Bug 1894

Summary: [Security Update Request] Oracle Java SE Critical Patch Update 6u26
Product: Mageia Reporter: Luc Menut <lmenut>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Normal CC: chmielu1_a, davidwhodgins, manuel.mageia, tmb
Version: 1   
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: http://www.oracle.com/technetwork/topics/security/javacpujune2011-313339.html
Whiteboard:
Source RPM: java-1.6.0-sun CVE:
Status comment:

Description Luc Menut 2011-06-23 00:04:58 CEST 
Description of problem:
java-1.6.0-sun needs to be updated to Critical Patch Update 6u26. java-1.6.0-sun-1.6.0.26-0.1.mga1 is available in nonfree/updates_testing.

Java Critical Patch Update is a collection of patches for multiple security vulnerabilities.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible.

Oracle Java SE Executive Summary: (could be used for update announcement)
This Critical Patch Update contains 17 new security fixes for Oracle Java SE - 5 apply to client and server deployments of Java SE, 11 apply to client deployments of Java SE only, and 1 applies to server deployments of Java SE only.  All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

 CVE-2011-0862, CVE-2011-0873, CVE-2011-0815, CVE-2011-0817, CVE-2011-0863,
 CVE-2011-0864, CVE-2011-0802, CVE-2011-0814, CVE-2011-0871, CVE-2011-0786,
 CVE-2011-0788, CVE-2011-0866, CVE-2011-0868, CVE-2011-0872, CVE-2011-0867,
 CVE-2011-0869, CVE-2011-0865




Affected product releases and versions: JDK and JRE 6 Update 25 and earlier
Comment 1 Dave Hodgins 2011-06-23 19:40:24 CEST 
I've installed and tested java-1.6.0-sun-plugin from updates-testing and it is
working on my Mageia 1 i586 installation.

CC: (none) => davidwhodgins

Comment 2 Nicolas Vigier 2011-06-27 21:56:01 CEST 
Thanks for testing. Can you give more details about what you tested ?
For instance which java programs you tried to run after updating the java packages, which commands you ran, etc ...

CC: (none) => boklm

Comment 3 Dave Hodgins 2011-06-28 00:04:19 CEST 
I've checked that http://www.java.com/en/download/testjava.jsp loads in firefox,
and opera.  I also ran a previously compiled copy of
http://download.oracle.com/javase/tutorial/getStarted/cupojava/unix.html
Comment 4 Marcin Ch 2011-07-04 11:36:09 CEST 
When update (urpmi --verbose --auto-update) java-sun:

(noÅnik "Nonfree Updates Testing (distrib15)")
  java-1.6.0-sun                 1.6.0.26     0.1.mga1.non> x86_64  
  java-1.6.0-sun-alsa            1.6.0.26     0.1.mga1.non> x86_64  
  java-1.6.0-sun-fonts           1.6.0.26     0.1.mga1.non> x86_64  
  java-1.6.0-sun-jdbc            1.6.0.26     0.1.mga1.non> x86_64  
  java-1.6.0-sun-plugin          1.6.0.26     0.1.mga1.non> x86_64 

then:

removing upgraded package java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64
/var/tmp/rpm-tmp.VLSbCu: line 13: bÅÄd skÅadni: nieoczekiwany koniec pliku  (syntax error: unexpected end of file)
ostrzeżenie: skrypt (warning: script) %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) nie powiódÅ siÄ, stan wyjÅcia 2 (failed, exit status 2)
removing upgraded package java-1.6.0-sun-1.6.0.25-1.mga1.x86_64
removing upgraded package java-1.6.0-sun-plugin-1.6.0.25-1.mga1.x86_64

but java-sun works.

CC: (none) => chmielu1_a

Comment 5 Dave Hodgins 2011-07-04 14:13:57 CEST 
The line in the postuninstall scriptlet ...

if ! [ -e /usr/lib/jvm/java-1.6.0-sun-1.6.0.26/jre/lib/fonts/LucidaBrightDemiBold.ttf ]; then

is missing the corresponding fi statement.

Presumably the update 25 package has the same error.
Comment 6 Luc Menut 2011-07-04 22:14:45 CEST 
(In reply to comment #4)
...
> 
> removing upgraded package java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64
> /var/tmp/rpm-tmp.VLSbCu: line 13: bÅÄd skÅadni: nieoczekiwany koniec pliku 
> (syntax error: unexpected end of file)
> ostrzeżenie: skrypt (warning: script)
> %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) nie powiódÅ siÄ, stan
> wyjÅcia 2 (failed, exit status 2)
...

Thanks to have reported this bug in %postun fonts.
I've just fixed it, and submitted a new package in nonfree/updates_testing.

@QA team:
please, could you validate java-1.6.0-sun-1.6.0.26-0.2.mga1; it contains the fix for missing fi in %postun fonts (fi removed by error at rev 98900 - clean spec file http://svnweb.mageia.org/packages?view=revision&revision=98900).

regards,
Luc
Comment 7 Ahmad Samir 2011-07-04 22:39:41 CEST 
(In reply to comment #4)
> When update (urpmi --verbose --auto-update) java-sun:
> 
> (noÅnik "Nonfree Updates Testing (distrib15)")
>   java-1.6.0-sun                 1.6.0.26     0.1.mga1.non> x86_64  
>   java-1.6.0-sun-alsa            1.6.0.26     0.1.mga1.non> x86_64  
>   java-1.6.0-sun-fonts           1.6.0.26     0.1.mga1.non> x86_64  
>   java-1.6.0-sun-jdbc            1.6.0.26     0.1.mga1.non> x86_64  
>   java-1.6.0-sun-plugin          1.6.0.26     0.1.mga1.non> x86_64 
> 
> then:
> 
> removing upgraded package java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64
> /var/tmp/rpm-tmp.VLSbCu: line 13: bÅÄd skÅadni: nieoczekiwany koniec pliku 
> (syntax error: unexpected end of file)
> ostrzeżenie: skrypt (warning: script)
> %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) nie powiódÅ siÄ, stan
> wyjÅcia 2 (failed, exit status 2)
> removing upgraded package java-1.6.0-sun-1.6.0.25-1.mga1.x86_64
> removing upgraded package java-1.6.0-sun-plugin-1.6.0.25-1.mga1.x86_64
> 

For future reference, to provide any command output in English, append LC_ALL=C to any command, e.g.
LC_ALL=C urpmi --verbose --auto-update

> but java-sun works.
Comment 8 Dave Hodgins 2011-07-05 01:23:32 CEST 
Should installing it update /etc/alternatives?  I still have
/etc/alternatives/java -> /usr/lib/jvm/jre-1.6.0-openjdk/bin/java*

Is the user supposed to do something to manually select which version to use?
Comment 9 James Kerr 2011-07-05 02:05:00 CEST 
The same problem occurred for me when I installed the release version of sun-java. /etc/alternatives was not updated and the free java continued to be used. IIRC that did not happen on Mandriva where /etc/alternatives was updated.

When I executed  'update-alternatives --config java' 
it reported that the change had been made, but it had not.

My only interest was in getting Firefox to use the sun-java plugin and so I deleted /etc/alternatives/libjavaplugin.so and created the symlink

ln -s /usr/lib/jvm/java-1.6.0-sun-1.6.0.25/jre/lib/i386/libnpjp2.so /etc/alternatives/libjavaplugin.so

There's probably a more elegant way to do it - but that worked for me.
Comment 10 James Kerr 2011-07-05 02:29:23 CEST 
Having written that - I re-ran 'update-alternatives --config java' and this time the java symlink was changed to point to sun-java.  

I think that it may be only the plugin symlink that is not changed.
Comment 11 Dave Hodgins 2011-07-05 03:05:34 CEST 
Thanks, I'd forgotten how to use update-alternatives, I also used
update-alternatives --config libjavaplugin.so
and now have the correct symlinks.

I've repeated the tests in Comment 3 successfully on my i586 system.
I also used rpm -q --scripts to confirm the fi statement had been
added, and used urpme java-1.6.0-sun to confirm the scrptlet works.

Comment 7 indicates it's working on x86-64 systems as well.

Can someone from the sysadmin team push the packages
java-1.6.0-sun
java-1.6.0-sun-alsa
java-1.6.0-sun-fonts
java-1.6.0-sun-src
java-1.6.0-sun-devel
java-1.6.0-sun-jdbc
java-1.6.0-sun-demo
java-1.6.0-sun-plugin
from Nonfree Updates Testing to Nonfree updates please.
The srpm is java-1.6.0-sun-1.6.0.26-0.2.mga1.nonfree.src.rpm
Comment 12 James Kerr 2011-07-05 08:16:20 CEST 
(In reply to comment #11)
> Thanks, I'd forgotten how to use update-alternatives, I also used
> update-alternatives --config libjavaplugin.so
> and now have the correct symlinks.
> 

and I had forgotten that the plugin alternative needed to be configured separately :)
Comment 13 Marcin Ch 2011-07-05 11:22:33 CEST 
(In reply to comment #6)
> (In reply to comment #4)
> ...
> > 
> > removing upgraded package java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64
> > /var/tmp/rpm-tmp.VLSbCu: line 13: bÅÄd skÅadni: nieoczekiwany koniec pliku 
> > (syntax error: unexpected end of file)
> > ostrzeżenie: skrypt (warning: script)
> > %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) nie powiódÅ siÄ, stan
> > wyjÅcia 2 (failed, exit status 2)
> ...
> 
> Thanks to have reported this bug in %postun fonts.
> I've just fixed it, and submitted a new package in nonfree/updates_testing.
> 
> @QA team:
> please, could you validate java-1.6.0-sun-1.6.0.26-0.2.mga1; it contains the
> fix for missing fi in %postun fonts (fi removed by error at rev 98900 - clean
> spec file http://svnweb.mageia.org/packages?view=revision&revision=98900).
> 
> regards,
> Luc

Now, it is OK.
After removal (LC_ALL=C urpme -a java-1.6.0-sun) and installation 26-0.2.mga1 wasn't error.

removing package java-1.6.0-sun-plugin-1.6.0.26-0.2.mga1.nonfree.x86_64
removing package java-1.6.0-sun-alsa-1.6.0.26-0.2.mga1.nonfree.x86_64
removing package java-1.6.0-sun-jdbc-1.6.0.26-0.2.mga1.nonfree.x86_64
removing package java-1.6.0-sun-fonts-1.6.0.26-0.2.mga1.nonfree.x86_64
removing package java-1.6.0-sun-1.6.0.26-0.2.mga1.nonfree.x86_64

Thanks.
Comment 14 Nicolas Vigier 2011-07-06 17:59:49 CEST 
pushed to updates.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 15 Manuel Hiebel 2011-07-07 00:51:41 CEST 
reopen 

on x86_64 and i586 os

/var/tmp/rpm-tmp.GwHjhR: ligne13: Erreur de syntaxe : fin de fichier prématurée
attention: 
                     %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) 
                     scriptlet failed, exit status 2

and 

http://www.mageialinux-online.org/forum/topic-10774+erreur-de-syntaxe-lors-de-la-mise-a-jour-java-1-6-0-sun.php#m108618

the is .26 in cauldron but .25 in Mageia 1

Status: RESOLVED => REOPENED
CC: (none) => manuel
Resolution: FIXED => (none)

Comment 16 Manuel Hiebel 2011-07-07 00:55:05 CEST 
[manu@vosdook ~]$ rpm -qa | grep sun
java-1.6.0-sun-plugin-1.6.0.26-0.2.mga1.nonfree
java-1.6.0-sun-jdbc-1.6.0.26-0.2.mga1.nonfree
java-1.6.0-sun-alsa-1.6.0.26-0.2.mga1.nonfree
java-1.6.0-sun-fonts-1.6.0.26-0.2.mga1.nonfree
java-1.6.0-sun-1.6.0.26-0.2.mga1.nonfree

but it's fail also :/
Comment 17 Thomas Backlund 2011-07-07 01:07:36 CEST 
(In reply to comment #15)
> reopen 
> 
> on x86_64 and i586 os
> 
> /var/tmp/rpm-tmp.GwHjhR: ligne13: Erreur de syntaxe : fin de fichier prématurée
> attention: 
>                      %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) 
>                      scriptlet failed, exit status 2
> 

As the error message states, it's the %postun script of the java-1.6.0-sun-fonts-1.6.0.25-1.mga1 wich shipped in Mageia 1 (media/nonfree/release) that had a bug, so it's nothing we can do about an already installed package.

The issue was also fixed in java-1.6.0-sun-fonts-1.6.0.26-0.2.mga1

Status: REOPENED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

Comment 18 Manuel Hiebel 2011-07-07 01:13:04 CEST 
or not... :

média « Nonfree Updates (dd13) »)
  java-1.6.0-sun                 1.6.0.26     0.2.mga1.non> x86_64  
  java-1.6.0-sun-alsa            1.6.0.26     0.2.mga1.non> x86_64  
  java-1.6.0-sun-fonts           1.6.0.26     0.2.mga1.non> x86_64  
  java-1.6.0-sun-jdbc            1.6.0.26     0.2.mga1.non> x86_64  
  java-1.6.0-sun-plugin          1.6.0.26     0.2.mga1.non> x86_64  
(média « Tainted Release (dd21) »)
  gstreamer0.10-ofa              0.10.21      3.mga1.taint> x86_64  (conseillé)
(média « Tainted Updates Testing (dd25) »)
  lib64xine1                     1.1.19       5.mga1.taint> x86_64  
  xine-plugins                   1.1.19       5.mga1.taint> x86_64  
un espace additionnel de 269Ko sera utilisé.
30Mo de paquets seront récupérés.
Procéder à l'installation des 14 paquetages ? (O/n) o


installation de /media/tux/var/pub/Mageia/x86_64/media/core/updates_testing/subversion-1.6.16-5.1.mga1.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/core/updates_testing/bind-utils-9.8.0-6.P4.mga1.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/core/updates_testing/perl-SVN-1.6.16-5.1.mga1.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/nonfree/updates/java-1.6.0-sun-fonts-1.6.0.26-0.2.mga1.nonfree.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/core/updates_testing/lib64svn0-1.6.16-5.1.mga1.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/nonfree/updates/java-1.6.0-sun-1.6.0.26-0.2.mga1.nonfree.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/nonfree/updates/java-1.6.0-sun-jdbc-1.6.0.26-0.2.mga1.nonfree.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/nonfree/updates/java-1.6.0-sun-alsa-1.6.0.26-0.2.mga1.nonfree.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/core/updates_testing/clementine-0.7.1-0.1.mga1.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/nonfree/updates/java-1.6.0-sun-plugin-1.6.0.26-0.2.mga1.nonfree.x86_64.rpm
/media/tux/var/pub/Mageia/x86_64/media/core/backports_testing/smartmontools-5.41-1.mga1.x86_64.rpm
Préparation ...                  #############################################
     1/14: lib64svn0             #############################################
     2/14: subversion            #############################################
     3/14: java-1.6.0-sun-jdbc   #############################################
     4/14: java-1.6.0-sun-alsa   #############################################
     5/14: java-1.6.0-sun-plugin #############################################
     6/14: java-1.6.0-sun        #############################################
     7/14: java-1.6.0-sun-fonts  #############################################
     8/14: perl-SVN              #############################################
     9/14: smartmontools         #############################################
    10/14: clementine            #############################################
    11/14: bind-utils            #############################################
/var/tmp/rpm-tmp.GwHjhR: ligne13: Erreur de syntaxe : fin de fichier prématurée
attention: %postun(java-1.6.0-sun-fonts-1.6.0.25-1.mga1.x86_64) scriptlet failed, exit status 2
Comment 19 Manuel Hiebel 2011-07-07 01:15:11 CEST 
I yes sorry, now I understand :(

I'm really bad in English: (
Nicolas Vigier 2014-05-08 18:04:40 CEST

CC: boklm => (none)