Red Hat Security Advisory: java-1.6.0-openjdk security update Security Advisory secalert@redhat.com Red Hat Security Response Team RHSA-2013:0245 Final 2 2 2013-02-08T18:50:00Z Current version 2013-02-08T18:50:00Z 2013-02-08T18:50:00Z Red Hat rhsa-to-cvrf 1.0.1484 2013-02-08T19:37:02Z Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428) Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially-crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges. (CVE-2013-1478, CVE-2013-1480) A flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432) The default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted. (CVE-2013-0435) Multiple improper permission check issues were discovered in the Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434) It was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424) It was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2013-0440) It was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack. (CVE-2013-0443) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to the NEWS file, linked to in the References, for further information. All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Please see https://www.redhat.com/footer/terms-of-use.html Copyright © 2013 Red Hat, Inc. All rights reserved. Critical https://rhn.redhat.com/errata/RHSA-2013-0245.html https://rhn.redhat.com/errata/RHSA-2013-0245.html https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/security/updates/classification/#critical http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS Red Hat Enterprise Linux HPC Node Optional (v. 6) Red Hat Enterprise Linux Server (v. 6) Red Hat Enterprise Linux Workstation (v. 6) Red Hat Enterprise Linux Desktop Optional (v. 6) Red Hat Enterprise Linux Workstation Optional (v. 6) Red Hat Enterprise Linux HPC Node (v. 6) Red Hat Enterprise Linux Desktop (v. 6) Red Hat Enterprise Linux Server Optional (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3.src.rpm java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux Server (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux Workstation (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux HPC Node (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux Desktop (v. 6) java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 as a component of Red Hat Enterprise Linux Server Optional (v. 6) It was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0424 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0424.html CVE-2013-0424 https://bugzilla.redhat.com/show_bug.cgi?id=906813 bz#906813: CVE-2013-0424 OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0425 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0425.html CVE-2013-0425 https://bugzilla.redhat.com/show_bug.cgi?id=907344 bz#907344: CVE-2013-0425 OpenJDK: logging insufficient access control checks (Libraries, 6664509) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0426 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0426.html CVE-2013-0426 https://bugzilla.redhat.com/show_bug.cgi?id=907346 bz#907346: CVE-2013-0426 OpenJDK: logging insufficient access control checks (Libraries, 6664528) Multiple improper permission check issues were discovered in the Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0427 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0427.html CVE-2013-0427 https://bugzilla.redhat.com/show_bug.cgi?id=907455 bz#907455: CVE-2013-0427 OpenJDK: invalid threads subject to interrupts (Libraries, 6776941) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0428 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0428.html CVE-2013-0428 https://bugzilla.redhat.com/show_bug.cgi?id=907207 bz#907207: CVE-2013-0428 OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0429 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0429.html CVE-2013-0429 https://bugzilla.redhat.com/show_bug.cgi?id=907460 bz#907460: CVE-2013-0429 OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694) A flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0432 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0432.html CVE-2013-0432 https://bugzilla.redhat.com/show_bug.cgi?id=907219 bz#907219: CVE-2013-0432 OpenJDK: insufficient clipboard access premission checks (AWT, 7186952) Multiple improper permission check issues were discovered in the Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0433 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0433.html CVE-2013-0433 https://bugzilla.redhat.com/show_bug.cgi?id=907456 bz#907456: CVE-2013-0433 OpenJDK: InetSocketAddress serialization issue (Networking, 7201071) Multiple improper permission check issues were discovered in the Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0434 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0434.html CVE-2013-0434 https://bugzilla.redhat.com/show_bug.cgi?id=907453 bz#907453: CVE-2013-0434 OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235) The default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0435 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0435.html CVE-2013-0435 https://bugzilla.redhat.com/show_bug.cgi?id=906892 bz#906892: CVE-2013-0435 OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068) It was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake. 2012-07-25T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0440 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0440.html CVE-2013-0440 https://bugzilla.redhat.com/show_bug.cgi?id=859140 bz#859140: CVE-2013-0440 OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0441 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0441.html CVE-2013-0441 https://bugzilla.redhat.com/show_bug.cgi?id=907458 bz#907458: CVE-2013-0441 OpenJDK: missing serialization restriction (CORBA, 7201066) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0442 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0442.html CVE-2013-0442 https://bugzilla.redhat.com/show_bug.cgi?id=906899 bz#906899: CVE-2013-0442 OpenJDK: insufficient privilege checking issue (AWT, 7192977) It was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0443 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Moderate 4.0 AV:N/AC:H/Au:N/C:P/I:P/A:N Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0443.html CVE-2013-0443 https://bugzilla.redhat.com/show_bug.cgi?id=907340 bz#907340: CVE-2013-0443 OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0445 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0445.html CVE-2013-0445 https://bugzilla.redhat.com/show_bug.cgi?id=906900 bz#906900: CVE-2013-0445 OpenJDK: insufficient privilege checking issue (AWT, 8001057) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-0450 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-0450.html CVE-2013-0450 https://bugzilla.redhat.com/show_bug.cgi?id=906911 bz#906911: CVE-2013-0450 OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2012-09-26T00:00:00Z 2012-09-25T00:00:00Z CVE-2013-1475 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-1475.html CVE-2013-1475 https://bugzilla.redhat.com/show_bug.cgi?id=860652 bz#860652: CVE-2013-1475 OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50) Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-1476 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-1476.html CVE-2013-1476 https://bugzilla.redhat.com/show_bug.cgi?id=907457 bz#907457: CVE-2013-1476 OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631) Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially-crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-1478 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-1478.html CVE-2013-1478 https://bugzilla.redhat.com/show_bug.cgi?id=906894 bz#906894: CVE-2013-1478 OpenJDK: image parser insufficient raster parameter checks (2D, 8001972) Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially-crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges. 2013-02-01T00:00:00Z 2013-02-01T00:00:00Z CVE-2013-1480 6Client-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Client-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6ComputeNode-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Server-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 6Workstation-optional-6.3.z:java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3 Critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0245.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html https://www.redhat.com/security/data/cve/CVE-2013-1480.html CVE-2013-1480 https://bugzilla.redhat.com/show_bug.cgi?id=906904 bz#906904: CVE-2013-1480 OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)