Java 7 (openjdk) gets a security update

Many people who have a need for Java, will already have switched to Java 8. Nevertheless there are still many places where Java 7 is preferred or even required. So, I am riding on the Q4 security updates for OpenJDK and used the recently released icedtea 2.6.8 to compile OpenJDK 7u121_b00 or “Java 7 Update 121 Build 00”. As always, there is a JDK and a JRE package.

Andrew Hughes has posted about this new release, and I copied the security related changes here:

• S8151921: Improved page resolution
• S8155968: Update command line options
• S8155973, CVE-2016-5542: Tighten jar checks
• S8157176: Improved classfile parsing
• S8157739, CVE-2016-5554: Classloader Consistency Checking
• S8157749: Improve handling of DNS error replies
• S8157753: Audio replay enhancement
• S8157759: LCMS Transform Sampling Enhancement
• S8157764: Better handling of interpolation plugins
• S8158302: Handle contextual glyph substitutions
• S8158993, CVE-2016-5568: Service Menu services
• S8159495: Fix index offsets
• S8159503: Amend Annotation Actions
• S8159511: Stack map validation
• S8159515: Improve indy validation
• S8159519, CVE-2016-5573: Reformat JDWP messages
• S8160090: Better signature handling in pack200
• S8160094: Improve pack200 layout
• S8160098: Clean up color profiles
• S8160591, CVE-2016-5582: Improve internal array handling
• S8160838, CVE-2016-5597: Better HTTP service
• PR3207, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read()

Obviously, you are strongly urged to upgrade your OpenJDK 7 to this new release. Download locations for the JDK and JRE packages (Java 7 version):

• http://www.slackware.com/~alien/slackbuilds/openjdk7/
• http://bear.alienbase.nl/mirrors/people/alien/slackbuilds/openjdk7/
  (rsync URI: rsync://bear.alienbase.nl/mirrors/people/alien/slackbuilds/openjdk7/)

The “rhino” package (implementation of the JavaScript engine used by OpenJDK) is an external dependency for OpenJDK 7, you can find a package in my repository.

Note about usage:

My Java 7 and Java 8 packages (e.g. openjdk7 and openjdk… or openjre7 and openjre) can not co-exist on your computer because they use the same installation directory. You must install either Java 7 or Java 8.

Remember that I release packages for the JRE (runtime environment) and the JDK (development kit) simultaneously, but you only need to install one of the two. The JRE is sufficient if you only want to run Java programs (including Java web plugins). Only in case where you’d want to develop Java programs and need a Java compiler, you are in need of the JDK package.

Optionally: If you want to use Java in a web browser then you’ll have to install my icedtea-web package too. While Oracle’s JDK contains a browser plugin, that one is closed-source and therefore Icedtea offers an open source variant which does a decent job. Note that icedtea-web is a NPAPI plugin – this prevents use of Java in Chrome & Chromium because those browsers only support PPAPI plugins, but you’ll be OK with all Mozilla [-compatible] browsers of course.

Have fun! Eric