RHSA-2014:0406: Critical: java-1.7.0-openjdk security update

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java RuntimeEnvironment and the OpenJDK 7 Java Software Development Kit.An input validation flaw was discovered in the medialib library in the 2Dcomponent. A specially crafted image could trigger Java Virtual Machinememory corruption when processed. A remote attacker, or an untrusted Javaapplication or applet, could possibly use this flaw to execute arbitrarycode with the privileges of the user running the Java Virtual Machine.(CVE-2014-0429)Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK.An untrusted Java application or applet could use these flaws to triggerJava Virtual Machine memory corruption and possibly bypass Java sandboxrestrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421)Multiple improper permission check issues were discovered in the Librariescomponent in OpenJDK. An untrusted Java application or applet could usethese flaws to bypass Java sandbox restrictions. (CVE-2014-0457,CVE-2014-0455, CVE-2014-0461)Multiple improper permission check issues were discovered in the AWT,JAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK.An untrusted Java application or applet could use these flaws to bypasscertain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451,CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402,CVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459)Multiple flaws were identified in the Java Naming and Directory Interface(JNDI) DNS client. These flaws could make it easier for a remote attackerto perform DNS spoofing attacks. (CVE-2014-0460)It was discovered that the JAXP component did not properly prevent accessto arbitrary files when a SecurityManager was present. This flaw couldcause a Java application using JAXP to leak sensitive information, oraffect application availability. (CVE-2014-2403)It was discovered that the Security component in OpenJDK could leak sometiming information when performing PKCS#1 unpadding. This could possiblylead to the disclosure of some information that was meant to be protectedby encryption. (CVE-2014-0453)It was discovered that the fix for CVE-2013-5797 did not properly resolveinput sanitization flaws in javadoc. When javadoc documentation wasgenerated from an untrusted Java source code and hosted on a domain notcontrolled by the code author, these issues could make it easier to performcross-site scripting (XSS) attacks. (CVE-2014-2398)An insecure temporary file use flaw was found in the way the unpack200utility created log files. A local attacker could possibly use this flaw toperform a symbolic link attack and overwrite arbitrary files with theprivileges of the user running unpack200. (CVE-2014-1876)Note: If the web browser plug-in provided by the icedtea-web package wasinstalled, the issues exposed via Java applets could have been exploitedwithout user interaction if a user visited a malicious website.All users of java-1.7.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.