<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">
Security update for java-1_7_0-ibm </DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2015:1073-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2015-06-12T14:22:03Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2015-06-12T14:22:03Z</InitialReleaseDate>
    <CurrentReleaseDate>2015-06-12T14:22:03Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">
Security update for java-1_7_0-ibm </Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update fixes the following security issues:

- Version bump to 7.1-3.0 release bnc#930365 CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138

- Fix removeing links before update-alternatives run. bnc#931702

- Fix bnc#912434, javaws/plugin stuff should slave plugin update-alternatives
- Fix bnc#912447, use system cacerts

- Update to 7.1.2.10 for sec issues bnc#916266 and bnc#916265 CVE-2014-8892 CVE-2014-8891
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-SDK-12-2015-270,SUSE-SLE-SERVER-12-2015-270</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151073-1/</URL>
      <Description>Link for SUSE-SU-2015:1073-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2015-June/001442.html</URL>
      <Description>E-Mail link for SUSE-SU-2015:1073-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/912434</URL>
      <Description>SUSE Bug 912434</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/912447</URL>
      <Description>SUSE Bug 912447</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/930365</URL>
      <Description>SUSE Bug 930365</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/931693</URL>
      <Description>SUSE Bug 931693</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/931702</URL>
      <Description>SUSE Bug 931702</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-0138/</URL>
      <Description>SUSE CVE CVE-2015-0138 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-0192/</URL>
      <Description>SUSE CVE CVE-2015-0192 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-1914/</URL>
      <Description>SUSE CVE CVE-2015-1914 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-2808/</URL>
      <Description>SUSE CVE CVE-2015-2808 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12" CPE="cpe:/o:suse:sles:12">SUSE Linux Enterprise Server 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12" CPE="cpe:/o:suse:sles_sap:12">SUSE Linux Enterprise Server for SAP Applications 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12" CPE="cpe:/o:suse:sle-sdk:12">SUSE Linux Enterprise Software Development Kit 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1">
      <FullProductName ProductID="java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1">java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_1-ibm-1.7.1_sr3.0-11.1">
      <FullProductName ProductID="java-1_7_1-ibm-1.7.1_sr3.0-11.1">java-1_7_1-ibm-1.7.1_sr3.0-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1">
      <FullProductName ProductID="java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1">java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1">
      <FullProductName ProductID="java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1">java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1">
      <FullProductName ProductID="java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1">java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</FullProductName>
    </Branch>
    <Relationship ProductReference="java-1_7_1-ibm-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1">java-1_7_1-ibm-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1">java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1">java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1">java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1">java-1_7_1-ibm-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1">java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1">java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1">java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12:java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1">java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1 as a component of SUSE Linux Enterprise Software Development Kit 12</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.</Note>
    </Notes>
    <CVE>CVE-2015-0138</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12:java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151073-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0138.html</URL>
        <Description>CVE-2015-0138</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/952088</URL>
        <Description>SUSE Bug 952088</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.</Note>
    </Notes>
    <CVE>CVE-2015-0192</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12:java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151073-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0192.html</URL>
        <Description>CVE-2015-0192</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/952088</URL>
        <Description>SUSE Bug 952088</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine.</Note>
    </Notes>
    <CVE>CVE-2015-1914</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12:java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151073-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-1914.html</URL>
        <Description>CVE-2015-1914</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/952088</URL>
        <Description>SUSE Bug 952088</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.</Note>
    </Notes>
    <CVE>CVE-2015-2808</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12:java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12:java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151073-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-2808.html</URL>
        <Description>CVE-2015-2808</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925378</URL>
        <Description>SUSE Bug 925378</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/938248</URL>
        <Description>SUSE Bug 938248</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/938895</URL>
        <Description>SUSE Bug 938895</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/952088</URL>
        <Description>SUSE Bug 952088</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
