GNU/Andrew’s Blog

The IcedTea project provides a harness to build the source code from OpenJDK6 using Free Software build tools, along with additional features such as a PulseAudio sound driver and support for alternative virtual machines.

A new set of releases for the IcedTea6 series is now available, which includes a number of bug fixes for issues reported since the last release. Full details are below.

Please note that, with the imminent release of IcedTea6 1.11, this will be the last release in the 1.8 series. We also generally recommend that users start to investigate Java 1.7 and the 2.0 series of IcedTea releases, as support for the older 1.6 releases will begin to diminish.

What’s New?

New in release 1.10.5 (2012-01-11)

• Backports
  • S7034464: Support transparent large pages on Linux
  • S7037939: NUMA: Disable adaptive resizing if SHM large pages are used
  • S7102369, RH751203: remove java.rmi.server.codebase property parsing from registyimpl
  • S7094468, RH751203: rmiregistry clean up
  • S7103725, RH767129: REGRESSION – 6u29 breaks ssl connectivity using TLS_DH_anon_WITH_AES_128_CBC_SHA
  • S6851973, PR830: ignore incoming channel binding if acceptor does not set one
  • S7091528: javadoc attempts to parse .class files

New in release 1.9.12 (2012-01-11)

• Backports
  • S7102369, RH751203: remove java.rmi.server.codebase property parsing from registyimpl
  • S7094468, RH751203: rmiregistry clean up
  • S7103725, RH767129: REGRESSION – 6u29 breaks ssl connectivity using TLS_DH_anon_WITH_AES_128_CBC_SHA
  • S6851973, PR830: ignore incoming channel binding if acceptor does not set one

New in release 1.8.12 (2012-01-11)

• Backports
  • S7102369, RH751203: remove java.rmi.server.codebase property parsing from registyimpl
  • S7094468, RH751203: rmiregistry clean up
  • S7103725, RH767129: REGRESSION – 6u29 breaks ssl connectivity using TLS_DH_anon_WITH_AES_128_CBC_SHA
  • S6851973, PR830: ignore incoming channel binding if acceptor does not set one

The tarballs can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea6-1.8.12.tar.gz (sig)
• http://icedtea.classpath.org/download/source/icedtea6-1.9.12.tar.gz (sig)
• http://icedtea.classpath.org/download/source/icedtea6-1.10.5.tar.gz (sig)

SHA256 checksums:

• ddd3eceba02b5511c1c399e0067c6348d2215f49262e9456108dd2da66b937d7 icedtea6-1.8.12.tar.gz
• dfd8c88052aca10ef12ae78ddce883cf2ee308e77624e24127f4b97f19ed733c icedtea6-1.9.12.tar.gz
• 7d0f9e833a42b6af308a34d432431f0528a2efa52d7837aa446d1c4c27161a0c icedtea6-1.10.5.tar.gz

Each tarball is accompanied by a digital signature (available at the above URL + ‘.sig’). This is produced using my public key:

• PGP Key: 248BDC07 (https://keys.indymedia.org/)
• Fingerprint = EC5A 1F5E C0AD 1D15 8F1F 8F91 3B96 A578 248B DC07

The following people helped with these releases:

• Deepak Bhole (backport of 7037939, 7034464, 7043564)
• Andrew John Hughes (release management and backports of 7091528, 6851973, 7103725)
• Omair Majid (backport of 7102369)

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea6-<ver>.tar.gz
$ cd icedtea6-<ver>

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

The IcedTea project provides a harness to build the source code from OpenJDK6 using Free Software build tools, along with additional features such as a PulseAudio sound driver and support for alternative
virtual machines.

A new set of security releases is now available for versions of IcedTea which include the plugin and Web Start support now developed in the IcedTea-Web project:

• IcedTea6 1.8.11
• IcedTea6 1.9.11

Where possible, we recommend using IcedTea-Web in preference to these older versions, in order to obtain the latest bug fixes and features.

All updates contain the following security fixes:

• RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

Full details of each release can be found below.

What’s New?

New in release 1.9.11 (2011-11-08)

• Security fixes
  • RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

New in release 1.8.11 (2011-11-08)

• Security fixes
  • RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

The tarballs can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea6-1.8.11.tar.gz
• http://icedtea.classpath.org/download/source/icedtea6-1.9.11.tar.gz

SHA256 checksums:

• 6eb418ec0609080a71bda16896124d6e1ac23b2f54af52e05fc22c719e12ca29 icedtea6-1.8.11.tar.gz
• fd3b32f8dd1010fa8b752f0224fb25a8fe102c9f82652f0ded32138fd4ba3714 icedtea6-1.9.11.tar.gz

Each tarball is accompanied by a digital signature (available at the above URL + ‘.sig’). This is produced using my public key. See details below in the signature.

The following people helped with these releases:

• Deepak Bhole (RH742515)
• Andrew John Hughes (release management)
• Omair Majid (additional patch preparation work)

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea6-<ver>.tar.gz
$ cd icedtea6-<ver>

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

We are pleased to announce the release of IcedTea 2.0!

This release is the first release of IcedTea based on OpenJDK7 since it was released for general availability. It includes all changes from the public OpenJDK7 tree, together with the latest security fixes and a number of IcedTea enhancements.

The IcedTea project provides a harness to build the source code from OpenJDK using Free Software build tools, along with additional features such as a PulseAudio sound driver and support for alternative virtual machines.

Please note that CACAO is not supported in this release as it does not yet support the current OpenJDK7. Support is likely to be restored in a future release.

What’s New?

• Security fixes
  • S7000600, CVE-2011-3547: InputStream skip() information leak
  • S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
  • S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
  • S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
  • S7046794, CVE-2011-3553: JAX-WS stack-traces information leak
  • S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
  • S7055902, CVE-2011-3521: IIOP deserialization code execution
  • S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
  • S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
  • S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer
  • S7077466, CVE-2011-3556: RMI DGC server remote code execution
  • S7083012, CVE-2011-3557: RMI registry privileged code execution
  • S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
• Bug fixes
  • Allow the compiler used to be overridden by setting BUILD_GCC/BUILD_CPP.
  • Fixed regression test runtime/7020373.
  • Convert to optional system library usage via USE_SYSTEM_ZLIB/JPEG/PNG/GIF.
  • PR586: Add missing sources to src.zip.
  • PR717: All non-bootstrap non-conditional patches in IcedTea7 should be in the forest or dropped.
  • PR767: Annotation Processing Filer.getResource() always throws FileNotFoundException
  • PR790: Re-include JAXP and JAXWS in the source tree
  • G356743: Support building against libpng 1.5.
  • S7070134: Hotspot crashes with sigsegv from PorterStemmer
  • S7044738: Loop unroll optimization causes incorrect result
  • S7068051: SIGSEGV in PhaseIdealLoop::build_loop_late_post
  • S7073913: Avoid random segfaults.
  • PR751: IcedTea7 should bootstrap with IcedTea7
• Zero/Shark
  • PR757, S7066143: 7009309 regression: x86 stubRoutines
  • PR753, S7066143: 7009923 regression
  • PR770: Zero 7033954 regression: missing mapfile
  • methodHandles_zero missing.
  • sharkContext typo in assert
  • sharedRuntime needs rework after indy reorg
  • Add missing describe_pd method for Zero.
• JamVM
  • JamVM is self-hosting.
  • PR772: jtreg LocalOnlyTest sends SIGQUIT to all processes on exit.
  • LP827463: Fix OpenJDK enclosingMethodInfo().
  • Add support for armhf.
  • Skip Java-reflection-related DelegatingClassLoaders, enables JamVM to run NetBeans.
  • Generic JNI stubs for common JNI method signatures.
  • Fix memory heap arguments in terms of gigabytes.
  • armhf: ensure stack is 8 byte aligned.
  • “Fix” handling of CLI bootclasspath options.
  • Fix for StackTraceElement checkin.
  • Fix typo in definition of ACC_MIRANDA.
  • Intern strings when creating a StackTraceElement.
  • Ignore assertions and verify options.
  • Remove empty clobber.
  • Use dots instead of slashes in classname for exception.
  • Correct thrown exception by bootstrap loader.
  • Put parsing of -cp and -classpath options back in.
  • Fix threading of references list during compaction.
  • Further fix to freeClassData for native methods.
  • Fix class GC with classes containing Miranda methods.
  • Propogate initialisation errors to top-level.
  • Make classlib init functions consistent + warnings.
  • Correctly implement sun.misc.Unsafe freeMemory().
  • Move lazy-loading to init function.
  • Fix various warnings with -Wall.
  • PrintThreadsDump needs “self” as argument.
  • CopyMemory, etc. handle negative or truncation in length.
  • Extra sun.misc.Unsafe functions.
  • Ignore options for jtreg tests.
  • Enable shutdownVM to be called with OpenJDK classlib.
  • Initial implementation of JVM_FindClassFromBootLoader.
  • Fix callJNIMethod on i386 with -fomit-frame-pointer.
  • Fix backwards cache conflict resolution code.
  • Unify command line options parsing.
  • Remove debug printf.
  • Fix leak of native thread structure.
  • Consistent naming for classlib functions.
  • Add extra includes to get rid off compiler warning.
  • Rework OpenJDK storage of native thread structure.
  • Implement remaining OpenJDK Array reflection interface.

The tarball can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea-2.0.tar.gz (signature)

The tarball is accompanied by a digital signature, produced using my public key.

pub   4096R/248BDC07 2011-09-28 [expires: 2012-09-27]
      Key fingerprint = EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07
uid                  Dr Andrew John Hughes <ahughes@redhat.com>
uid                  Dr Andrew John Hughes <gnu_andrew@member.fsf.org>
sub   4096R/954E386D 2011-09-28 [expires: 2012-09-27]

SHA256 checksum:

• 2485d5e7807658bc3488c7e6d4720ef1261a31dd698ce2641f541119e0c2387a icedtea-2.0.tar.gz

The following people helped with these releases:

• Mark David Dumlao (JamVM support)
• Andrew John Hughes (all other fixes and release management)
• Matthias Klose (addvm support)
• Xerxes Rånby (Zero/Shark & JamVM support)
• Marc Schoenefeld (regression test for HotSpot bug 7020373)
• Pavel Tisnovsky (fix for HotSpot bug 7073913)
• Mark Wielaard (devel package suggestions, server URL updates)

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea-2.0.tar.gz
$ cd icedtea-2.0

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

Happy hacking!

The IcedTea project provides a harness to build the source code from OpenJDK6 using Free Software build tools, along with additional features such as a PulseAudio sound driver and support for alternative virtual machines.

A new set of security releases is now available:

• IcedTea6 1.8.10
• IcedTea6 1.9.10
• IcedTea6 1.10.4

All updates contain the following security fixes:

• S7000600, CVE-2011-3547: InputStream skip() information leak
• S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
• S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
• S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
• S7046794, CVE-2011-3553: JAX-WS stack-traces information leak
• S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
• S7055902, CVE-2011-3521: IIOP deserialization code execution
• S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
• S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
• S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer
• S7077466, CVE-2011-3556: RMI DGC server remote code execution
• S7083012, CVE-2011-3557: RMI registry privileged code execution
• S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection

The 1.9.10 and 1.10.4 updates also include:

• S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer

The patch for this issue did not apply to the older versions of HotSpot (14 and 16) supported by the 1.8 release series. It is believed that the underlying issue is also not present in these versions, but for safety, we recommend using the latest 1.10.x release series where possible.

Full details of each release can be found below.

What’s New?

New in release 1.10.4 (2011-10-18)

• Security fixes
  • S7000600, CVE-2011-3547: InputStream skip() information leak
  • S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
  • S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
  • S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
  • S7046794, CVE-2011-3553: JAX-WS stack-traces information leak
  • S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
  • S7055902, CVE-2011-3521: IIOP deserialization code execution
  • S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
  • S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
  • S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer
  • S7077466, CVE-2011-3556: RMI DGC server remote code execution
  • S7083012, CVE-2011-3557: RMI registry privileged code execution
  • S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
• Bug fixes
  • RH727195: Japanese font mappings are broken
• Backports
  • S6826104, RH730015: Getting a NullPointer exception when clicked on Application & Toolkit Modal dialog
• Zero/Shark
  • PR690: Shark fails to JIT using hs20.
  • PR696: Zero fails to handle fast_aldc and fast_aldc_w in hs20.

New in release 1.9.10 (2011-10-18)

• Security fixes
  • S7000600, CVE-2011-3547: InputStream skip() information leak
  • S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
  • S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
  • S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
  • S7046794, CVE-2011-3553: JAX-WS stack-traces information leak
  • S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
  • S7055902, CVE-2011-3521: IIOP deserialization code execution
  • S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
  • S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
  • S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer
  • S7077466, CVE-2011-3556: RMI DGC server remote code execution
  • S7083012, CVE-2011-3557: RMI registry privileged code execution
  • S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
• NetX
  • PR794: javaws does not work if a Web Start app jar has a Class-Path element in the manifest
• Fixes
  • G356743: Support libpng 1.5.

New in release 1.8.10 (2011-10-18)

• Security fixes
  • S7000600, CVE-2011-3547: InputStream skip() information leak
  • S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
  • S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
  • S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
  • S7046794, CVE-2011-3553: JAX-WS stack-traces information leak
  • S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
  • S7055902, CVE-2011-3521: IIOP deserialization code execution
  • S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
  • S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
  • S7077466, CVE-2011-3556: RMI DGC server remote code execution
  • S7083012, CVE-2011-3557: RMI registry privileged code execution
  • S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
• NetX
  • PR794: javaws does not work if a Web Start app jar has a Class-Path element in the manifest
  • PR764: icedtea 1.8.9 fails to build in CachedJarFileCallback.java
• Fixes
  • G356743: Support libpng 1.5.

The tarballs can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea6-1.8.10.tar.gz (signature)
• http://icedtea.classpath.org/download/source/icedtea6-1.9.10.tar.gz (signature)
• http://icedtea.classpath.org/download/source/icedtea6-1.10.4.tar.gz (signature)

Each tarball is accompanied by a digital signature. This is produced using my public key:

pub   4096R/248BDC07 2011-09-28 [expires: 2012-09-27]
      Key fingerprint = EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07
uid                  Dr Andrew John Hughes <ahughes@redhat.com>
uid                  Dr Andrew John Hughes <gnu_andrew@member.fsf.org>
sub   4096R/954E386D 2011-09-28 [expires: 2012-09-27]

SHA256 checksums:

• c4a17b55de875a49efa192cfe015f1cb0cf02aeac03f7fc7afe2a3e9fdef64b83 icedtea6-1.8.10.tar.gz
• 3f41d433ed362f2bb81536585511d901b19864b98a97abab8ccd0b4ba00803a6 icedtea6-1.9.10.tar.gz
• 15491d7f2f81436aaf87f964d923b95b4bda8f6689198b4999961070b6c68851 icedtea6-1.10.4.tar.gz

The following people helped with these releases:

• Deepak Bhole (PR794, S6826104)
• Andrew John Hughes (all other fixes and release management)
• Xerxes Rånby (PR690, PR696)
• Jiri Vanek (RH727195)

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea6-<ver>.tar.gz
$ cd icedtea6-<ver>

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

Happy hacking!

IcedTea7 2.0 has now branched for release. I plan to do the release on Monday evening here in the UK, pending major issues.

Features new since 1.14

• PR717: All non-bootstrap non-conditional patches in IcedTea7 should be in the forest or dropped. The only patches now in IcedTea7 are either conditional or necessary to bootstrap. The other patches have been either moved to the forest or removed because they were no longer required.
• Convert to optional system library usage via USE_SYSTEM_ZLIB/JPEG/PNG/GIF. The old libraries.patch is now upstream in the form of USE_SYSTEM_ZLIB/JPEG/PNG/GIF. It also has also been joined by some friends: USE_SYSTEM_GTK/CUPS/FONTCONFIG/GIO which relate to libraries formally used by dlopen/dlsym calls, but which can now optionally be linked at runtime to reduce the risk of issues. More on this in an upcoming blog.
• PR790: Re-include JAXP and JAXWS in the source tree. Previously, the JAXP and JAXWS repository tarballs were fairly useless as all they contained was build machinery, with the actual code being in another tarball. Not only did this increase the amount of build machinery and downloading required, it also made it harder to patch the sources. The sources have now been restored to the OpenJDK tree (a facility provided by the upstream build code) and the drop machinery in IcedTea7 removed.
• Allow the compiler used to be overridden by setting BUILD_GCC/BUILD_CPP. This is a more general version of the gcc-suffix patch. BUILD_GCC and BUILD_CPP can be set to any arbitrary C/C++ compiler and IcedTea7 defaults to using $(CC) and $(CXX).

System dependency updates

• IcedTea7 now works with Linux 3.0+ and libpng 1.5+

Please test prior to release. The release branch is currently http://icedtea.classpath.org/people/andrew/icedtea7-2.0 with an accompanying forest:

• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/
• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/corba
• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/jaxp
• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/jaxws
• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/hotspot
• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/langtools
• http://icedtea.classpath.org/people/andrew/icedtea7-forest-2.0/jdk

A pre-release tarball is now available, made against the branchpoint after a make distcheck:

• http://icedtea.classpath.org/download/source/icedtea-2.0pre.tar.gz
• SHA256 sum: aacbacbafd5baaea3653d6f5ecd6f56ebb679ecf186e6f061c3674209df81490

It’s signed with my new public key: http://icedtea.classpath.org/download/source/icedtea-2.0pre.tar.gz.sig

pub   4096R/248BDC07 2011-09-28 [expires: 2012-09-27]
uid                  Dr Andrew John Hughes <ahughes@redhat.com>
uid                  Dr Andrew John Hughes <gnu_andrew@member.fsf.org>
sub   4096R/954E386D 2011-09-28 [expires: 2012-09-27]

Update 1

FYI, I’ve already discovered that bootstrapping with IcedTea7 seems to have broken again… Working on a fix. Bootstrap builds with GNU Classpath and non-bootstrap builds with IcedTea6/7 should be fine.

We are pleased to announce a new minor release of IcedTea6, 1.10.3!

The IcedTea6 project provides a harness to build the source code from OpenJDK6 using Free Software build tools. It also includes support for using alternate virtual machines such as CACAO and JamVM.

What’s New?

New in release 1.10.3 (2011-07-21):

• Bug fixes
  • PR748: Icedtea6 fails to build with Linux 3.0.
  • PR744: icedtea6-1.10.2 : patching error
• Backports:
  • S7037283, RH712211: Null Pointer Exception in SwingUtilities2.
  • S6769607, PR677: Modal frame hangs for a while.
  • S6578583: Modality is broken in windows vista home premium from jdk1.7 b02 onwards.
  • S6610244: modal dialog closes with fatal error if -Xcheck:jni is set

The tarball can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea6-1.10.3.tar.gz

SHA256 sums:

• c29827bf4b5ceed41799e680395fa475b67f5bbc94de7bc323030feb4f2be5db icedtea6-1.10.3.tar.gz

The following people helped with this release:

• Andrew John Hughes
• Denis Lila
• Pavel Tisnovsky

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea6-1.10.3.tar.gz
$ cd icedtea6-1.10.3

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-cacao --enable-pulse-java --enable-systemtap ...]
$ make

There is a new set of security releases: IcedTea6 1.8.9 and IcedTea6 1.9.9. This security issue concerns IcedTea-Web, which is not part of the IcedTea6 1.10 series, hence there will be no IcedTea6 1.10 security update. However, an IcedTea6 1.10 bug fix update will follow shortly.

This update contains the following security updates:

• RH718164, CVE-2011-2513: Home directory path disclosure to untrusted apps

The IcedTea project provides a harness to build the source code from OpenJDK6 using Free Software build tools. It also includes the only Free Java plugin and Web Start implementation, and support for additional architectures over and above x86, x86_64 and SPARC via the Zero assembler port.

What Else Is New?

New in release 1.8.9 (2011-07-20)

• Bug fixes
  • PR744: icedtea6-1.10.2 : patching error
  • PR748: Icedtea6 fails to build with Linux 3.0.

New in release 1.9.9 (2011-07-20)

• Bug Fixes
  • PR744: icedtea6-1.10.2 : patching error
  • PR748: Icedtea6 fails to build with Linux 3.0.
• Shark
  • PR632: patches/security/20110215/6878713.patch breaks shark zero build

The tarballs can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea6-1.8.9.tar.gz
• http://icedtea.classpath.org/download/source/icedtea6-1.9.9.tar.gz

SHA256 sums

• e12e06c2ee642396f1d080d871a42fa4db38aced10bf13c20644f752ef03741f icedtea6-1.8.9.tar.gz
• c2419896f8925822b0135bcd2db37affcb2b9f6f50d782e7f6b8d23afb5beb39 icedtea6-1.9.9.tar.gz

The following people helped with these releases:

• Andrew John Hughes
• Omair Majid
• Xerxes Rånby
• Pavel Tisnovsky
• Mark Wielaard

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea6-<ver>.tar.gz
$ cd icedtea6-<ver>

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

There is a new set of security releases: IcedTea6 1.8.8, IcedTea6 1.9.8 and IcedTea6 1.10.2.

This update contains the following security updates:

• S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent disabled get still selected for read ops (win)
• S6618658, CVE-2011-0865: Vulnerability in deserialization
• S7012520, CVE-2011-0815: Heap overflow vulnerability in FileDialog.show()
• S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D code
• S7013969, CVE-2011-0867: NetworkInterface.toString can reveal bindings
• S7013971, CVE-2011-0869: Vulnerability in SAAJ
• S7016340, CVE-2011-0870: Vulnerability in SAAJ
• S7016495, CVE-2011-0868: Crash in Java 2D transforming an image with scale close to zero
• S7020198, CVE-2011-0871: ImageIcon creates Component with null acc
• S7020373, CVE-2011-0864: JSR rewriting can overflow memory address size variables

The IcedTea project provides a harness to build the source code from OpenJDK6 using Free Software build tools. It also includes the only Free Java plugin and Web Start implementation, and support for additional architectures over and above x86, x86_64 and SPARC via the Zero assembler port.

What Else Is New?

IcedTea6 1.8.8

• Backports
  • S6675802: Regression: heavyweight popups cause SecurityExceptions in applets
  • S6691503: Malicious applet can show always-on-top popup menu which has whole screen size
  • PR632: patches/security/20110215/6878713.patch breaks shark zero build
  • Fixed AccessControlContext which was thrown while working with Color class in a PropertyEditor
• Plugin
  • PR542: Plugin fails with NPE on http://www.openprocessing.org/visuals/iframe.php?visualID=2615

IcedTea6 1.9.8

• Backports
  • S6675802: Regression: heavyweight popups cause SecurityExceptions in applets
  • S6691503: Malicious applet can show always-on-top popup menu which has whole screen size
  • S6980392, PR642: simple correction in testcase, added missing bracket
  • Fixed AccessControlContext which was thrown while working with Color class in a PropertyEditor
• Plugin
  • PR542: Plugin fails with NPE on http://www.openprocessing.org/visuals/iframe.php?visualID=2615
• Shark
  • PR689: Shark fails to find LLVM 2.9 System headers during build

IcedTea6 1.10.2

• Backports
  • S7043054: REGRESSION – wrong userBounds in Paint.createContext()
  • S7043963, RH698295: Window manager workaround in AWT was not applied to mutter. Now it is.
• Shark
  • PR689: Shark fails to find LLVM 2.9 System headers during build.

The tarballs can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea6-1.8.8.tar.gz
• http://icedtea.classpath.org/download/source/icedtea6-1.9.8.tar.gz
• http://icedtea.classpath.org/download/source/icedtea6-1.10.2.tar.gz

SHA256 sums

• 61c0036df25aa0108dba91ab3dd8334e45dd85f8caa6dadf997b10b63a7d280f icedtea6-1.8.8.tar.gz
• ad63b3c4f87df5bf189b3fd2ef5e82f916b4bb22fb3ff107105a14583b38fbc3 icedtea6-1.9.8.tar.gz
• 488af9a6ddebc38344aabdb62798d403ccc477be1076118788f0b146aa3db5ba icedtea6-1.10.2.tar.gz

The following people helped with these releases:

• Deepak Bhole
• Andrew John Hughes
• Denis Lila
• Xerxes Rånby
• Pavel Tisnovsky
• Mark Wielaard

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea6-<ver>.tar.gz
$ cd icedtea6-<ver>

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

We are pleased to announce a new major release of IcedTea7, 1.14! This will be the final preview release. The next release of IcedTea7 will be based on the first release of OpenJDK7 and we propose to start versioning of such releases from 2.0, allowing the IcedTea6/7 differentation to be dropped if required.

The IcedTea project provides a harness to build the source code from OpenJDK7 using Free Software build tools and against system libraries, together with a number of local extensions such as a PulseAudio sound provider.

What’s New?

• NetX and the plugin moved to the IcedTea-Web project with a separate release cycle.
• Builds using system LCMS by default.
• Added out-of-the-box JamVM support using –enable-jamvm
• Allow building of JamVM beside the default VM by using –with-additional-vms=jamvm
• Allow the location of the JamVM source zip to be specified using –with-jamvm-src-zip
• JamVM builds can bootstrap and are self-hosting.
• Bug fixes
  • PR616, PR99: Don’t statically link libstdc++
  • PR714: Forwardport replace-hotspot support from IcedTea6.
  • PR103: Usage of native2ascii during bootstrap
  • PR543: zero fails to build on icedtea7 trunk 20100907
  • PR715: Port updated macros from IcedTea6 to 7
  • PR732: Use xsltproc for bootstrap xslt in place of Xerces/Xalan
• JamVM
  • Ignore all unknown options.
  • Handle overflow in getPhysicalMemory().
  • Base default min and max heap size on physical memory.
  • Fix reflective array access.
  • Handle O_DELETE in JVM_Open.
  • Minor performance improvement on ARM.
  • First set of changes to support JamVM/OpenJDK on MacOS X.
  • Minor memory leak (missing free).
  • Handle integer overflow on i386/amd64.
  • On ARM, force interpreter to be built in ARM mode.
  • MIPS: 64-bit and interpreter inlining by default.
  • Trivial implementation of stubs for MIPS.
  • PR640: JamVM fails to build – Unrecognised option: -XX:ThreadStackSize.
• CACAO
  • Threadlist & threadobject improvements.
  • Ignore all unknown options, but report them.
  • Fixes build for newer gcc (at least 4.4) on PPC64, breaks older gcc.
  • CA123: LD_LIBRARY_PATH and java.library.path.
  • CA143: don’t hang with invalid locale.
  • CA144: aligned patchers on x86_64.
  • CA148: support for LCMP bytecode.
  • CA152: Calling Policy.setPolicy with a new Policy object has no effect on the DefaultSecurityManager.
  • CA156: uncaughtExceptionHandler doesn’t work with OpenJDK 6 b21.
  • CA157: ARM SMP Assertion thinlock failed.
• Zero/Shark
  • Match Shark in icedtea6, makes OSR work by removing vestigal check.
  • LLVM 2.7 non-product fixes.
  • Correct suffix for the llvm.atomic.cmp.swap intrinsic.

The tarball can be downloaded from:

• http://icedtea.classpath.org/download/source/icedtea-1.14.tar.gz

SHA256 sums:

• 4df2c20d4379468436c60779cba89209ad25f884588f8b638647ad210a6ae9a8

The following people helped with this release:

• Gary Benson
• Deepak Bhole
• Andrew John Hughes
• Matthias Klose
• Denis Lila
• Omair Majid
• Damien Raude-Morvan
• Xerxes Rånby
• Pavel Tisnovsky
• Mark Wielaard

We would also like to thank the bug reporters and testers!

To get started:

$ tar xzf icedtea-1.14.tar.gz
$ cd icedtea-1.14

Full build requirements and instructions are in INSTALL:

$ ./configure [--enable-zero --enable-pulse-java --enable-systemtap ...]
$ make

The unelected governance board has decided we can’t have OpenJDK8 repositories until they finish whatever it is they think they’re doing, and OpenJDK7 development is locked down to critical fixes.

So looks like OpenJDK is effectively closed for business (bar OpenJDK6 backporting) for the foreseeable future. Is this any way to run a supposed FOSS project?