- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202409-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: IcedTea: Multiple Vulnerabilities Date: September 28, 2024 Bugs: #732628, #803608, #877599 ID: 202409-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in IcedTea, the worst of which could result in arbitrary code execution. Background ========== IcedTea’s aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions. Affected packages ================= Package Vulnerable Unaffected -------------------- ------------ ------------ dev-java/icedtea <= 3.21.0 Vulnerable! dev-java/icedtea-bin <= 3.16.0-r2 Vulnerable! Description =========== Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== Gentoo has discontinued support for IcedTea. We recommend that users unmerge it: # emerge --sync # emerge --ask --depclean "dev-java/icedtea" "dev-java/icedtea-bin" References ========== [ 1 ] CVE-2020-14556 https://nvd.nist.gov/vuln/detail/CVE-2020-14556 [ 2 ] CVE-2020-14562 https://nvd.nist.gov/vuln/detail/CVE-2020-14562 [ 3 ] CVE-2020-14573 https://nvd.nist.gov/vuln/detail/CVE-2020-14573 [ 4 ] CVE-2020-14577 https://nvd.nist.gov/vuln/detail/CVE-2020-14577 [ 5 ] CVE-2020-14578 https://nvd.nist.gov/vuln/detail/CVE-2020-14578 [ 6 ] CVE-2020-14579 https://nvd.nist.gov/vuln/detail/CVE-2020-14579 [ 7 ] CVE-2020-14581 https://nvd.nist.gov/vuln/detail/CVE-2020-14581 [ 8 ] CVE-2020-14583 https://nvd.nist.gov/vuln/detail/CVE-2020-14583 [ 9 ] CVE-2020-14593 https://nvd.nist.gov/vuln/detail/CVE-2020-14593 [ 10 ] CVE-2020-14621 https://nvd.nist.gov/vuln/detail/CVE-2020-14621 [ 11 ] CVE-2020-14664 https://nvd.nist.gov/vuln/detail/CVE-2020-14664 [ 12 ] CVE-2020-14779 https://nvd.nist.gov/vuln/detail/CVE-2020-14779 [ 13 ] CVE-2020-14781 https://nvd.nist.gov/vuln/detail/CVE-2020-14781 [ 14 ] CVE-2020-14782 https://nvd.nist.gov/vuln/detail/CVE-2020-14782 [ 15 ] CVE-2020-14792 https://nvd.nist.gov/vuln/detail/CVE-2020-14792 [ 16 ] CVE-2020-14796 https://nvd.nist.gov/vuln/detail/CVE-2020-14796 [ 17 ] CVE-2020-14797 https://nvd.nist.gov/vuln/detail/CVE-2020-14797 [ 18 ] CVE-2020-14798 https://nvd.nist.gov/vuln/detail/CVE-2020-14798 [ 19 ] CVE-2020-14803 https://nvd.nist.gov/vuln/detail/CVE-2020-14803 [ 20 ] CVE-2021-2341 https://nvd.nist.gov/vuln/detail/CVE-2021-2341 [ 21 ] CVE-2021-2369 https://nvd.nist.gov/vuln/detail/CVE-2021-2369 [ 22 ] CVE-2021-2388 https://nvd.nist.gov/vuln/detail/CVE-2021-2388 [ 23 ] CVE-2021-2432 https://nvd.nist.gov/vuln/detail/CVE-2021-2432 [ 24 ] CVE-2021-35550 https://nvd.nist.gov/vuln/detail/CVE-2021-35550 [ 25 ] CVE-2021-35556 https://nvd.nist.gov/vuln/detail/CVE-2021-35556 [ 26 ] CVE-2021-35559 https://nvd.nist.gov/vuln/detail/CVE-2021-35559 [ 27 ] CVE-2021-35561 https://nvd.nist.gov/vuln/detail/CVE-2021-35561 [ 28 ] CVE-2021-35564 https://nvd.nist.gov/vuln/detail/CVE-2021-35564 [ 29 ] CVE-2021-35565 https://nvd.nist.gov/vuln/detail/CVE-2021-35565 [ 30 ] CVE-2021-35567 https://nvd.nist.gov/vuln/detail/CVE-2021-35567 [ 31 ] CVE-2021-35578 https://nvd.nist.gov/vuln/detail/CVE-2021-35578 [ 32 ] CVE-2021-35586 https://nvd.nist.gov/vuln/detail/CVE-2021-35586 [ 33 ] CVE-2021-35588 https://nvd.nist.gov/vuln/detail/CVE-2021-35588 [ 34 ] CVE-2021-35603 https://nvd.nist.gov/vuln/detail/CVE-2021-35603 [ 35 ] CVE-2022-21618 https://nvd.nist.gov/vuln/detail/CVE-2022-21618 [ 36 ] CVE-2022-21619 https://nvd.nist.gov/vuln/detail/CVE-2022-21619 [ 37 ] CVE-2022-21624 https://nvd.nist.gov/vuln/detail/CVE-2022-21624 [ 38 ] CVE-2022-21626 https://nvd.nist.gov/vuln/detail/CVE-2022-21626 [ 39 ] CVE-2022-21628 https://nvd.nist.gov/vuln/detail/CVE-2022-21628 [ 40 ] CVE-2022-39399 https://nvd.nist.gov/vuln/detail/CVE-2022-39399 [ 41 ] CVE-2023-21830 https://nvd.nist.gov/vuln/detail/CVE-2023-21830 [ 42 ] CVE-2023-21835 https://nvd.nist.gov/vuln/detail/CVE-2023-21835 [ 43 ] CVE-2023-21843 https://nvd.nist.gov/vuln/detail/CVE-2023-21843 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202409-26 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5