[CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution

[Simon Quigley]

This aims to fix two CVEs:

 - CVE-2013-2027: Creates executables class files with wrong permissions
 - CVE-2016-4000: Unsafe deserialization leads to code execution

While CVE-2013-2027 is not shown as fixed in Debian and Red Hat, it is fixed in OpenSUSE (openSUSE-SU-2015:0269-1), we can backport their patches.

CVE-2016-4000 was fixed in Debian in 2.5.3-17, and that's in Artful, but we still need fixes for Trusty, Xenial, and Zesty.

[Simon Quigley (tsimonq2)]

Since CVE-2016-4000 is High priority, marking as High priority in all releases affected, marking as Medium in Artful.

[Simon Quigley (tsimonq2)]

Uploaded to Artful: https://launchpad.net/ubuntu/+source/jython/2.5.3-17ubuntu1

[Launchpad Janitor (janitor)]

This bug was fixed in the package jython - 2.5.3-17ubuntu1

---------------
jython (2.5.3-17ubuntu1) artful; urgency=medium

  * SECURITY UPDATE: Creates executables class files with wrong permissions
    (LP: #1714728)
    - CVE-2013-2027
    - 1-CVE-2013-2027.patch
    - 2-CVE-2013-2027.patch
    - 3-CVE-2013-2027.patch
    - Thanks to Lubomir Rintel for the patches!

 -- Simon Quigley <email address hidden> Sat, 02 Sep 2017 21:26:38 -0500

[Simon Quigley (tsimonq2)]

Uploaded the fixes to ppa:tsimonq2/security-builds if anybody would like to test.

[Simon Quigley (tsimonq2)]

Attached is a patch for Zesty applicable to 2.5.3-15.

I tested it on a Ubuntu 17.04 install and it works as intended.

[Simon Quigley (tsimonq2)]

Attached is a patch for Xenial applicable to 2.5.3-9.

I tested it on a Lubuntu 16.04 install and it works as intended.

[Simon Quigley (tsimonq2)]

Attached is a patch for Trusty applicable to 2.5.3-1.

I tested it on a Lubuntu 14.04 install and it works as intended.

[Launchpad Janitor (janitor)]

This bug was fixed in the package jython - 2.5.3-9ubuntu0.1

---------------
jython (2.5.3-9ubuntu0.1) xenial-security; urgency=high

  [ Simon Quigley ]
  * SECURITY UPDATE: Creates executables class files with wrong permissions
    (LP: #1714728)
    - CVE-2013-2027
    - 1-CVE-2013-2027.patch
    - 2-CVE-2013-2027.patch
    - 3-CVE-2013-2027.patch
    - Thanks to Lubomir Rintel for the patches!

  [ Markus Koschany ]
  * SECURITY UPDATE: Unsafe deserialization may lead to arbitrary code
    execution
    - CVE-2016-4000
    - CVE-2016-4000.patch

 -- Simon Quigley <email address hidden> Mon, 18 Sep 2017 06:25:00 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package jython - 2.5.3-1ubuntu0.1

---------------
jython (2.5.3-1ubuntu0.1) trusty-security; urgency=high

  [ Simon Quigley ]
  * SECURITY UPDATE: Creates executables class files with wrong permissions
    (LP: #1714728)
    - CVE-2013-2027
    - 1-CVE-2013-2027.patch
    - 2-CVE-2013-2027.patch
    - 3-CVE-2013-2027.patch
    - Thanks to Lubomir Rintel for the patches!

  [ Markus Koschany ]
  * SECURITY UPDATE: Unsafe deserialization may lead to arbitrary code
    execution
    - CVE-2016-4000
    - CVE-2016-4000.patch

 -- Simon Quigley <email address hidden> Wed, 20 Sep 2017 21:10:50 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package jython - 2.5.3-15ubuntu0.1

---------------
jython (2.5.3-15ubuntu0.1) zesty-security; urgency=high

  [ Simon Quigley ]
  * SECURITY UPDATE: Creates executables class files with wrong permissions
    (LP: #1714728)
    - CVE-2013-2027
    - 1-CVE-2013-2027.patch
    - 2-CVE-2013-2027.patch
    - 3-CVE-2013-2027.patch
    - Thanks to Lubomir Rintel for the patches!

  [ Markus Koschany ]
  * SECURITY UPDATE: Unsafe deserialization may lead to arbitrary code
    execution
    - CVE-2016-4000
    - CVE-2016-4000.patch

 -- Simon Quigley <email address hidden> Mon, 18 Sep 2017 00:43:55 -0500

[Seth Arnold (seth-arnold)]

Thanks Simon!