RHSA-2014:0026: Critical: java-1.7.0-openjdk security update

These packages provide the OpenJDK 7 Java Runtime Environment and theOpenJDK 7 Software Development Kit.An input validation flaw was discovered in the font layout engine in the 2Dcomponent. A specially crafted font file could trigger Java Virtual Machinememory corruption when processed. An untrusted Java application or appletcould possibly use this flaw to bypass Java sandbox restrictions.(CVE-2013-5907)Multiple improper permission check issues were discovered in the CORBA,JNDI, and Libraries components in OpenJDK. An untrusted Java application orapplet could use these flaws to bypass Java sandbox restrictions.(CVE-2014-0428, CVE-2014-0422, CVE-2013-5893)Multiple improper permission check issues were discovered in theServiceability, Security, CORBA, JAAS, JAXP, and Networking components inOpenJDK. An untrusted Java application or applet could use these flaws tobypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878,CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376,CVE-2014-0368)It was discovered that the Beans component did not restrict processing ofXML external entities. This flaw could cause a Java application using Beansto leak sensitive information, or affect application availability.(CVE-2014-0423)It was discovered that the JSSE component could leak timing informationduring the TLS/SSL handshake. This could possibly lead to disclosure ofinformation about the used encryption keys. (CVE-2014-0411)Note: The java-1.7.0-openjdk package shipped with Red Hat Enterprise Linux6.5 via RHBA-2013:1611 replaced "java7" with "java" in the provides list.This update re-adds "java7" to the provides list to maintain backwardscompatibility with releases prior to Red Hat Enterprise Linux 6.5.Note: If the web browser plug-in provided by the icedtea-web package wasinstalled, the issues exposed via Java applets could have been exploitedwithout user interaction if a user visited a malicious website.All users of java-1.7.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.