RHSA-2013:0770: Important: java-1.6.0-openjdk security update

First published: Wed Apr 24 2013(Updated: )

These packages provide the OpenJDK 6 Java Runtime Environment and the<br>OpenJDK 6 Software Development Kit.<br>Multiple flaws were discovered in the font layout engine in the 2D<br>component. An untrusted Java application or applet could possibly use these<br>flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-1569,<br>CVE-2013-2383, CVE-2013-2384)<br>Multiple improper permission check issues were discovered in the Beans,<br>Libraries, JAXP, and RMI components in OpenJDK. An untrusted Java<br>application or applet could use these flaws to bypass Java sandbox<br>restrictions. (CVE-2013-1558, CVE-2013-2422, CVE-2013-1518, CVE-2013-1557)<br>The previous default value of the java.rmi.server.useCodebaseOnly property<br>permitted the RMI implementation to automatically load classes from<br>remotely specified locations. An attacker able to connect to an application<br>using RMI could use this flaw to make the application execute arbitrary<br>code. (CVE-2013-1537)<br>Note: The fix for CVE-2013-1537 changes the default value of the property<br>to true, restricting class loading to the local CLASSPATH and locations<br>specified in the java.rmi.server.codebase property. Refer to Red Hat<br>Bugzilla bug 952387 for additional details.<br>The 2D component did not properly process certain images. An untrusted Java<br>application or applet could possibly use this flaw to trigger Java Virtual<br>Machine memory corruption. (CVE-2013-2420)<br>It was discovered that the Hotspot component did not properly handle<br>certain intrinsic frames, and did not correctly perform MethodHandle<br>lookups. An untrusted Java application or applet could use these flaws to<br>bypass Java sandbox restrictions. (CVE-2013-2431, CVE-2013-2421)<br>It was discovered that JPEGImageReader and JPEGImageWriter in the ImageIO<br>component did not protect against modification of their state while<br>performing certain native code operations. An untrusted Java application or<br>applet could possibly use these flaws to trigger Java Virtual Machine<br>memory corruption. (CVE-2013-2429, CVE-2013-2430)<br>The JDBC driver manager could incorrectly call the toString() method in<br>JDBC drivers, and the ConcurrentHashMap class could incorrectly call the<br>defaultReadObject() method. An untrusted Java application or applet could<br>possibly use these flaws to bypass Java sandbox restrictions.<br>(CVE-2013-1488, CVE-2013-2426)<br>The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly<br>invoke the system class loader. An untrusted Java application or applet<br>could possibly use this flaw to bypass certain Java sandbox restrictions.<br>(CVE-2013-0401)<br>Flaws were discovered in the Network component's InetAddress serialization,<br>and the 2D component's font handling. An untrusted Java application or<br>applet could possibly use these flaws to crash the Java Virtual Machine.<br>(CVE-2013-2417, CVE-2013-2419)<br>The MBeanInstantiator class implementation in the OpenJDK JMX component did<br>not properly check class access before creating new instances. An untrusted<br>Java application or applet could use this flaw to create instances of<br>non-public classes. (CVE-2013-2424)<br>It was discovered that JAX-WS could possibly create temporary files with<br>insecure permissions. A local attacker could use this flaw to access<br>temporary files created by an application using JAX-WS. (CVE-2013-2415)<br>This erratum also upgrades the OpenJDK package to IcedTea6 1.11.10. Refer<br>to the NEWS file, linked to in the References, for further information.<br>All users of java-1.6.0-openjdk are advised to upgrade to these updated<br>packages, which resolve these issues. All running instances of OpenJDK Java<br>must be restarted for the update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2013:0770
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• package-manager/redhat