<?xml version="1.0" encoding="UTF-8"?>
<!--PATCHINFO id="1e44020beba82366d00f30078455bb06"!-->
<update status="stable" from="maint-coord@suse.de" type="security" version="2362">
  <id>dbg111-java-1_6_0-openjdk</id>
  <title>java-1_6_0-openjdk security update</title>
  <release>openSUSE 11.1 DEBUGINFO</release>
  <issued date="1272451633"/>
  <references>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=594415" id="594415" title="bug number 594415" type="bugzilla"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0837" id="CVE-2010-0837" title="CVE-2010-0837" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0845" id="CVE-2010-0845" title="CVE-2010-0845" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0838" id="CVE-2010-0838" title="CVE-2010-0838" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0082" id="CVE-2010-0082" title="CVE-2010-0082" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0095" id="CVE-2010-0095" title="CVE-2010-0095" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0085" id="CVE-2010-0085" title="CVE-2010-0085" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0091" id="CVE-2010-0091" title="CVE-2010-0091" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0088" id="CVE-2010-0088" title="CVE-2010-0088" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0084" id="CVE-2010-0084" title="CVE-2010-0084" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0092" id="CVE-2010-0092" title="CVE-2010-0092" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0094" id="CVE-2010-0094" title="CVE-2010-0094" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0093" id="CVE-2010-0093" title="CVE-2010-0093" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0840" id="CVE-2010-0840" title="CVE-2010-0840" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0848" id="CVE-2010-0848" title="CVE-2010-0848" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0847" id="CVE-2010-0847" title="CVE-2010-0847" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555" id="CVE-2009-3555" title="CVE-2009-3555" type="cve"/>
  </references>
  <description>java-1_6_0-openjdk version 1.7.3 fixes serveral security
issues:

  - CVE-2010-0837: JAR 'unpack200' must verify input
    parameters
  - CVE-2010-0845: No ClassCastException for
    HashAttributeSet constructors if run with -Xcomp
  - CVE-2010-0838: CMM readMabCurveData Buffer Overflow
    Vulnerability
  - CVE-2010-0082: Loader-constraint table allows arrays
    instead of only the base-classes
  - CVE-2010-0095: Subclasses of InetAddress may
    incorrectly interpret network addresses
  - CVE-2010-0085: File TOCTOU deserialization vulnerability
  - CVE-2010-0091: Unsigned applet can retrieve the dragged
    information before drop action occurs
  - CVE-2010-0088: Inflater/Deflater clone issues
  - CVE-2010-0084: Policy/PolicyFile leak dynamic
    ProtectionDomains.
  - CVE-2010-0092: AtomicReferenceArray causes SIGSEGV -&gt;
    SEGV_MAPERR error
  - CVE-2010-0094: Deserialization of RMIConnectionImpl
    objects should enforce stricter checks
  - CVE-2010-0093: System.arraycopy unable to reference
    elements beyond Integer.MAX_VALUE bytes
  - CVE-2010-0840: Applet Trusted Methods Chaining
    Privilege Escalation Vulnerability
  - CVE-2010-0848: AWT Library Invalid Index Vulnerability
  - CVE-2010-0847: ImagingLib arbitrary code execution
    vulnerability
  - CVE-2009-3555: TLS: MITM attacks via session
    renegotiation
</description>
  <pkglist>
    <collection>
        <package name="java-1_6_0-openjdk-debuginfo" arch="i586" version="1.6.0.0_b17" release="2.3.1">
          <filename>java-1_6_0-openjdk-debuginfo-1.6.0.0_b17-2.3.1.i586.rpm</filename>
        </package>
        <package name="java-1_6_0-openjdk-debuginfo" arch="ppc" version="1.6.0.0_b17" release="2.3.1">
          <filename>java-1_6_0-openjdk-debuginfo-1.6.0.0_b17-2.3.1.ppc.rpm</filename>
        </package>
        <package name="java-1_6_0-openjdk-debuginfo" arch="x86_64" version="1.6.0.0_b17" release="2.3.1">
          <filename>java-1_6_0-openjdk-debuginfo-1.6.0.0_b17-2.3.1.x86_64.rpm</filename>
        </package>
        <package name="java-1_6_0-openjdk-debugsource" arch="i586" version="1.6.0.0_b17" release="2.3.1">
          <filename>java-1_6_0-openjdk-debugsource-1.6.0.0_b17-2.3.1.i586.rpm</filename>
        </package>
        <package name="java-1_6_0-openjdk-debugsource" arch="ppc" version="1.6.0.0_b17" release="2.3.1">
          <filename>java-1_6_0-openjdk-debugsource-1.6.0.0_b17-2.3.1.ppc.rpm</filename>
        </package>
        <package name="java-1_6_0-openjdk-debugsource" arch="x86_64" version="1.6.0.0_b17" release="2.3.1">
          <filename>java-1_6_0-openjdk-debugsource-1.6.0.0_b17-2.3.1.x86_64.rpm</filename>
        </package>
    </collection>
  </pkglist>
</update>
