CVE:CVE-2015-7940
CNNVD:CNNVD-201511-141
Legion of the Bouncy Castle Java library是澳大利亚Legion of the Bouncy Castle公司的一个用于Java平台的开源的轻量级密码包。
Legion of the Bouncy Castle Java library 1.51之前版本中存在安全漏洞，该漏洞源于程序没有验证椭圆曲线中的点。远程攻击者可借助一系列特制的elliptic curve Diffie Hellman(ECDH)密钥交换利用该漏洞获取私钥。
solution:Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade bouncycastle bouncy_castle_crypto_package to a higher version than 1.50,and avoid the version (,1.50]; Upgrade oracle application_testing_suite to a higher version than 12.5.0.1,12.5.0.2,12.5.0.3,and avoid the version 12.5.0.1,12.5.0.2,12.5.0.3; Upgrade oracle enterprise_manager_ops_center to a higher version than 12.1.4,12.2.2,and avoid the version 12.1.4,12.2.2; Upgrade oracle peoplesoft_enterprise_peopletools to a higher version than 8.54,8.55,and avoid the version 8.54,8.55; Upgrade oracle virtual_desktop_infrastructure to a higher version than 3.5.2,and avoid the version 3.5.2