Skip to navigation

Security Advisory Critical: java-1.6.0-sun security update

Advisory: RHSA-2009:1560-1
Type: Security Advisory
Severity: Critical
Issued on: 2009-11-09
Last updated on: 2009-11-09
Affected Products: RHEL Desktop Supplementary (v. 5 client)
RHEL Supplementary (v. 5 server)
RHEL Supplementary EUS (v. 5.4.z server)
Red Hat Enterprise Linux Extras (v. 4)
Red Hat Enterprise Linux Extras (v. 4.8.z)
CVEs (cve.mitre.org): CVE-2009-2409
CVE-2009-3728
CVE-2009-3729
CVE-2009-3865
CVE-2009-3866
CVE-2009-3867
CVE-2009-3868
CVE-2009-3869
CVE-2009-3871
CVE-2009-3872
CVE-2009-3873
CVE-2009-3874
CVE-2009-3875
CVE-2009-3876
CVE-2009-3877
CVE-2009-3879
CVE-2009-3880
CVE-2009-3881
CVE-2009-3882
CVE-2009-3883
CVE-2009-3884
CVE-2009-3886

Details

Updated java-1.6.0-sun packages that correct several security issues are
now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and
the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime
Environment and the Sun Java 6 Software Development Kit. These
vulnerabilities are summarized on the "Advance notification of Security
Updates for Java SE" page from Sun Microsystems, listed in the References
section. (CVE-2009-2409, CVE-2009-3728, CVE-2009-3729, CVE-2009-3865,
CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871,
CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876,
CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,
CVE-2009-3883, CVE-2009-3884, CVE-2009-3886)

Users of java-1.6.0-sun should upgrade to these updated packages, which
correct these issues. All running instances of Sun Java must be restarted
for the update to take effect.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Desktop Supplementary (v. 5 client)

IA-32:
java-1.6.0-sun-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: f1a30ea516e7b01c47d81d5aafc30731
java-1.6.0-sun-demo-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 0d428ccb4628708f623fdf28c956535d
java-1.6.0-sun-devel-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 0814c6af26196e97e41a968dcb8a9bec
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: faf415bf075124be53ba5ab683c9c1d7
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 9d425ec3d7396f27cad6b242a6cb89ec
java-1.6.0-sun-src-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 005f91c4687fedf2f2829d51ff96e8a9
 
x86_64:
java-1.6.0-sun-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 04674a3b329c21db5fff2fb8bf12032e
java-1.6.0-sun-demo-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 7708e68119b10e5d63e78f074385c9d8
java-1.6.0-sun-devel-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 3806dee0178aef2a108f9987965ca0c6
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 08587694a27ac88bf7e52038a89d634c
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 9d425ec3d7396f27cad6b242a6cb89ec
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 71098a33a0c88ecb63a98de190c680b0
java-1.6.0-sun-src-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 2dd169c75d80d32e8176dab51d5ab03d
 
RHEL Supplementary (v. 5 server)

IA-32:
java-1.6.0-sun-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: f1a30ea516e7b01c47d81d5aafc30731
java-1.6.0-sun-demo-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 0d428ccb4628708f623fdf28c956535d
java-1.6.0-sun-devel-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 0814c6af26196e97e41a968dcb8a9bec
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: faf415bf075124be53ba5ab683c9c1d7
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 9d425ec3d7396f27cad6b242a6cb89ec
java-1.6.0-sun-src-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 005f91c4687fedf2f2829d51ff96e8a9
 
x86_64:
java-1.6.0-sun-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 04674a3b329c21db5fff2fb8bf12032e
java-1.6.0-sun-demo-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 7708e68119b10e5d63e78f074385c9d8
java-1.6.0-sun-devel-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 3806dee0178aef2a108f9987965ca0c6
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 08587694a27ac88bf7e52038a89d634c
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.i586.rpm     MD5: 9d425ec3d7396f27cad6b242a6cb89ec
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 71098a33a0c88ecb63a98de190c680b0
java-1.6.0-sun-src-1.6.0.17-1jpp.2.el5.x86_64.rpm     MD5: 2dd169c75d80d32e8176dab51d5ab03d
 
RHEL Supplementary EUS (v. 5.4.z server)

IA-32:
java-1.6.0-sun-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: f1a30ea516e7b01c47d81d5aafc30731
java-1.6.0-sun-demo-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: 0d428ccb4628708f623fdf28c956535d
java-1.6.0-sun-devel-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: 0814c6af26196e97e41a968dcb8a9bec
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: faf415bf075124be53ba5ab683c9c1d7
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: 9d425ec3d7396f27cad6b242a6cb89ec
java-1.6.0-sun-src-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: 005f91c4687fedf2f2829d51ff96e8a9
 
x86_64:
java-1.6.0-sun-1.6.0.17-1jpp.2.el5.x86_64.rpm
File outdated by:  RHBA-2010:0555
    MD5: 04674a3b329c21db5fff2fb8bf12032e
java-1.6.0-sun-demo-1.6.0.17-1jpp.2.el5.x86_64.rpm
File outdated by:  RHBA-2010:0555
    MD5: 7708e68119b10e5d63e78f074385c9d8
java-1.6.0-sun-devel-1.6.0.17-1jpp.2.el5.x86_64.rpm
File outdated by:  RHBA-2010:0555
    MD5: 3806dee0178aef2a108f9987965ca0c6
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.2.el5.x86_64.rpm
File outdated by:  RHBA-2010:0555
    MD5: 08587694a27ac88bf7e52038a89d634c
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.i586.rpm
File outdated by:  RHBA-2010:0555
    MD5: 9d425ec3d7396f27cad6b242a6cb89ec
java-1.6.0-sun-plugin-1.6.0.17-1jpp.2.el5.x86_64.rpm
File outdated by:  RHBA-2010:0555
    MD5: 71098a33a0c88ecb63a98de190c680b0
java-1.6.0-sun-src-1.6.0.17-1jpp.2.el5.x86_64.rpm
File outdated by:  RHBA-2010:0555
    MD5: 2dd169c75d80d32e8176dab51d5ab03d
 
Red Hat Enterprise Linux Extras (v. 4)

IA-32:
java-1.6.0-sun-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHSA-2012:0139
    MD5: df089d27259f8430175dad2e05e44ddc
java-1.6.0-sun-demo-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHSA-2012:0139
    MD5: 7e121081679fd2f7405074a9cb34162c
java-1.6.0-sun-devel-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHSA-2012:0139
    MD5: fca49e4c1f95a0d3b8e1d90f75570cfb
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHSA-2012:0139
    MD5: 598ca97f3e2c772a5284c5effc62ae55
java-1.6.0-sun-plugin-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHSA-2012:0139
    MD5: d76fc76c470e49cb4acce062652fc73b
java-1.6.0-sun-src-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHSA-2012:0139
    MD5: 5900d4d1266d255cc2e1171988264215
 
x86_64:
java-1.6.0-sun-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHSA-2012:0139
    MD5: 21ed466215d61d59a2b63bc456de33ef
java-1.6.0-sun-demo-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHSA-2012:0139
    MD5: 1fb3765e9d0df7ec6c5a0db3f30e7294
java-1.6.0-sun-devel-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHSA-2012:0139
    MD5: 8521d15e53f0b4a4b07275b97d4354d7
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHSA-2012:0139
    MD5: 0e1b6103300ffa985ad211a7e2e8f0d5
java-1.6.0-sun-plugin-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHSA-2012:0139
    MD5: a80b99e9bb2273e6d7c502c41d94d820
java-1.6.0-sun-src-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHSA-2012:0139
    MD5: 8cd7f0dbf4c4104f7676d19edfd3fea1
 
Red Hat Enterprise Linux Extras (v. 4.8.z)

IA-32:
java-1.6.0-sun-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHBA-2011:0835
    MD5: df089d27259f8430175dad2e05e44ddc
java-1.6.0-sun-demo-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHBA-2011:0835
    MD5: 7e121081679fd2f7405074a9cb34162c
java-1.6.0-sun-devel-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHBA-2011:0835
    MD5: fca49e4c1f95a0d3b8e1d90f75570cfb
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHBA-2011:0835
    MD5: 598ca97f3e2c772a5284c5effc62ae55
java-1.6.0-sun-plugin-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHBA-2011:0835
    MD5: d76fc76c470e49cb4acce062652fc73b
java-1.6.0-sun-src-1.6.0.17-1jpp.1.el4.i586.rpm
File outdated by:  RHBA-2011:0835
    MD5: 5900d4d1266d255cc2e1171988264215
 
x86_64:
java-1.6.0-sun-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0835
    MD5: 21ed466215d61d59a2b63bc456de33ef
java-1.6.0-sun-demo-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0835
    MD5: 1fb3765e9d0df7ec6c5a0db3f30e7294
java-1.6.0-sun-devel-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0835
    MD5: 8521d15e53f0b4a4b07275b97d4354d7
java-1.6.0-sun-jdbc-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0835
    MD5: 0e1b6103300ffa985ad211a7e2e8f0d5
java-1.6.0-sun-plugin-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0835
    MD5: a80b99e9bb2273e6d7c502c41d94d820
java-1.6.0-sun-src-1.6.0.17-1jpp.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0835
    MD5: 8cd7f0dbf4c4104f7676d19edfd3fea1
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

510197 - CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky)
530053 - CVE-2009-3873 OpenJDK JPEG Image Writer quantization problem (6862968)
530057 - CVE-2009-3875 OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)
530061 - CVE-2009-3876 OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877
530062 - CVE-2009-3869 OpenJDK JRE AWT setDifflCM stack overflow (6872357)
530063 - CVE-2009-3871 OpenJDK JRE AWT setBytePixels heap overflow (6872358)
530067 - CVE-2009-3874 OpenJDK ImageI/O JPEG heap overflow (6874643)
530098 - CVE-2009-3728 OpenJDK ICC_Profile file existence detection information leak (6631533)
530173 - CVE-2009-3881 OpenJDK resurrected classloaders can still have children (6636650)
530175 - CVE-2009-3882 CVE-2009-3883 OpenJDK information leaks in mutable variables (6657026,6657138)
530296 - CVE-2009-3880 OpenJDK UI logging information leakage(6664512)
530297 - CVE-2009-3879 OpenJDK GraphicsConfiguration information leak(6822057)
530300 - CVE-2009-3884 OpenJDK zoneinfo file existence information leak (6824265)
532904 - CVE-2009-3729 JRE TrueType font parsing crash (6815780)
532906 - CVE-2009-3872 JRE JPEG JFIF Decoder issue (6862969)
532914 - CVE-2009-3886 JRE REGRESSION:have problem to run JNLP app and applets with signed Jar files (6870531)
533211 - CVE-2009-3865 java-1.6.0-sun: ACE in JRE Deployment Toolkit (6869752)
533212 - CVE-2009-3866 java-1.6.0-sun: Privilege escalation in the Java Web Start Installer (6872824)
533214 - CVE-2009-3867 java-1.5.0-sun, java-1.6.0-sun: Stack-based buffer overflow via a long file: URL argument (6854303)
533215 - CVE-2009-3868 java-1.5.0-sun, java-1.6.0-sun: Privilege escalation via crafted image file due improper color profiles parsing (6862970)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/