USN-3275-3
- Source
- https://ubuntu.com/security/notices/USN-3275-3
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3275-3.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-3275-3
- Published
- 2017-05-18T21:39:12Z
- Modified
- 2026-02-10T04:41:07Z
- Summary
- openjdk-7 regression
- Details
-
USN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509)
It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511)
It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526)
It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533)
It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539)
It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application's SMTP connections. (CVE-2017-3544)
- References
Affected packages
Ubuntu:14.04:LTS / openjdk-7
Package
- Name
- openjdk-7
- Purl
- pkg:deb/ubuntu/openjdk-7@7u131-2.6.9-0ubuntu0.14.04.2?arch=source&distro=trusty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed7u131-2.6.9-0ubuntu0.14.04.2
Affected versions
7u25-2.*
7u45-2.*
7u51-2.*
7u55-2.*
7u65-2.*
7u71-2.*
7u75-2.*
7u79-2.*
7u85-2.*
7u91-2.*
7u95-2.*
7u101-2.*
7u111-2.*
7u121-2.*
7u131-2.*
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "icedtea-7-jre-jamvm"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-demo"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-jdk"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-jre"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-jre-headless"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-jre-lib"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-jre-zero"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-source"
},
{
"binary_version": "7u131-2.6.9-0ubuntu0.14.04.2",
"binary_name": "openjdk-7-tests"
}
]
}