openSUSE Security Update: icedtea-web: update to 1.3.1 (bnc#787846) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1524-1 Rating: moderate References: #784859 #785333 #786775 #787846 Cross-References: CVE-2012-4540 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: The IcedTea Web Java plugin was updated to 1.3.1 (bnc#787846) - Security Updates * CVE-2012-4540, RH869040: Heap-based buffer overflow after triggering event attached to applet - Common Bugfixes - PR1161: X509VariableTrustManager does not work correctly with OpenJDK7 fixes the self-signed issue (mentioned in bnc#784859, bnc#785333, bnc#786775) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-797 - openSUSE 12.1: zypper in -t patch openSUSE-2012-797 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): icedtea-web-1.3.1-1.9.1 icedtea-web-debuginfo-1.3.1-1.9.1 icedtea-web-debugsource-1.3.1-1.9.1 - openSUSE 12.2 (noarch): icedtea-web-javadoc-1.3.1-1.9.1 - openSUSE 12.1 (i586 x86_64): icedtea-web-1.3.1-17.1 icedtea-web-debuginfo-1.3.1-17.1 icedtea-web-debugsource-1.3.1-17.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.3.1-17.1 References: http://support.novell.com/security/cve/CVE-2012-4540.html https://bugzilla.novell.com/784859 https://bugzilla.novell.com/785333 https://bugzilla.novell.com/786775 https://bugzilla.novell.com/787846