RHSA-2016:0049: Critical: java-1.8.0-openjdk security update

First published: Wed Jan 20 2016(Updated: )

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime<br>Environment and the OpenJDK 8 Java Software Development Kit.<br>An out-of-bounds write flaw was found in the JPEG image format decoder in<br>the AWT component in OpenJDK. A specially crafted JPEG image could cause<br>a Java application to crash or, possibly execute arbitrary code. An<br>untrusted Java application or applet could use this flaw to bypass Java<br>sandbox restrictions. (CVE-2016-0483)<br>An integer signedness issue was found in the font parsing code in the 2D<br>component in OpenJDK. A specially crafted font file could possibly cause<br>the Java Virtual Machine to execute arbitrary code, allowing an untrusted<br>Java application or applet to bypass Java sandbox restrictions.<br>(CVE-2016-0494)<br>It was discovered that the password-based encryption (PBE) implementation<br>in the Libraries component in OpenJDK used an incorrect key length. This<br>could, in certain cases, lead to generation of keys that were weaker than<br>expected. (CVE-2016-0475)<br>It was discovered that the JAXP component in OpenJDK did not properly<br>enforce the totalEntitySizeLimit limit. An attacker able to make a Java<br>application process a specially crafted XML file could use this flaw to<br>make the application consume an excessive amount of memory. (CVE-2016-0466)<br>A flaw was found in the way TLS 1.2 could use the MD5 hash function for<br>signing ServerKeyExchange and Client Authentication packets during a TLS<br>handshake. A man-in-the-middle attacker able to force a TLS connection to<br>use the MD5 hash function could use this flaw to conduct collision attacks<br>to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)<br>Multiple flaws were discovered in the Networking and JMX components in<br>OpenJDK. An untrusted Java application or applet could use these flaws to<br>bypass certain Java sandbox restrictions. (CVE-2016-0402, CVE-2016-0448)<br>Note: If the web browser plug-in provided by the icedtea-web package was<br>installed, the issues exposed via Java applets could have been exploited<br>without user interaction if a user visited a malicious website.<br>Note: This update also disallows the use of the MD5 hash algorithm in the<br>certification path processing. The use of MD5 can be re-enabled by removing<br>MD5 from the jdk.certpath.disabledAlgorithms security property defined in<br>the java.security file.<br>All users of java-1.8.0-openjdk are advised to upgrade to these updated<br>packages, which resolve these issues. All running instances of OpenJDK Java<br>must be restarted for the update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2016:0049
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• package-manager/redhat