localhost ~]$ uname -a Linux localhost 4.1.15-desktop-2.mga5 #1 SMP Wed Jan 20 17:05:51 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux ----installation---- The following 3 packages are going to be installed: - java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64 - java-1.8.0-openjdk-devel-1.8.0.91-1.b14.1.mga5.x86_64 - java-1.8.0-openjdk-headless-1.8.0.91-1.b14.1.mga5.x86_64 18KB of additional disk space will be used. 36MB of packages will be retrieved. ------------------- Before installation [brian@localhost ~]$ java -version openjdk version "1.8.0_77" OpenJDK Runtime Environment (build 1.8.0_77-b03) OpenJDK 64-Bit Server VM (build 25.77-b03, mixed mode) After installation [brian@localhost ~]$ java -version openjdk version "1.8.0_91" OpenJDK Runtime Environment (build 1.8.0_91-b14) OpenJDK 64-Bit Server VM (build 25.91-b14, mixed mode) Ran Eclipse Go into Help | Installation Details | Configuration sun.arch.data.model=64 sun.boot.class.path=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/resources.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/rt.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/sunrsasign.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/jsse.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/jce.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/charsets.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/jfr.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/classes sun.boot.library.path=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.x86_64/jre/lib/amd64 sun.cpu.endian=little Seems to be working properly to me. CC:
(none) =>
brtians1 Linux localhost 4.1.15-desktop-2.mga5 #1 SMP Wed Jan 20 17:37:30 UTC 2016 i686 i686 i686 GNU/Linux The following 6 packages are going to be installed: - java-1.8.0-openjdk-1.8.0.91-1.b14.1.mga5.i586 - java-1.8.0-openjdk-demo-1.8.0.91-1.b14.1.mga5.i586 - java-1.8.0-openjdk-devel-1.8.0.91-1.b14.1.mga5.i586 - java-1.8.0-openjdk-headless-1.8.0.91-1.b14.1.mga5.i586 - java-1.8.0-openjdk-javadoc-1.8.0.91-1.b14.1.mga5.noarch - java-1.8.0-openjdk-src-1.8.0.91-1.b14.1.mga5.i586 93MB of additional disk space will be used. 96MB of packages will be retrieved. openjdk version "1.8.0_91" OpenJDK Runtime Environment (build 1.8.0_91-b14) OpenJDK Server VM (build 25.91-b14, mixed mode) followed links Bill provided: http://www.java.com/en/download/installed.jsp Verified Java Version Completion checkmark Congratulations! You have the recommended Java installed (Version 8 Update 91). http://javatester.org/version.html Successful! Whiteboard:
has_procedure MGA5-64-OK =>
has_procedure MGA5-64-OK MGA5-32-OK
Brian Rockwell
2016-04-23 00:36:10 CEST
Keywords:
(none) =>
validated_update Nice testing Brian. Advisory uploaded. Whiteboard:
has_procedure MGA5-64-OK MGA5-32-OK =>
has_procedure advisory MGA5-64-OK MGA5-32-OK An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0149.html Status:
NEW =>
RESOLVED |