<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for java-1_7_0-openjdk</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2016:1997-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2016-08-09T11:33:08Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2016-08-09T11:33:08Z</InitialReleaseDate>
    <CurrentReleaseDate>2016-08-09T11:33:08Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for java-1_7_0-openjdk</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update for java-1_7_0-openjdk fixes the following issues:

- Update to 2.6.7 - OpenJDK 7u111
  * Security fixes
    - S8079718, CVE-2016-3458: IIOP Input Stream Hooking
      (bsc#989732)
    - S8145446, CVE-2016-3485: Perfect pipe placement (Windows
      only)  (bsc#989734)
    - S8147771: Construction of static protection domains under
      Javax custom policy
    - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)
    - S8149962, CVE-2016-3508: Better delineation of XML processing
      (bsc#989731)
    - S8150752: Share Class Data
    - S8151925: Font reference improvements
    - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)
    - S8155981, CVE-2016-3606: Bolster bytecode verification
      (bsc#989722)
    - S8155985, CVE-2016-3598: Persistent Parameter Processing
      (bsc#989723)
    - S8158571, CVE-2016-3610: Additional method handle validation
      (bsc#989725)
    - CVE-2016-3511 (bsc#989727)
    - CVE-2016-3503 (bsc#989728)
    - CVE-2016-3498 (bsc#989729)
  * Import of OpenJDK 7 u111 build 0
    - S6953295: Move few sun.security.{util, x509, pkcs} classes
      used by keytool/jarsigner to another package
    - S7060849: Eliminate pack200 build warnings
    - S7064075: Security libraries don't build with
      javac -Xlint:all,-deprecation -Werror
    - S7069870: Parts of the JDK erroneously rely on generic array
      initializers with diamond
    - S7102686: Restructure timestamp code so that jars and modules
      can more easily share the same code
    - S7105780: Add SSLSocket client/SSLEngine server to templates
      directory
    - S7142339: PKCS7.java is needlessly creating SHA1PRNG
      SecureRandom instances when timestamping is not done
    - S7152582: PKCS11 tests should use the NSS libraries available
      in the OS
    - S7192202: Make sure keytool prints both unknown and
      unparseable extensions
    - S7194449: String resources for Key Tool and Policy Tool
      should be in their respective packages
    - S7196855: autotest.sh fails on ubuntu because libsoftokn.so
      not found
    - S7200682: TEST_BUG: keytool/autotest.sh still has problems
      with libsoftokn.so
    - S8002306: (se) Selector.open fails if invoked with thread
      interrupt status set [win]
    - S8009636: JARSigner including TimeStamp PolicyID
      (TSAPolicyID) as defined in RFC3161
    - S8019341: Update CookieHttpsClientTest to use the newer
      framework.
    - S8022228: Intermittent test failures in
      sun/security/ssl/javax/net/ssl/NewAPIs
    - S8022439: Fix lint warnings in sun.security.ec
    - S8022594: Potential deadlock in &lt;clinit&gt; of
      sun.nio.ch.Util/IOUtil
    - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails
      intermittently
    - S8036612: [parfait] JNI exception pending in
      jdk/src/windows/native/sun/security/mscapi/security.cpp
    - S8037557: test SessionCacheSizeTests.java timeout
    - S8038837: Add support to jarsigner for specifying timestamp
      hash algorithm
    - S8079410: Hotspot version to share the same update and build
      version from JDK
    - S8130735: javax.swing.TimerQueue: timer fires late when
      another timer starts
    - S8139436: sun.security.mscapi.KeyStore might load incomplete
      data
    - S8144313: Test SessionTimeOutTests can be timeout
    - S8146387: Test SSLSession/SessionCacheSizeTests socket
      accept timed out
    - S8146669: Test SessionTimeOutTests fails intermittently
    - S8146993: Several javax/management/remote/mandatory regression
      tests fail after JDK-8138811
    - S8147857: [TEST] RMIConnector logs attribute names incorrectly
    - S8151841, PR3098: Build needs additional flags to compile
      with GCC 6
    - S8151876: (tz) Support tzdata2016d
    - S8157077: 8u101 L10n resource file updates
    - S8161262: Fix jdk build with gcc 4.1.2: -fno-strict-overflow
      not known.
  * Import of OpenJDK 7 u111 build 1
    - S7081817: test/sun/security/provider/certpath/X509CertPath/IllegalCertificates.java failing
    - S8140344: add support for 3 digit update release numbers
    - S8145017: Add support for 3 digit hotspot minor version
      numbers
    - S8162344: The API changes made by CR 7064075 need to be
      reverted
  * Backports
    - S2178143, PR2958: JVM crashes if the number of bound CPUs
      changed during runtime
    - S4900206, PR3101: Include worst-case rounding tests for Math
      library functions
    - S6260348, PR3067: GTK+ L&amp;F JTextComponent not respecting
      desktop caret blink rate
    - S6934604, PR3075: enable parts of EliminateAutoBox by default
    - S7043064, PR3020: sun/java2d/cmm/ tests failed against
      RI b141 &amp; b138-nightly
    - S7051394, PR3020: NullPointerException when running
      regression tests LoadProfileTest by using openjdk-7-b144
    - S7086015, PR3013: fix
      test/tools/javac/parser/netbeans/JavacParserTest.java
    - S7119487, PR3013: JavacParserTest.java test fails on Windows
      platforms
    - S7124245, PR3020: [lcms] ColorConvertOp to color space
      CS_GRAY apparently converts orange to 244,244,0
    - S7159445, PR3013: (javac) emits inaccurate diagnostics for
      enhanced for-loops
    - S7175845, PR1437, RH1207129: 'jar uf' changes file
      permissions unexpectedly
    - S8005402, PR3020: Need to provide benchmarks for color
      management
    - S8005530, PR3020: [lcms] Improve performance of ColorConverOp
      for default destinations
    - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel is not
      transferred from source to destination.
    - S8013430, PR3020: REGRESSION:
      closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadProfileTest.java
      fails with java.io.StreamCorruptedException: invalid type
      code: EE since 8b87
    - S8014286, PR3075: failed java/lang/Math/DivModTests.java
      after 6934604 changes
    - S8014959, PR3075: assert(Compile::current()-&gt;live_nodes() &lt; (uint)MaxNodeLimit)
      failed: Live Node limit exceeded limit
    - S8019247, PR3075: SIGSEGV in compiled method
      c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object
    - S8024511, PR3020: Crash during color profile destruction
    - S8025429, PR3020: [parfait] warnings from b107 for
      sun.java2d.cmm: JNI exception pending
    - S8026702, PR3020: Fix for 8025429 breaks jdk build on windows
    - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for
      Java_awt test suit
    - S8047066, PR3020: Test test/sun/awt/image/bug8038000.java
      fails with ClassCastException
    - S8069181, PR3012, RH1015612: java.lang.AssertionError when
      compiling JDK 1.4 code in JDK 8
    - S8158260, PR2992, RH1341258: PPC64: unaligned Unsafe.getInt
      can lead to the generation of illegal instructions (bsc#988651)
    - S8159244, PR3075: Partially initialized string object created
      by C2's string concat optimization may escape
  * Bug fixes
    - PR2799, RH1195203: Files are missing from resources.jar
    - PR2900: Don't use WithSeed versions of NSS functions as they
      don't fully process the seed
    - PR3091: SystemTap is heavily confused by multiple JDKs
    - PR3102: Extend 8022594 to AixPollPort
    - PR3103: Handle case in clean-fonts where
      linux.fontconfig.Gentoo.properties.old has not been created
    - PR3111: Provide option to disable SystemTap tests
    - PR3114: Don't assume system mime.types supports
      text/x-java-source
    - PR3115: Add check for elliptic curve cryptography
      implementation
    - PR3116: Add tests for Java debug info and source files
    - PR3118: Path to agpl-3.0.txt not updated
    - PR3119: Makefile handles cacerts as a symlink, but the
      configure check doesn't
  * AArch64 port
    - S8148328, PR3100: aarch64: redundant lsr instructions in stub
      code.
    - S8148783, PR3100: aarch64: SEGV running SpecJBB2013
    - S8148948, PR3100: aarch64: generate_copy_longs calls align()
      incorrectly
    - S8150045, PR3100: arraycopy causes segfaults in SATB during
      garbage collection
    - S8154537, PR3100: AArch64: some integer rotate instructions
      are never emitted
    - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess loads
      in wrong mode
    - S8157906, PR3100: aarch64: some more integer rotate
      instructions are never emitted
- Enable SunEC for SLE12 and Leap (bsc#982366)

- Fix aarch64 running with 48 bits va space (bsc#984684)

</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-DESKTOP-12-SP1-2016-1186,SUSE-SLE-SERVER-12-SP1-2016-1186</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      <Description>Link for SUSE-SU-2016:1997-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2016-August/002184.html</URL>
      <Description>E-Mail link for SUSE-SU-2016:1997-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/982366</URL>
      <Description>SUSE Bug 982366</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/984684</URL>
      <Description>SUSE Bug 984684</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/988651</URL>
      <Description>SUSE Bug 988651</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989722</URL>
      <Description>SUSE Bug 989722</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989723</URL>
      <Description>SUSE Bug 989723</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989725</URL>
      <Description>SUSE Bug 989725</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989727</URL>
      <Description>SUSE Bug 989727</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989728</URL>
      <Description>SUSE Bug 989728</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989729</URL>
      <Description>SUSE Bug 989729</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989730</URL>
      <Description>SUSE Bug 989730</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989731</URL>
      <Description>SUSE Bug 989731</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989732</URL>
      <Description>SUSE Bug 989732</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989733</URL>
      <Description>SUSE Bug 989733</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/989734</URL>
      <Description>SUSE Bug 989734</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3458/</URL>
      <Description>SUSE CVE CVE-2016-3458 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3485/</URL>
      <Description>SUSE CVE CVE-2016-3485 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3498/</URL>
      <Description>SUSE CVE CVE-2016-3498 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3500/</URL>
      <Description>SUSE CVE CVE-2016-3500 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3503/</URL>
      <Description>SUSE CVE CVE-2016-3503 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3508/</URL>
      <Description>SUSE CVE CVE-2016-3508 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3511/</URL>
      <Description>SUSE CVE CVE-2016-3511 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3550/</URL>
      <Description>SUSE CVE CVE-2016-3550 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3598/</URL>
      <Description>SUSE CVE CVE-2016-3598 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3606/</URL>
      <Description>SUSE CVE CVE-2016-3606 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-3610/</URL>
      <Description>SUSE CVE CVE-2016-3610 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Desktop 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Desktop 12 SP1" CPE="cpe:/o:suse:sled:12:sp1">SUSE Linux Enterprise Desktop 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1" CPE="cpe:/o:suse:sles:12:sp1">SUSE Linux Enterprise Server 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1" CPE="cpe:/o:suse:sles_sap:12:sp1">SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_0-openjdk-1.7.0.111-33.1">
      <FullProductName ProductID="java-1_7_0-openjdk-1.7.0.111-33.1">java-1_7_0-openjdk-1.7.0.111-33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_0-openjdk-headless-1.7.0.111-33.1">
      <FullProductName ProductID="java-1_7_0-openjdk-headless-1.7.0.111-33.1">java-1_7_0-openjdk-headless-1.7.0.111-33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_0-openjdk-demo-1.7.0.111-33.1">
      <FullProductName ProductID="java-1_7_0-openjdk-demo-1.7.0.111-33.1">java-1_7_0-openjdk-demo-1.7.0.111-33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_0-openjdk-devel-1.7.0.111-33.1">
      <FullProductName ProductID="java-1_7_0-openjdk-devel-1.7.0.111-33.1">java-1_7_0-openjdk-devel-1.7.0.111-33.1</FullProductName>
    </Branch>
    <Relationship ProductReference="java-1_7_0-openjdk-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1">java-1_7_0-openjdk-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Desktop 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-headless-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1">java-1_7_0-openjdk-headless-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Desktop 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1">java-1_7_0-openjdk-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-demo-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1">java-1_7_0-openjdk-demo-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-devel-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1">java-1_7_0-openjdk-devel-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-headless-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1">java-1_7_0-openjdk-headless-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1">java-1_7_0-openjdk-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-demo-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1">java-1_7_0-openjdk-demo-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-devel-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1">java-1_7_0-openjdk-devel-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_0-openjdk-headless-1.7.0.111-33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1">java-1_7_0-openjdk-headless-1.7.0.111-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.</Note>
    </Notes>
    <CVE>CVE-2016-3458</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3458.html</URL>
        <Description>CVE-2016-3458</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989732</URL>
        <Description>SUSE Bug 989732</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.</Note>
    </Notes>
    <CVE>CVE-2016-3485</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.2</BaseScoreV2>
        <VectorV2>AV:L/AC:H/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>2.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3485.html</URL>
        <Description>CVE-2016-3485</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1009280</URL>
        <Description>SUSE Bug 1009280</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989734</URL>
        <Description>SUSE Bug 989734</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows remote attackers to affect availability via vectors related to JavaFX.</Note>
    </Notes>
    <CVE>CVE-2016-3498</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3498.html</URL>
        <Description>CVE-2016-3498</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989729</URL>
        <Description>SUSE Bug 989729</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.</Note>
    </Notes>
    <CVE>CVE-2016-3500</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3500.html</URL>
        <Description>CVE-2016-3500</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989730</URL>
        <Description>SUSE Bug 989730</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.</Note>
    </Notes>
    <CVE>CVE-2016-3503</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.7</BaseScoreV2>
        <VectorV2>AV:L/AC:H/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3503.html</URL>
        <Description>CVE-2016-3503</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989728</URL>
        <Description>SUSE Bug 989728</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.</Note>
    </Notes>
    <CVE>CVE-2016-3508</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3508.html</URL>
        <Description>CVE-2016-3508</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989731</URL>
        <Description>SUSE Bug 989731</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.</Note>
    </Notes>
    <CVE>CVE-2016-3511</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.7</BaseScoreV2>
        <VectorV2>AV:L/AC:H/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3511.html</URL>
        <Description>CVE-2016-3511</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1009280</URL>
        <Description>SUSE Bug 1009280</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989727</URL>
        <Description>SUSE Bug 989727</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="8">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.</Note>
    </Notes>
    <CVE>CVE-2016-3550</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3550.html</URL>
        <Description>CVE-2016-3550</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989733</URL>
        <Description>SUSE Bug 989733</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="9">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.</Note>
    </Notes>
    <CVE>CVE-2016-3598</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.6</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3598.html</URL>
        <Description>CVE-2016-3598</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1009280</URL>
        <Description>SUSE Bug 1009280</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989723</URL>
        <Description>SUSE Bug 989723</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="10">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.</Note>
    </Notes>
    <CVE>CVE-2016-3606</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3606.html</URL>
        <Description>CVE-2016-3606</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989722</URL>
        <Description>SUSE Bug 989722</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="11">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598.</Note>
    </Notes>
    <CVE>CVE-2016-3610</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-demo-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-devel-1.7.0.111-33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:java-1_7_0-openjdk-headless-1.7.0.111-33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.6</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-3610.html</URL>
        <Description>CVE-2016-3610</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989725</URL>
        <Description>SUSE Bug 989725</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
