Jump to content
Compatible Support Forums
Sign in to follow this  
Followers 0
news

[RHSA-2016:0050-01] Important: java-1.8.0-openjdk security update

By news, in Upcoming News

Recommended Posts

news    28

news
Posted

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: java-1.8.0-openjdk security update

Advisory ID: RHSA-2016:0050-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0050.html

Issue date: 2016-01-20

CVE Names: CVE-2015-7575 CVE-2016-0402 CVE-2016-0448

CVE-2016-0466 CVE-2016-0475 CVE-2016-0483

CVE-2016-0494

=====================================================================

 

1. Summary:

 

Updated java-1.8.0-openjdk packages that fix multiple security issues are

now available for Red Hat Enterprise Linux 6.

 

Red Hat Product Security has rated this update as having Important security

impact. Common Vulnerability Scoring System (CVSS) base scores, which give

detailed severity ratings, are available for each vulnerability from the

CVE links in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64

 

3. Description:

 

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime

Environment and the OpenJDK 8 Java Software Development Kit.

 

An out-of-bounds write flaw was found in the JPEG image format decoder in

the AWT component in OpenJDK. A specially crafted JPEG image could cause

a Java application to crash or, possibly execute arbitrary code. An

untrusted Java application or applet could use this flaw to bypass Java

sandbox restrictions. (CVE-2016-0483)

 

An integer signedness issue was found in the font parsing code in the 2D

component in OpenJDK. A specially crafted font file could possibly cause

the Java Virtual Machine to execute arbitrary code, allowing an untrusted

Java application or applet to bypass Java sandbox restrictions.

(CVE-2016-0494)

 

It was discovered that the password-based encryption (PBE) implementation

in the Libraries component in OpenJDK used an incorrect key length. This

could, in certain cases, lead to generation of keys that were weaker than

expected. (CVE-2016-0475)

 

It was discovered that the JAXP component in OpenJDK did not properly

enforce the totalEntitySizeLimit limit. An attacker able to make a Java

application process a specially crafted XML file could use this flaw to

make the application consume an excessive amount of memory. (CVE-2016-0466)

 

A flaw was found in the way TLS 1.2 could use the MD5 hash function for

signing ServerKeyExchange and Client Authentication packets during a TLS

handshake. A man-in-the-middle attacker able to force a TLS connection to

use the MD5 hash function could use this flaw to conduct collision attacks

to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)

 

Multiple flaws were discovered in the Networking and JMX components in

OpenJDK. An untrusted Java application or applet could use these flaws to

bypass certain Java sandbox restrictions. (CVE-2016-0402, CVE-2016-0448)

 

Note: This update also disallows the use of the MD5 hash algorithm in the

certification path processing. The use of MD5 can be re-enabled by removing

MD5 from the jdk.certpath.disabledAlgorithms security property defined in

the java.security file.

 

All users of java-1.8.0-openjdk are advised to upgrade to these updated

packages, which resolve these issues. All running instances of OpenJDK Java

must be restarted for the update to take effect.

 

4. Solution:

 

Before applying this update, make sure all previously released errata

relevant to your system have been applied.

 

For details on how to apply this update, refer to:

 

https://access.redhat.com/articles/11258

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1289841 - CVE-2015-7575 TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)

1298906 - CVE-2016-0494 ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)

1298949 - CVE-2016-0475 OpenJDK: PBE incorrect key lengths (Libraries, 8138589)

1298957 - CVE-2016-0402 OpenJDK: URL deserialization inconsistencies (Networking, 8059054)

1299073 - CVE-2016-0448 OpenJDK: logging of RMI connection secrets (JMX, 8130710)

1299385 - CVE-2016-0466 OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)

1299441 - CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017)

 

6. Package List:

 

Red Hat Enterprise Linux Desktop (v. 6):

 

Source:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.src.rpm

 

i386:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.i686.rpm

 

x86_64:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux Desktop Optional (v. 6):

 

i386:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.i686.rpm

 

noarch:

java-1.8.0-openjdk-javadoc-1.8.0.71-1.b15.el6_7.noarch.rpm

java-1.8.0-openjdk-javadoc-debug-1.8.0.71-1.b15.el6_7.noarch.rpm

 

x86_64:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux HPC Node (v. 6):

 

Source:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.src.rpm

 

x86_64:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux HPC Node Optional (v. 6):

 

noarch:

java-1.8.0-openjdk-javadoc-1.8.0.71-1.b15.el6_7.noarch.rpm

java-1.8.0-openjdk-javadoc-debug-1.8.0.71-1.b15.el6_7.noarch.rpm

 

x86_64:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux Server (v. 6):

 

Source:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.src.rpm

 

i386:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.i686.rpm

 

x86_64:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux Server Optional (v. 6):

 

i386:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.i686.rpm

 

noarch:

java-1.8.0-openjdk-javadoc-1.8.0.71-1.b15.el6_7.noarch.rpm

java-1.8.0-openjdk-javadoc-debug-1.8.0.71-1.b15.el6_7.noarch.rpm

 

x86_64:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux Workstation (v. 6):

 

Source:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.src.rpm

 

i386:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.i686.rpm

 

x86_64:

java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

Red Hat Enterprise Linux Workstation Optional (v. 6):

 

i386:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.i686.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.i686.rpm

 

noarch:

java-1.8.0-openjdk-javadoc-1.8.0.71-1.b15.el6_7.noarch.rpm

java-1.8.0-openjdk-javadoc-debug-1.8.0.71-1.b15.el6_7.noarch.rpm

 

x86_64:

java-1.8.0-openjdk-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-debuginfo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-demo-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-devel-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-headless-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-1.8.0.71-1.b15.el6_7.x86_64.rpm

java-1.8.0-openjdk-src-debug-1.8.0.71-1.b15.el6_7.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2015-7575

https://access.redhat.com/security/cve/CVE-2016-0402

https://access.redhat.com/security/cve/CVE-2016-0448

https://access.redhat.com/security/cve/CVE-2016-0466

https://access.redhat.com/security/cve/CVE-2016-0475

https://access.redhat.com/security/cve/CVE-2016-0483

https://access.redhat.com/security/cve/CVE-2016-0494

https://access.redhat.com/security/updates/classification/#important

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2016 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFWn+eDXlSAg2UNWIIRAsl9AKCN/u1kOiyeQF5qRjkU+eKaoGkCmwCcDiGY

vPAfjyRumxPN6+Z7dJlhHBY=

=ZfGy

-----END PGP SIGNATURE-----

 

 

--

 

Share this post

Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  
Followers 0
Go To Topic Listing Upcoming News
×