[ GLSA 201908-10 ] Oracle JDK/JRE: Multiple vulnerabilities

Signed-off-by: Aaron Bauman <bman@gentoo.org>

1 files changed, 82 insertions, 0 deletions

diff --git a/glsa-201908-10.xml b/glsa-201908-10.xml
new file mode 100644
index 00000000..c5246faf
--- /dev/null
+++ b/glsa-201908-10.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="201908-10">
+  <title>Oracle JDK/JRE: Multiple vulnerabilities</title>
+  <synopsis>Multiple vulnerabilities have been found in Oracle’s JDK and JRE
+    software suites.
+  </synopsis>
+  <product type="ebuild">oracle,jre,jdk</product>
+  <announced>2019-08-15</announced>
+  <revised count="1">2019-08-15</revised>
+  <bug>668948</bug>
+  <bug>691336</bug>
+  <access>remote</access>
+  <affected>
+    <package name="dev-java/oracle-jdk-bin" auto="yes" arch="*">
+      <unaffected range="ge" slot="1.8">1.8.0.202</unaffected>
+      <vulnerable range="lt" slot="1.8">1.8.0.202</vulnerable>
+    </package>
+    <package name="dev-java/oracle-jre-bin" auto="yes" arch="*">
+      <unaffected range="ge" slot="1.8">1.8.0.202</unaffected>
+      <vulnerable range="lt" slot="1.8">1.8.0.202</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>Java Platform, Standard Edition (Java SE) lets you develop and deploy
+      Java applications on desktops and servers, as well as in today’s
+      demanding embedded environments. Java offers the rich user interface,
+      performance, versatility, portability, and security that today’s
+      applications require.
+    </p>
+  </background>
+  <description>
+    <p>Multiple vulnerabilities have been discovered in Oracle’s JDK and JRE
+      software suites. Please review the CVE identifiers referenced below for
+      details.
+    </p>
+  </description>
+  <impact type="normal">
+    <p>Please review the referenced CVE identifiers for details.</p>
+  </impact>
+  <workaround>
+    <p>There is no known workaround at this time.</p>
+  </workaround>
+  <resolution>
+    <p>All Oracle JDK bin users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=dev-java/oracle-jdk-bin-1.8.0.202:1.8"
+    </code>
+    
+    <p>All Oracle JRE bin users should upgrade to the latest version:</p>
+    
+    <code>
+      # emerge --sync
+      # emerge --ask --oneshot --verbose
+      "&gt;=dev-java/oracle-jre-bin-1.8.0.202:1.8"
+    </code>
+  </resolution>
+  <references>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-13785">CVE-2018-13785</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3136">CVE-2018-3136</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3139">CVE-2018-3139</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3149">CVE-2018-3149</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3150">CVE-2018-3150</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3157">CVE-2018-3157</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3169">CVE-2018-3169</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3180">CVE-2018-3180</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3183">CVE-2018-3183</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3209">CVE-2018-3209</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3211">CVE-2018-3211</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-3214">CVE-2018-3214</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-2602">CVE-2019-2602</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-2684">CVE-2019-2684</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-2697">CVE-2019-2697</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-2698">CVE-2019-2698</uri>
+    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-2699">CVE-2019-2699</uri>
+  </references>
+  <metadata tag="requester" timestamp="2019-04-27T05:36:16Z">BlueKnight</metadata>
+  <metadata tag="submitter" timestamp="2019-08-15T15:48:13Z">b-man</metadata>
+</glsa>