java: two vulnerabilities
| Package(s): | java-1.8.0-openjdk | CVE #(s): | CVE-2015-2659 CVE-2015-3149 | ||||||||||||||||||||||||||||||||
| Created: | July 15, 2015 | Updated: | July 21, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was discovered that the GCM (Galois Counter Mode) implementation in the Security component of OpenJDK failed to properly perform a null check. This could cause the Java Virtual Machine to crash when an application performed encryption using a block cipher in the GCM mode. (CVE-2015-2659) Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. Note: This issue was originally fixed as CVE-2015-0383, but the fix was regressed in the RHSA-2015:0809 advisory. (CVE-2015-3149) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||