RHSA-2014:0097: Important: java-1.6.0-openjdk security update

First published: Mon Jan 27 2014(Updated: )

These packages provide the OpenJDK 6 Java Runtime Environment and the<br>OpenJDK 6 Java Software Development Kit.<br>An input validation flaw was discovered in the font layout engine in the 2D<br>component. A specially crafted font file could trigger a Java Virtual<br>Machine memory corruption when processed. An untrusted Java application or<br>applet could possibly use this flaw to bypass Java sandbox restrictions.<br>(CVE-2013-5907)<br>Multiple improper permission check issues were discovered in the CORBA and<br>JNDI components in OpenJDK. An untrusted Java application or applet could<br>use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428,<br>CVE-2014-0422)<br>Multiple improper permission check issues were discovered in the<br>Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in<br>OpenJDK. An untrusted Java application or applet could use these flaws to<br>bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878,<br>CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376,<br>CVE-2014-0368)<br>It was discovered that the Beans component did not restrict processing of<br>XML external entities. This flaw could cause a Java application using Beans<br>to leak sensitive information, or affect application availability.<br>(CVE-2014-0423)<br>It was discovered that the JSSE component could leak timing information<br>during the TLS/SSL handshake. This could possibly lead to a disclosure of<br>information about the used encryption keys. (CVE-2014-0411)<br>All users of java-1.6.0-openjdk are advised to upgrade to these updated<br>packages, which resolve these issues. All running instances of OpenJDK Java<br>must be restarted for the update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2014:0097
• agent/title
• agent/weakness
• agent/severity
• agent/references
• agent/tags
• agent/type
• agent/event
• agent/description
• agent/remedy
• agent/last-modified-date
• agent/first-publish-date
• agent/softwarecombine
• package-manager/redhat