[Bug 3640] [IcedTea7] Backport "CVE-2018-16435 lcms2: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile" to in-tree LCMS

Tue Jan 1 19:34:47 UTC 2019

https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3640

--- Comment #2 from hg commits <mercurial at icedtea.classpath.org> ---
details:
http://icedtea.classpath.org//hg/release/icedtea7-2.6?cmd=changeset;node=2f0ac48fe540
author: Andrew John Hughes <gnu_andrew at member.fsf.org>
date: Tue Jan 01 05:04:45 2019 +0000

    Bump to 2.6.16.

    Upstream changes:
      - Bump to icedtea-2.6.16
      - PR3640, CVE-2018-16435: lcms2: heap-based buffer overflow in SetData
function in cmsIT8LoadFromFile
      - S7058700: Unexpected exceptions and timeouts in SF2 parser code
      - S7098755: test/sun/misc/JarIndex/metaInfFilenames/Basic.java should use
supported compiler interface
      - S7104650: rawtype warnings in several net, nio and security source
files
      - S7116722: Miscellaneous warnings sun.misc ( and related classes )
      - S7117249: fix warnings in java.util.jar, .logging, .prefs, .zip
      - S7142888: sun/security/tools/jarsigner/ec.sh fail on sparc
      - S8044860: Vectors and fixed length fields should be verified for
allowed sizes.
      - S8049834: Two security tools tests do not run with only JRE
      - S8054431: Some of the input validation in the javasound is too strict
      - S8074462: Handshake messages can be strictly ordered
      - S8130132: jarsigner should emit warning if weak algorithms or keysizes
are used
      - S8142927: Feed some text to STDIN in ProcessTools.executeProcess()
      - S8146377: test/sun/security/tools/jarsigner/concise_jarsigner.sh
failing
      - S8158887: sun/security/tools/jarsigner/concise_jarsigner.sh timed out
      - S8164480: Crash with assert(handler_address ==
SharedRuntime::compute_compiled_exc_handler(..) failed: Must be the same
      - S8168405: Pending exceptions in java.base/windows/native
      - S8172529: Use PKIXValidator in jarsigner
      - S8180289: jarsigner treats timestamped signed jar invalid after the
signer cert expires
      - S8190674: sun/security/tools/jarsigner/TimestampCheck.java failed with
java.nio.file.NoSuchFileException: ts2.cert
      - S8193892: Impact of noncloneable MessageDigest implementation
      - S8194534: Manifest better support
      - S8194546: Choosier FileManagers
      - S8195868: Address Internet Addresses
      - S8195874: Improve jar specification adherence
      - S8196897: Improve PRNG support
      - S8196902: Better HTTP redirection support
      - S8199177: Enhance JNDI lookups
      - S8199226: Improve field accesses
      - S8201756: Improve cipher inputs
      - S8202613: Improve TLS connections stability
      - S8203654: Improve cypher state updates
      - S8204497: Better formatting of decimals
      - S8204667: Resources not freed on exception
      - S8205361: Better RIFF reading support
      - S8207336: Build failure in JDK8u on Windows after fix 8207260
      - S8208350: Disable all DES cipher suites
      - S8208353: Upgrade JDK 8u to libpng 1.6.35
      - S8208660: JDK 8u191 l10n resource file update
      - S8208754: The fix for JDK-8194534 needs updates
      - S8211107: LDAPS communication failure with jdk 1.8.0_181
      - S8211731: Reconsider default option for ClassPathURLCheck change done
in JDK-8195874

    ChangeLog:

    2018-12-31  Andrew John Hughes  <gnu_andrew at member.fsf.org>

        Bump to 2.6.16.
        * Makefile.am:
        (CORBA_CHANGESET): Update to icedtea-2.6.16.
        (JAXP_CHANGESET): Likewise.
        (JAXWS_CHANGESET): Likewise.
        (JDK_CHANGESET): Likewise.
        (LANGTOOLS_CHANGESET): Likewise.
        (OPENJDK_CHANGESET): Likewise.
        (CORBA_SHA256SUM): Likewise.
        (JAXP_SHA256SUM): Likewise.
        (JAXWS_SHA256SUM): Likewise.
        (JDK_SHA256SUM): Likewise.
        (LANGTOOLS_SHA256SUM): Likewise.
        (OPENJDK_SHA256SUM): Likewise.
        * NEWS: Updated. Split previous u191 NEWS items
        into individual builds (0, 1 and 2)
        * acinclude.m4:
        (JDK_UPDATE_VERSION): Bump to 201.
        (BUILD_VERSION): Set to b00.
        * configure.ac: Bump to 2.6.16.
        * hotspot.map.in: Update to icedtea-2.6.16.
        * patches/boot/ecj-diamond.patch:
        Regenerated. Add new cases in
        java.util.jar.JarVerifier,
        java.util.jar.Manifest,
        java.util.prefs.XmlSupport,
        sun.misc.ExtensionDependency,
        sun.misc.JarIndex,
        sun.misc.ProxyGenerator,
        sun.misc.Service,
        sun.misc.Signal and
        sun.security.ssl.HandshakeStateManager.
        * patches/boot/ecj-multicatch.patch:
        Add new case in sun.misc.URLClasspath.
        * patches/boot/ecj-trywithresources.patch:
        Add new case in sun.security.tools.jarsigner.Main.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.java.net/pipermail/distro-pkg-dev/attachments/20190101/04fd62c6/attachment.html>