[SECURITY] IcedTea 1.11.8 & 1.12.3 Released!

Omair Majid omajid at redhat.com
Tue Feb 19 13:48:41 PST 2013


The IcedTea project provides a harness to build the source code from
OpenJDK6 using Free Software build tools, along with additional
features such as a PulseAudio sound driver and support for alternative
virtual machines.

A new set of security release is now available:

* IcedTea6 1.11.8
* IcedTea6 1.12.3

All updates contain the following security fixes:

* S8006446: Restrict MBeanServer access
* S8006777: Improve TLS handling of invalid messages
* S8007688: Blacklist known bad certificate

Full details of each release can be found below.

What’s New?
—————–

New in release 1.11.8 (2013-02-19):

* Security fixes
  - S8006446: Restrict MBeanServer access
  - S8006777: Improve TLS handling of invalid messages
  - S8007688: Blacklist known bad certificate
* Backports
  - S7123519: problems with certification path
  - S8007393: Possible race condition after JDK-6664509
  - S8007611: logging behavior in applet changed
* Bug fixes
  - PR1319: Support GIF lib v5.

New in release 1.12.3 (2013-02-19):

* Security fixes
  - S8006446: Restrict MBeanServer access
  - S8006777: Improve TLS handling of invalid messages
  - S8007688: Blacklist known bad certificate
* Backports
  - S8007393: Possible race condition after JDK-6664509
  - S8007611: logging behavior in applet changed
* Bug fixes
  - PR1319: Support GIF lib v5.


The tarballs can be downloaded from:

* http://icedtea.classpath.org/download/source/icedtea6-1.11.8.tar.gz
* http://icedtea.classpath.org/download/source/icedtea6-1.12.3.tar.gz

SHA256 checksums:

62620b5544d5e1df7508d7c777fb78532c75eec43b99c8c7d1a3c84f352c1ea3
icedtea6-1.11.8.tar.gz
db9dc14fa537fb22616fcd9e5b80758aa7baa66e0b6f8adfe3d5e80414574b4c
icedtea6-1.12.3.tar.gz

Each tarball is accompanied by a digital signature (available at the
above URL + '.sig').  This is produced using Andrew John Hughes' public key:

PGP Key: 248BDC07 (https://keys.indymedia.org/)
Fingerprint = EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07

The following people helped with these releases:

* Severin Gehwolf (checking S8006777 and S8007688)
* Andrew John Hughes (applying all security patches & backports, release
testing)
* Jon VanAlten (checking S8006446 and S8007611)

We would also like to thank the bug reporters and testers!

To get started:

$ tar xf icedtea6-1.12.3.tar.gz

Full build requirements and instructions are in INSTALL:

$ mkdir icedtea6-build
$ cd icedtea6-build
$ ../icedtea6-1.12.3/configure [--enable-zero --enable-pulse-java
--enable-systemtap ...]
$ make

Happy hacking!
-- 
PGP Key: 66484681 (http://pgp.mit.edu/)
Fingerprint = F072 555B 0A17 3957 4E95  0056 F286 F14F 6648 4681



More information about the distro-pkg-dev mailing list