What is the severity of RHSA-2016:0054?

The severity of RHSA-2016:0054 is considered critical due to the potential for remote code execution.

How do I fix RHSA-2016:0054?

To fix RHSA-2016:0054, upgrade to the version 1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2 or higher.

What vulnerable packages are affected by RHSA-2016:0054?

RHSA-2016:0054 affects various OpenJDK packages including java-1.7.0-openjdk, java-1.7.0-openjdk-headless, and others.

Are earlier versions of the OpenJDK safe from the vulnerabilities described in RHSA-2016:0054?

No, earlier versions of OpenJDK prior to the fixed versions are vulnerable and should be upgraded immediately.

Is there a workaround for RHSA-2016:0054 if I cannot upgrade immediately?

The recommended mitigation is to avoid processing untrusted JPEG images until an upgrade can be performed.

Vulnerability/
RHSA-2016:0054

21/1/2016

RHSA-2016:0054: Important: java-1.7.0-openjdk security update

First published: Thu Jan 21 2016(Updated: )

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483) An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494) It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory. (CVE-2016-0466) A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575) Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4871, CVE-2016-0402, CVE-2016-0448) Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of RHSA-2016:0054?
The severity of RHSA-2016:0054 is considered critical due to the potential for remote code execution.
How do I fix RHSA-2016:0054?
To fix RHSA-2016:0054, upgrade to the version 1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2 or higher.
What vulnerable packages are affected by RHSA-2016:0054?
RHSA-2016:0054 affects various OpenJDK packages including java-1.7.0-openjdk, java-1.7.0-openjdk-headless, and others.
Are earlier versions of the OpenJDK safe from the vulnerabilities described in RHSA-2016:0054?
No, earlier versions of OpenJDK prior to the fixed versions are vulnerable and should be upgraded immediately.
Is there a workaround for RHSA-2016:0054 if I cannot upgrade immediately?
The recommended mitigation is to avoid processing untrusted JPEG images until an upgrade can be performed.

collector/redhat-errata
anchor-id/RHSA-2016:0054
agent/description
agent/event
agent/first-publish-date
agent/last-modified-date
agent/references
agent/remedy
agent/severity
agent/softwarecombine
agent/tags
agent/title
agent/type
package-manager/redhat