User: Password:
|
|
Subscribe / Log in / New account

Scientific Linux alert SL-java-20130417 (java-1.7.0-openjdk)

From:  Pat Riehecky <riehecky@fnal.gov>
To:  <scientific-linux-errata@listserv.fnal.gov>
Subject:  Security ERRATA Critical: java-1.7.0-openjdk on SL6.x i386/x86_64
Date:  Wed, 17 Apr 2013 20:52:07 +0000
Message-ID:  <20130417205207.8628.17593@slpackages.fnal.gov>
Archive-link:  Article, Thread

Synopsis: Critical: java-1.7.0-openjdk security update Advisory ID: SLSA-2013:0751-1 Issue Date: 2013-04-17 CVE Numbers: CVE-2013-0401 CVE-2013-1488 CVE-2013-1537 CVE-2013-2415 CVE-2013-2423 CVE-2013-2424 CVE-2013-2429 CVE-2013-2430 CVE-2013-2436 CVE-2013-2420 CVE-2013-1558 CVE-2013-2422 CVE-2013-2431 CVE-2013-1518 CVE-2013-1557 CVE-2013-2421 CVE-2013-2426 CVE-2013-2419 CVE-2013-2417 CVE-2013-2383 CVE-2013-2384 CVE-2013-1569 -- Multiple flaws were discovered in the font layout engine in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384) Multiple improper permission check issues were discovered in the Beans, Libraries, JAXP, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-1558, CVE-2013-2422, CVE-2013-2436, CVE-2013-1518, CVE-2013-1557) The previous default value of the java.rmi.server.useCodebaseOnly property permitted the RMI implementation to automatically load classes from remotely specified locations. An attacker able to connect to an application using RMI could use this flaw to make the application execute arbitrary code. (CVE-2013-1537) Note: The fix for CVE-2013-1537 changes the default value of the property to true, restricting class loading to the local CLASSPATH and locations specified in the java.rmi.server.codebase property. The 2D component did not properly process certain images. An untrusted Java application or applet could possibly use this flaw to trigger Java Virtual Machine memory corruption. (CVE-2013-2420) It was discovered that the Hotspot component did not properly handle certain intrinsic frames, and did not correctly perform access checks and MethodHandle lookups. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-2431, CVE-2013-2421, CVE-2013-2423) It was discovered that JPEGImageReader and JPEGImageWriter in the ImageIO component did not protect against modification of their state while performing certain native code operations. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-2429, CVE-2013-2430) The JDBC driver manager could incorrectly call the toString() method in JDBC drivers, and the ConcurrentHashMap class could incorrectly call the defaultReadObject() method. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. (CVE-2013-1488, CVE-2013-2426) The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2013-0401) Flaws were discovered in the Network component's InetAddress serialization, and the 2D component's font handling. An untrusted Java application or applet could possibly use these flaws to crash the Java Virtual Machine. (CVE-2013-2417, CVE-2013-2419) The MBeanInstantiator class implementation in the OpenJDK JMX component did not properly check class access before creating new instances. An untrusted Java application or applet could use this flaw to create instances of non-public classes. (CVE-2013-2424) It was discovered that JAX-WS could possibly create temporary files with insecure permissions. A local attacker could use this flaw to access temporary files created by an application using JAX-WS. (CVE-2013-2415) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. This erratum also upgrades the OpenJDK package to IcedTea7 2.3.9. All running instances of OpenJDK Java must be restarted for the update to take effect. -- SL6 x86_64 java-1.7.0-openjdk-1.7.0.19-2.3.9.1.el6_4.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.19-2.3.9.1.el6_4.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.19-2.3.9.1.el6_4.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.19-2.3.9.1.el6_4.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.19-2.3.9.1.el6_4.x86_64.rpm i386 java-1.7.0-openjdk-1.7.0.19-2.3.9.1.el6_4.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.19-2.3.9.1.el6_4.i686.rpm java-1.7.0-openjdk-demo-1.7.0.19-2.3.9.1.el6_4.i686.rpm java-1.7.0-openjdk-devel-1.7.0.19-2.3.9.1.el6_4.i686.rpm java-1.7.0-openjdk-src-1.7.0.19-2.3.9.1.el6_4.i686.rpm noarch java-1.7.0-openjdk-javadoc-1.7.0.19-2.3.9.1.el6_4.noarch.rpm - Scientific Linux Development Team


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds