Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Pat Riehecky <riehecky-13hema8v3vg <at> public.gmane.org>
Subject: Security ERRATA Critical: java-1.6.0-openjdk on SL6.x i386/x86_64
Newsgroups: gmane.linux.scientific.errata
Date: Friday 8th February 2013 22:12:09 UTC (over 3 years ago)
Synopsis:          Critical: java-1.6.0-openjdk security update
Issue Date:        2013-02-08
CVE Numbers:       CVE-2013-0440
                    CVE-2013-1475
                    CVE-2013-0424
                    CVE-2013-0435
                    CVE-2013-1478
                    CVE-2013-0442
                    CVE-2013-0445
                    CVE-2013-1480
                    CVE-2013-0450
                    CVE-2013-0428
                    CVE-2013-0432
                    CVE-2013-0443
                    CVE-2013-0425
                    CVE-2013-0426
                    CVE-2013-0434
                    CVE-2013-0427
                    CVE-2013-0433
                    CVE-2013-1476
                    CVE-2013-0441
                    CVE-2013-0429
--

Multiple improper permission check issues were discovered in the AWT,
CORBA,
JMX, and Libraries components in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475, CVE-2013-1476,
CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428)

Multiple flaws were found in the way image parsers in the 2D and AWT 
components
handled image raster parameters. A specially-crafted image could cause Java
Virtual Machine memory corruption and, possibly, lead to arbitrary code
execution with the virtual machine privileges. (CVE-2013-1478, 
CVE-2013-1480)

A flaw was found in the AWT component's clipboard handling code. An 
untrusted
Java application or applet could use this flaw to access clipboard data,
bypassing Java sandbox restrictions. (CVE-2013-0432)

The default Java security properties configuration did not restrict 
access to
certain com.sun.xml.internal packages. An untrusted Java application or 
applet
could use this flaw to access information, bypassing certain Java sandbox
restrictions. This update lists the whole package as restricted.
(CVE-2013-0435)

Multiple improper permission check issues were discovered in the Libraries,
Networking, and JAXP components. An untrusted Java application or applet 
could
use these flaws to bypass certain Java sandbox restrictions.
(CVE-2013-0427,
CVE-2013-0433, CVE-2013-0434)

It was discovered that the RMI component's CGIHandler class used user 
inputs in
error messages without any sanitization. An attacker could use this flaw to
perform a cross-site scripting (XSS) attack. (CVE-2013-0424)

It was discovered that the SSL/TLS implementation in the JSSE component 
did not
properly enforce handshake message ordering, allowing an unlimited number
of
handshake restarts. A remote attacker could use this flaw to make an
SSL/TLS
server using JSSE consume an excessive amount of CPU by continuously 
restarting
the handshake. (CVE-2013-0440)

It was discovered that the JSSE component did not properly validate Diffie-
Hellman public keys. An SSL/TLS client could possibly use this flaw to 
perform
a small subgroup attack. (CVE-2013-0443)

Note: If the web browser plug-in provided by the icedtea-web package was
installed, the issues exposed via Java applets could have been exploited
without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.

All running instances of OpenJDK Java must be restarted for the update 
to take
effect.
--

SL6
   x86_64
     java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3.x86_64.rpm
     java-1.6.0-openjdk-debuginfo-1.6.0.0-1.54.1.11.6.el6_3.x86_64.rpm
     java-1.6.0-openjdk-demo-1.6.0.0-1.54.1.11.6.el6_3.x86_64.rpm
     java-1.6.0-openjdk-devel-1.6.0.0-1.54.1.11.6.el6_3.x86_64.rpm
     java-1.6.0-openjdk-javadoc-1.6.0.0-1.54.1.11.6.el6_3.x86_64.rpm
     java-1.6.0-openjdk-src-1.6.0.0-1.54.1.11.6.el6_3.x86_64.rpm
   i386
     java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3.i686.rpm
     java-1.6.0-openjdk-debuginfo-1.6.0.0-1.54.1.11.6.el6_3.i686.rpm
     java-1.6.0-openjdk-demo-1.6.0.0-1.54.1.11.6.el6_3.i686.rpm
     java-1.6.0-openjdk-devel-1.6.0.0-1.54.1.11.6.el6_3.i686.rpm
     java-1.6.0-openjdk-javadoc-1.6.0.0-1.54.1.11.6.el6_3.i686.rpm
     java-1.6.0-openjdk-src-1.6.0.0-1.54.1.11.6.el6_3.i686.rpm

- Scientific Linux Development Team
 
CD: 2ms