It was discovered that ICU Layout Engine was missing multiple boundary checks. These could lead to buffer overflows and JVM memory corruption. A specially crafted file could cause an application using ICU to parse untrusted font files to crash and, possibly, execute arbitrary code.
ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
An integer overflow flaw, leading to out-of-bounds read, was found in the LETableReference's verifyLength() method. A specially crafted file could cause an application using ICU to parse untrusted font files to perform an invalid memory access, leading to crash and possibly disclosure of portion of application memory.
ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
It was discovered that the Libraries component of OpenJDK failed to check current context / thread while performing object deserialization, possibly leading to incorrect input deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid.
This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection.
With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check.
It was discovered that the IIOPInputStream class in the CORBA component in OpenJDK failed to properly check object field types. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in the way the Libraries component of OpenJDK verified OCSP (Online Certificate Status Protocol) response. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity. This could allow a Java application to accept a revoked X.509 certificate as valid if it was presented with an OCSP response generated before certificate revocation.
It was discovered that the JCE (Java Cryptography Extension) component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring time used to perform operations using these non-constant time comparisons.
It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not prevent calls to the finalize() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
The patch prevents calls of the finalize() method. It also makes it possible to re-enable support for calling the method via the sun.rmi.server.invocationhandler.allowFinalizeInvocation system property.
It was discovered that the RMIConnectionImpl class in the JMX component of OpenJDK failed to properly check code permissions when creating repository class loaders. An untrusted Java application or applet could use this flaw to read information access to which should be restricted by the Java sandbox, partially bypassing sandbox restrictions.
It was discovered that the JMX component in OpenJDK failed to properly handle MBean connection proxy classes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
It was discovered that the DnsClient client class in the JNDI (Java Naming and Directory Interface) component in OpenJDK failed to properly remove information about an outgoing DNS request from the list of outstanding DNS requests when certain errors occurred during DNS resolution. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and possibly block further DNS resolution (after exhausting all DNS transaction ids).
It was discovered that the Elliptic Curve (EC) cryptography code as used in Mozilla NSS (Network Security Services) library and OpenJDK JCE (Java Cryptography Extension) component failed to properly validate EC parameters as used in ECDHDerive() function, which performs ECDH (Elliptic Curve Diffie-Hellman) key derivation. A remote attacker could use this flaw to disclose sensitive information.
The OpenJDK packages as shipped with Red Hat Enterprise Linux 5, 6 and 7 do not build the affected EC code and are therefore not directly affected. Future versions may provide EC support via NSS, see e.g. bug 1075702.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Note: The patch for this issue will address the vulnerability only if the WLS instance is using JDK 1.7.0191 or later, or JDK 1.8.0181 or later. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Oracle Java SE 7u85 and 8u51 fixes an unspecified vulnerability in the Deployment component (CVE-2015-4729). Upstream has CVSSv2 scored this issue as: 4.0/AV:N/AC:H/Au:N/C:P/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
Oracle Java SE 7u85 and 8u51 fixes an unspecified vulnerability in the Deployment component (CVE-2015-4736). Upstream has CVSSv2 scored this issue as: 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
It was discovered that GCM (Galois Counter Mode), a mode of operation for symmetric key cryptographic block ciphers, implementation in the Security component of OpenJDK failed to properly perform null check. This could cause crash when application performed encryption using a block cipher in GCM mode.
GCM mode is used in several cipher suites defined for TLS 1.2. Affected code was added to OpenJDK version 8, earlier versions 6 and 7 do not contain it and are therefore unaffected.
Oracle Java SE 6u101, 7u85 and 8u51 fixes an unspecified vulnerability in the Deployment component (CVE-2015-2664). Upstream has CVSSv2 scored this issue as: 6.9/AV:L/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.
Oracle Java SE 6u101, 7u85 and 8u51 fixes an unspecified vulnerability in the 2D component (CVE-2015-2637). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
Oracle Java SE 7u85 and 8u51 fixes an unspecified vulnerability in the 2D component (CVE-2015-2619). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
Oracle Java SE 6u101, 7u85 and 8u51 fixes an unspecified vulnerability in the Install component (CVE-2015-2627). Upstream has CVSSv2 scored this issue as: 2.6/AV:N/AC:H/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
Oracle Java SE 6u101, 7u85 and 8u51 fixes an unspecified vulnerability in the 2D component (CVE-2015-2638). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA