Synopsis: Important: java-1.6.0-openjdk security update
Advisory ID: SLSA-2014:0685-1
Issue Date: 2014-06-10
CVE Numbers: CVE-2014-1876
CVE-2014-2398
CVE-2014-0453
CVE-2014-0429
CVE-2014-0457
CVE-2014-0456
CVE-2014-2421
CVE-2014-2397
CVE-2014-0461
CVE-2014-2412
CVE-2014-0451
CVE-2014-0458
CVE-2014-2414
CVE-2014-2423
CVE-2014-0452
CVE-2014-0446
CVE-2014-2427
CVE-2014-0460
CVE-2014-2403
—
An input validation flaw was discovered in the medialib library in the 2D
component. A specially crafted image could trigger Java Virtual Machine
memory corruption when processed. A remote attacker, or an untrusted Java
application or applet, could possibly use this flaw to execute arbitrary
code with the privileges of the user running the Java Virtual Machine.
(CVE-2014-0429)
Multiple flaws were discovered in the Hotspot and 2D components in
OpenJDK. An untrusted Java application or applet could use these flaws to
trigger Java Virtual Machine memory corruption and possibly bypass Java
sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421)
Multiple improper permission check issues were discovered in the Libraries
component in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass Java sandbox restrictions. (CVE-2014-0457,
CVE-2014-0461)
Multiple improper permission check issues were discovered in the AWT, JAX-
WS, JAXB, Libraries, and Sound components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java sandbox
restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423,
CVE-2014-0452, CVE-2014-2414, CVE-2014-0446, CVE-2014-2427)
Multiple flaws were identified in the Java Naming and Directory Interface
(JNDI) DNS client. These flaws could make it easier for a remote attacker
to perform DNS spoofing attacks. (CVE-2014-0460)
It was discovered that the JAXP component did not properly prevent access
to arbitrary files when a SecurityManager was present. This flaw could
cause a Java application using JAXP to leak sensitive information, or
affect application availability. (CVE-2014-2403)
It was discovered that the Security component in OpenJDK could leak some
timing information when performing PKCS#1 unpadding. This could possibly
lead to the disclosure of some information that was meant to be protected
by encryption. (CVE-2014-0453)
It was discovered that the fix for CVE-2013-5797 did not properly resolve
input sanitization flaws in javadoc. When javadoc documentation was
generated from an untrusted Java source code and hosted on a domain not
controlled by the code author, these issues could make it easier to
perform cross-site scripting (XSS) attacks. (CVE-2014-2398)
An insecure temporary file use flaw was found in the way the unpack200
utility created log files. A local attacker could possibly use this flaw
to perform a symbolic link attack and overwrite arbitrary files with the
privileges of the user running unpack200. (CVE-2014-1876)
All running instances of OpenJDK Java must be restarted for the update to
take effect.
—
SL7
x86_64
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
– Scientific Linux Development Team
