Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-6549, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412)

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR8-FP10 release. All running instances of IBM Java must be restarted for the update to take effect.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16-FP3 release. All running instances of IBM Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0136 advisory.

  - ICU: font parsing OOB read (OpenJDK 2D, 8055489) (CVE-2014-6585)

  - ICU: font parsing OOB read (OpenJDK 2D, 8056276) (CVE-2014-6591)

  - OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) (CVE-2014-6593)

  - IBM JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8891)

  - IBM JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8892)

  - OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) (CVE-2015-0395)

  - OpenJDK: directory information leak via file chooser (Swing, 8055304) (CVE-2015-0407)

  - OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) (CVE-2015-0408)

  - OpenJDK: DER decoder infinite loop  (Security, 8059485) (CVE-2015-0410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201603-14 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  This       includes the possibility of remote execution of arbitrary code,       information disclosure, or Denial of Service.  Many of the       vulnerabilities can only be exploited through sandboxed Java Web Start       applications and java applets.  Please reference the CVEs listed for       specific details.
  Impact :

    Remote attackers may remotely execute arbitrary code, compromise       information, or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

ID	Name	Product	Family	Published	Updated	Severity
81202	RHEL 5 : java-1.7.0-ibm (RHSA-2015:0134)	Nessus	Red Hat Local Security Checks	2/6/2015	10/24/2019	critical
81203	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2015:0135)	Nessus	Red Hat Local Security Checks	2/6/2015	2/5/2021	critical
81204	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:0136)	Nessus	Red Hat Local Security Checks	2/6/2015	4/24/2024	critical
89907	GLSA-201603-14 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/14/2016	3/8/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical