- Vulnerability/
- RHSA-2016:0675
RHSA-2016:0675: Critical: java-1.7.0-openjdk security update
First published: Thu Apr 21 2016(Updated: )
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.<br>Security Fix(es):<br><li> Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-0686, CVE-2016-0687)</li> <li> It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427)</li> <li> It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425)</li> <li> It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695)</li> Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.7.0-openjdk-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-debuginfo-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-debuginfo-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-demo-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-demo-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-devel-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-devel-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-javadoc-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-javadoc-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-src-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-src-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-debuginfo-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-debuginfo-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-demo-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-demo-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-devel-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-devel-1.7.0.101-2.6.6.1.el6_7 |
| redhat/java | <1.7.0-openjdk-src-1.7.0.101-2.6.6.1.el6_7 | 1.7.0-openjdk-src-1.7.0.101-2.6.6.1.el6_7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1327743
- https://bugzilla.redhat.com/show_bug.cgi?id=1327749
- https://bugzilla.redhat.com/show_bug.cgi?id=1328022
- https://bugzilla.redhat.com/show_bug.cgi?id=1328040
- https://bugzilla.redhat.com/show_bug.cgi?id=1328210
- http://www.redhat.com/security/updates/classification/#normal
- https://access.redhat.com/errata/RHSA-2016:0675 (Advisory)
- collector/redhat-errata
- anchor-id/RHSA-2016:0675
- agent/severity
- agent/references
- agent/title
- agent/type
- agent/event
- agent/description
- agent/tags
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- package-manager/redhat