Alien Pastures

My thoughts on Slackware, life and everything

Tag: 0day (Page 2 of 2)

Chromium 100 out-of-band security update addresses (again) a single vulnerability

April 6, 2022 / / 18 Comments

I have uploaded new chromium 100 packages for Slackware. The chromium-ungoogled 100 packages are currently being built and will follow shortly.
What’s with all these updates that follow rapidly on each others’ heels? Just like the recent Chromium 99 security update which addressed a single critical vulnerability, last monday Google announced on their official blog the immediate availability of Chromium 100.0.4896.75. This hotfix release plugs a single hole which Google deemed serious enough to warrant the update. See CVE-2022-1232. The difference with last week is that no known exploit of this vulnerability is reported yet.
Still, it’s highly recommended that you upgrade ASAP.

My Chromium 100.0.4896.75 packages can be downloaded from my own repository (or any mirror that has synced up), for instance:

Once I have finished compiling the un-googled version of chromium and uploaded the packages, I will mention it in the comments section below and you can download them from: https://slackware.nl/people/alien/slackbuilds/chromium-ungoogled/ or https://us.slackware.nl/people/alien/slackbuilds/chromium-ungoogled/ .

Until I get tired of compiling for Slackware 14.2 (aka once I have migrated my last server to 15.0) these packages will work on Slackware 14.2 and newer. I provide 32bit as well as 64bit variants.

Eric

Another Chromium 96 update to patch a 0-day exploit

December 15, 2021 / / 10 Comments

I have uploaded a set of new packages for Chromium 96.0.4664.110. The package updates for chromium-ungoogled will follow shortly, they are still compiling.

This update follows on the heels of the previous one, and addresses a couple of severe/critical bugs.
One of them (being labeled as CVE-2021-4102, ‘use-after-free issue in the V8 JavaScript engine‘) is a zero-day vulnerability which is already actively exploited in the wild, according to Google’s report.

This is an urgent request to upgrade your package.
You can get the chromium and chromium-ungoogled packages from slackware.nl or its mirrors.

Eric

Update (Thu Dec 16 08:13:10 UTC 2021): packages for chromium-ungoogled are updated now as well. The slackware.com server is down but you can download from slackware.nl or any mirror.

Update for OpenJDK 7 with IcedTea 2.3.4 plugs 0-day exploit.

January 16, 2013 / / 8 Comments

The past week was buzzing with the 0-day exploit for Oracle’s Java browser plugin, but according to CERT, the OpenJDK was affected as well by the underlying bug. Oracle “hastily” patched this critical vulnerability (CVE-2012-3174) although now it seems that only this particular “attack vector” was patched but the underlying vulnerability remains, leaving the way open to other exploits.

Come what may, an update of IcedTea followed soon after, which will build OpenJDK packages which incorporate fixes for the vulnerability. The version of IcedTea which I use (upped to 2.3.4) builds a OpenJDK 7 Update 9 package – the same version as we already have (no idea why they did not lift the update version to 10 or 11 unless this was a hasty fix for this particular 0-day exploit), so what I did for my openjdk & openjre packages was increase the package BUILD number from “1alien” to “2alien” so that you can use upgradepkg to upgrade to the new package.

It appears that one of the main developers: GNU.Andrew (Andrew John Hughes from Redhat) has not yet updated his blog with news of the new icedtea releases. The aforementioned mailinglist post was his, so I expect that he will update his blog with all the details soon.

Here is the list with security fixes in the IcedTea 2.3.4 build of OpenJDK 7u9:

  • Security fixes:
    • S8004933, CVE-2012-3174: Improve MethodHandle interaction with libraries
    • S8006017, CVE-2013-0422: Improve lookup resolutions
    • S8006125: Update MethodHandles library interactions
  • Backports:
    • S7197906: BlockOffsetArray::power_to_cards_back() needs to handle > 32 bit shifts
  • Bug fixes:
    • G422525: Fix building with PaX enabled kernels.

Get my packages (Slackware 13,37 and newer) for OpenJDK 7u9_b30 build 2alien here and upgrade as soon as you can:

Further packages that are recommended/required:

  • Optional: If you want a Java browser-plugin you must install icedtea-web (OpenJDK itself does not contain such a plugin).
  • Required: The rhino package is a dependency of the openjdk/openjre package. It contains the JavaScript engine for OpenJDK.

I will repeat these notes:

  • You need to install either the JRE or the JDK package. Not both of them! If you are not a Java developer and never compile Java code, then you do not need the openjdk package and it will be sufficient to install the (smaller) openjre package instead.
  • If you are migrating to OpenJDK after having used Oracle’s Java binaries, make sure that you have removed both “jre” and “jdk” packages. Run a command like “removepkg /var/log/packages/jdk-* ; removepkg /var/log/packages/jre-*” to get rid of both. Then install the openjdk or openjre package. Logout and log back in after this package removal/installation, so that you will get the proper Java environment.
  • Test your java browser plugin online: http://javatester.org/version.html or http://www.java.com/en/download/testjava.jsp .

After upgrading you should see this when running java or javac:

$ java -version
java version “1.7.0_09”
OpenJDK Runtime Environment (IcedTea7 2.3.4) (Slackware)
OpenJDK 64-Bit Server VM (build 23.2-b09, mixed mode)
$ javac -version
javac 1.7.0_09

I tested the new packages with a short game of MineCraft and running JMol… and had no issues.

Good luck! Eric

 

OpenJDK 7u6_b30 with IcedTea 2.3.1 fixes 0day exploit

August 30, 2012 / / 19 Comments

 There is a 0-day (zero-day) exploit out for Java7 (both Oracle Java7 and OpenJDK 7).The attack is mounted through your web browser’s Java plugin.

People using Java6 are not affected by the exploit. This includes everybody who is running a stable version of Slackware. There is no more Java in slackware-current, except for a SlackBuild script which wraps the official Oracle Java7 binaries into a Slackware package. This would make your Java7 on slackware-current vulnerable.

People using OpenJDK7/icedtea-web are not vulnerable to a browser based attack since the icedtea-web browser plugin will prevent the privilege escalation. However, the OpenJDK 7u5_b21 package which I have is still flawed.

Unfortunately, Oracle is taking a long time to respond to this threat. Users of OpenJDK are better off. There was an update of the icedtea build framework. The new version 2.3.1 will build OpenJDK 7u6_b30 and that release has been patched for the exploit.

Get my packages (Slackware 13,37 and newer) for OpenJDK 7u6_b30 here:

You will find packages for icedtea-web (the mozilla-compatible brwoser plugin) too at those URLs, as well as the mandatory rhino package (the JavaScript engine). Without this, the OpenJDK will not work.

Notes:

  • You need to install either the JRE or the JDK package. Not both of them! If you are not a Java developer and never compile Java code, then you do not need the openjdk package and it will be sufficient to install the (much smaller) openjre package instead.
  • If you are migrating to OpenJDK after having used Oracle’s Java binaries, make sure that you have removed both “jre” and “jdk” packages. Run a command like “removepkg /var/log/packages/jdk-* ; removepkg /var/log/packages/jre-*” to get rid of both. Then install the openjdk or openjre package. Logout and log back in after this package removal/installation so that you will get the proper Java environment.
  • Test your java browser plugin online: http://javatester.org/version.html or http://www.java.com/en/download/testjava.jsp .

Good luck! Eric

Newer posts »

© 2024 Alien Pastures

Theme by Anders Noren — Up ↑