Bug#870860: openjfx: CVE-2017-10086 CVE-2017-10114
Moritz Muehlenhoff
jmm at debian.org
Mon Oct 2 13:08:51 UTC 2017
On Sat, Aug 05, 2017 at 09:58:53PM +0200, Salvatore Bonaccorso wrote:
> Source: openjfx
> Version: 8u131-b11-1
> Severity: grave
> Tags: upstream security
>
> Hi,
>
> the following vulnerabilities were published for openjfx.
>
> CVE-2017-10086[0] and CVE-2017-10114[1].
>
> Unfortunately it's no more details possilby know as shared via [2],
> which states that the supported versions vulnerable are 7u141 and
> 8u131. The severity is probably as well overrated for this bugreport
> and a DSA not deserved. But bug should help tracking the fix for
> future unstable upload.
>
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2017-10086
> [1] https://security-tracker.debian.org/tracker/CVE-2017-10114
> [2] http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html#JAVA
>
> Please adjust the affected versions in the BTS as needed.
Java maintainers, shall we follow the procedures for openjdk and
rebase to a new upstream release in stretch?
Cheers,
Moritz
More information about the pkg-java-maintainers
mailing list