What is the severity of RHSA-2015:0808?

The severity of RHSA-2015:0808 is classified as important due to an off-by-one flaw leading to a buffer overflow that could affect OpenJDK components.

How do I fix RHSA-2015:0808?

To fix the RHSA-2015:0808 vulnerability, upgrade to the specified remedied version of 1.6.0-openjdk or its associated packages as detailed in the advisory.

Which packages are affected by RHSA-2015:0808?

The affected packages in RHSA-2015:0808 include various versions of java-1.6.0-openjdk and associated components like debuginfo, demo, and devel.

What is the risk associated with RHSA-2015:0808?

The risk associated with RHSA-2015:0808 involves potential exploitation through crafted font files, which could lead to application crashes or remote code execution.

Is there an exploit available for RHSA-2015:0808?

As of the latest information available, there are no public exploits specifically published for the RHSA-2015:0808 vulnerability.

Vulnerability/
RHSA-2015:0808

CWE

119

14/4/2015

RHSA-2015:0808: Important: java-1.6.0-openjdk security update

First published: Tue Apr 14 2015(Updated: )

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469) A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0460) A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488) A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477) A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480) It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478) The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of RHSA-2015:0808?
The severity of RHSA-2015:0808 is classified as important due to an off-by-one flaw leading to a buffer overflow that could affect OpenJDK components.
How do I fix RHSA-2015:0808?
To fix the RHSA-2015:0808 vulnerability, upgrade to the specified remedied version of 1.6.0-openjdk or its associated packages as detailed in the advisory.
Which packages are affected by RHSA-2015:0808?
The affected packages in RHSA-2015:0808 include various versions of java-1.6.0-openjdk and associated components like debuginfo, demo, and devel.
What is the risk associated with RHSA-2015:0808?
The risk associated with RHSA-2015:0808 involves potential exploitation through crafted font files, which could lead to application crashes or remote code execution.
Is there an exploit available for RHSA-2015:0808?
As of the latest information available, there are no public exploits specifically published for the RHSA-2015:0808 vulnerability.

agent/severity
agent/type
agent/first-publish-date
agent/softwarecombine
agent/last-modified-date
agent/title
agent/weakness
agent/remedy
agent/references
agent/description
agent/event
collector/redhat-errata
source/Red Hat
anchor-id/RHSA-2015:0808
agent/software-canonical-lookup
agent/trending
agent/tags
agent/source
package-manager/redhat