RHSA-2013:0275: Important: java-1.7.0-openjdk security update

Published Feb 20, 2013
·
Updated

These packages provide the OpenJDK 7 Java Runtime Environment and theOpenJDK 7 Software Development Kit.Multiple improper permission check issues were discovered in the JMX andLibraries components in OpenJDK. An untrusted Java application or appletcould use these flaws to bypass Java sandbox restrictions. (CVE-2013-1486,CVE-2013-1484)An improper permission check issue was discovered in the Librariescomponent in OpenJDK. An untrusted Java application or applet could usethis flaw to bypass certain Java sandbox restrictions. (CVE-2013-1485)It was discovered that OpenJDK leaked timing information when decryptingTLS/SSL protocol encrypted records when CBC-mode cipher suites were used.A remote attacker could possibly use this flaw to retrieve plain text fromthe encrypted packets by using a TLS/SSL server as a padding oracle.(CVE-2013-0169)This erratum also upgrades the OpenJDK package to IcedTea7 2.3.7. Refer tothe NEWS file, linked to in the References, for further information.All users of java-1.7.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.

Affected Software

23 affected componentsFixes available
redhat/java<1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-javadoc-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-javadoc-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el6_3
1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el6_3
redhat/java<1.7.0-openjdk-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-javadoc-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-javadoc-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-debuginfo-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-demo-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-devel-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-javadoc-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-javadoc-1.7.0.9-2.3.7.1.el5_9
redhat/java<1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el5_9
1.7.0-openjdk-src-1.7.0.9-2.3.7.1.el5_9

Remediation

Event History

Feb 20, 2013
Advisory Published
12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What vulnerabilities are addressed in RHSA-2013:0275?

RHSA-2013:0275 addresses multiple improper permission check issues in the JMX and Libraries components of OpenJDK.

2

What is the severity level of RHSA-2013:0275?

The severity level of RHSA-2013:0275 is classified as critical due to the potential impact on untrusted Java applications.

3

How do I fix RHSA-2013:0275?

To fix RHSA-2013:0275, update to the recommended package versions such as 1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3 or the equivalent for your distribution.

4

What are the affected components in RHSA-2013:0275?

Affected components in RHSA-2013:0275 include OpenJDK 7 Runtime Environment and OpenJDK 7 Software Development Kit.

5

Is there a need for immediate action with RHSA-2013:0275?

Yes, immediate action is recommended to mitigate the vulnerabilities addressed in RHSA-2013:0275.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203