RHSA-2013:0274: Important: java-1.6.0-openjdk security update
These packages provide the OpenJDK 6 Java Runtime Environment and theOpenJDK 6 Software Development Kit.An improper permission check issue was discovered in the JMX component inOpenJDK. An untrusted Java application or applet could use this flaw tobypass Java sandbox restrictions. (CVE-2013-1486)It was discovered that OpenJDK leaked timing information when decryptingTLS/SSL protocol encrypted records when CBC-mode cipher suites were used.A remote attacker could possibly use this flaw to retrieve plain text fromthe encrypted packets by using a TLS/SSL server as a padding oracle.(CVE-2013-0169)This erratum also upgrades the OpenJDK package to IcedTea6 1.11.8. Refer tothe NEWS file, linked to in the References, for further information.All users of java-1.6.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2013:0274?
The vulnerability identified by RHSA-2013:0274 is classified as important.
How do I fix RHSA-2013:0274?
To fix RHSA-2013:0274, you should upgrade to the appropriate version of OpenJDK 6 as specified in the advisory.
What software is affected by RHSA-2013:0274?
RHSA-2013:0274 affects multiple packages related to OpenJDK 6 Java Runtime Environment and Software Development Kit on Red Hat.
Can RHSA-2013:0274 be exploited remotely?
Yes, an untrusted Java application or applet could exploit the vulnerability in RHSA-2013:0274 to bypass Java sandbox restrictions.
Is there a workaround for RHSA-2013:0274?
There is no specific workaround for RHSA-2013:0274; the recommended action is to apply the security update.