CVE-2015-3149: Medium severity red hat enterprise linux desktop vulnerability
It was discovered that the java-1.8.0-openjdk packages for Red Hat Enterprise Linux released via RHSA-2015:0809 (https://rhn.redhat.com/errata/RHSA-2015-0809.html) regressed the fix for the CVE-2015-0383 (bug 1123870) issue - "OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807)". This regression makes it possible to exploit the original issue and allow local attacker to make other users of OpenJDK 8 packages to overwrite arbitrary file via a symlink attack. Refer to bug 1123870 for technical details.
Other sources
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3149?
CVE-2015-3149 is categorized as having moderate severity.
How do I fix CVE-2015-3149?
To resolve CVE-2015-3149, users should update their java-1.8.0-openjdk packages to the latest version provided by Red Hat.
Which systems are affected by CVE-2015-3149?
CVE-2015-3149 affects Red Hat Enterprise Linux versions 6.0, 7.0, 7.1, and related products.
What does CVE-2015-3149 vulnerability entail?
CVE-2015-3149 involves a regression in a previous security fix for java-1.8.0-openjdk that can lead to security issues.
Is there a workaround for CVE-2015-3149?
There are no reliable workarounds for CVE-2015-3149; upgrading the package is the recommended approach.