CentOS 5, RHEL 5.6, and security updates

I'm the maintainer of IcedTea6 which is used to create the java-1.6.0-openjdk packages for Fedora and RHEL. One of the OpenJDK updates will be the floating point bug fix which has beem publicised recently. Unpatched, certain floating point numbers will hang the VM (and hence javac as it is written in Java) and this could be triggered by user input. Both packages correspond to IcedTea6 1.7.x releases which were made for these updates and do not require 5.6 to my knowledge. I would get these updates ASAP and leave 6 for now.