RHSA-2009:1584: Important: java-1.6.0-openjdk security update

First published: Mon Nov 16 2009(Updated: )

These packages provide the OpenJDK 6 Java Runtime Environment and the<br>OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE)<br>contains the software and tools that users need to run applications written<br>using the Java programming language.<br>An integer overflow flaw and buffer overflow flaws were found in the way<br>the JRE processed image files. An untrusted applet or application could use<br>these flaws to extend its privileges, allowing it to read and write local<br>files, as well as to execute local applications with the privileges of the<br>user running the applet or application. (CVE-2009-3869, CVE-2009-3871,<br>CVE-2009-3873, CVE-2009-3874)<br>An information leak was found in the JRE. An untrusted applet or<br>application could use this flaw to extend its privileges, allowing it to<br>read and write local files, as well as to execute local applications with<br>the privileges of the user running the applet or application. (CVE-2009-3881)<br>It was discovered that the JRE still accepts certificates with MD2 hash<br>signatures, even though MD2 is no longer considered a cryptographically<br>strong algorithm. This could make it easier for an attacker to create a<br>malicious certificate that would be treated as trusted by the JRE. With<br>this update, the JRE disables the use of the MD2 algorithm inside<br>signatures by default. (CVE-2009-2409)<br>A timing attack flaw was found in the way the JRE processed HMAC digests.<br>This flaw could aid an attacker using forged digital signatures to bypass<br>authentication checks. (CVE-2009-3875)<br>Two denial of service flaws were found in the JRE. These could be exploited<br>in server-side application scenarios that process DER-encoded<br>(Distinguished Encoding Rules) data. (CVE-2009-3876, CVE-2009-3877)<br>An information leak was found in the way the JRE handled color profiles. An<br>attacker could use this flaw to discover the existence of files outside of<br>the color profiles directory. (CVE-2009-3728)<br>A flaw in the JRE with passing arrays to the X11GraphicsDevice API was<br>found. An untrusted applet or application could use this flaw to access and<br>modify the list of supported graphics configurations. This flaw could also<br>lead to sensitive information being leaked to unprivileged code.<br>(CVE-2009-3879)<br>It was discovered that the JRE passed entire objects to the logging API.<br>This could lead to sensitive information being leaked to either untrusted<br>or lower-privileged code from an attacker-controlled applet which has<br>access to the logging API and is therefore able to manipulate (read and/or<br>call) the passed objects. (CVE-2009-3880)<br>Potential information leaks were found in various mutable static variables.<br>These could be exploited in application scenarios that execute untrusted<br>scripting code. (CVE-2009-3882, CVE-2009-3883)<br>An information leak was found in the way the TimeZone.getTimeZone method<br>was handled. This method could load time zone files that are outside of the<br>[JRE_HOME]/lib/zi/ directory, allowing a remote attacker to probe the local<br>file system. (CVE-2009-3884)<br>Note: The flaws concerning applets in this advisory, CVE-2009-3869,<br>CVE-2009-3871, CVE-2009-3873, CVE-2009-3874, CVE-2009-3879, CVE-2009-3880,<br>CVE-2009-3881 and CVE-2009-3884, can only be triggered in<br>java-1.6.0-openjdk by calling the "appletviewer" application.<br>All users of java-1.6.0-openjdk are advised to upgrade to these updated<br>packages, which resolve these issues. All running instances of OpenJDK Java<br>must be restarted for the update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:1584
• agent/software-canonical-lookup
• package-manager/redhat