Skip to navigation

Security Advisory Important: java-1.6.0-openjdk security update

Advisory: RHSA-2012:0730-1
Type: Security Advisory
Severity: Important
Issued on: 2012-06-13
Last updated on: 2012-06-13
Affected Products: Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2012-1711
CVE-2012-1713
CVE-2012-1716
CVE-2012-1717
CVE-2012-1718
CVE-2012-1719
CVE-2012-1723
CVE-2012-1724
CVE-2012-1725

Details

Updated java-1.6.0-openjdk packages that fix several security issues are
now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.

Multiple flaws were discovered in the CORBA (Common Object Request Broker
Architecture) implementation in Java. A malicious Java application or
applet could use these flaws to bypass Java sandbox restrictions or modify
immutable object data. (CVE-2012-1711, CVE-2012-1719)

It was discovered that the SynthLookAndFeel class from Swing did not
properly prevent access to certain UI elements from outside the current
application context. A malicious Java application or applet could use this
flaw to crash the Java Virtual Machine, or bypass Java sandbox
restrictions. (CVE-2012-1716)

Multiple flaws were discovered in the font manager's layout lookup
implementation. A specially-crafted font file could cause the Java Virtual
Machine to crash or, possibly, execute arbitrary code with the privileges
of the user running the virtual machine. (CVE-2012-1713)

Multiple flaws were found in the way the Java HotSpot Virtual Machine
verified the bytecode of the class file to be executed. A specially-crafted
Java application or applet could use these flaws to crash the Java Virtual
Machine, or bypass Java sandbox restrictions. (CVE-2012-1723,
CVE-2012-1725)

It was discovered that the Java XML parser did not properly handle certain
XML documents. An attacker able to make a Java application parse a
specially-crafted XML file could use this flaw to make the XML parser enter
an infinite loop. (CVE-2012-1724)

It was discovered that the Java security classes did not properly handle
Certificate Revocation Lists (CRL). CRL containing entries with duplicate
certificate serial numbers could have been ignored. (CVE-2012-1718)

It was discovered that various classes of the Java Runtime library could
create temporary files with insecure permissions. A local attacker could
use this flaw to gain access to the content of such temporary files.
(CVE-2012-1717)

This erratum also upgrades the OpenJDK package to IcedTea6 1.10.8. Refer to
the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux (v. 5 server)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.27.1.10.8.el5_8.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1d6889561cb4647ba2f0f86d920e4702
SHA-256: 17f13bbf01a8e3950112ec2c13c0dc9e3b78db1c6bb32fd2012c7c3ed18f4c5b
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 7f8efa3990ac9466490ea04cc8dd07ef
SHA-256: 8efaeebbe52dcdd4cb85192dc71af444ebbf38703e18024035f005fe08b429ca
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 10c82af8c8d1c69927c8c9187f15fa39
SHA-256: b90de1b16a101e4c387d5452dfefc84ac2be68f7f320e11c516a24e3c2b32d38
java-1.6.0-openjdk-demo-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 3a9893cca20af71f4c005b9e76ef4d24
SHA-256: 9759a4f8706b601d596a09954d0bd3f3ec814ad8118bb5249538aa654870834f
java-1.6.0-openjdk-devel-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 61882b9655fb036666280f84a72c7ab6
SHA-256: f592644320af2e06533ac8bf8bf153e58b756741f40585b19ce359440226491a
java-1.6.0-openjdk-javadoc-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2e553578b5b8f2df68d216df43e310ec
SHA-256: e7cae0f73a133511023a9e9a117810617c721e19383217a1778b24546610932a
java-1.6.0-openjdk-src-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 89ea2061c9508e009e00faa4dabab5c5
SHA-256: 172682a4749cff194b898ba2fbf6aece62a731de971092fac457cb933e0d7a2a
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: de36c61a04ef2bae24db408ad70133ce
SHA-256: 5e5f83f4580eccbd422136bfb3c8c776855b095f82819ee4a506ae6bf6ec809d
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 002a8fba259fa74a87051eba9e0fcbce
SHA-256: 4241702519af1958b761ec66ce83e106771ee1d91345d9943aaf890cd4e9c365
java-1.6.0-openjdk-demo-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: ed89da846593487f607a8c7ec33f11d0
SHA-256: 3bb8cfff3a7e0d79a31e816f5a0178d575b6974ca6de87a835ff87533e99635b
java-1.6.0-openjdk-devel-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: e5267b083a38eb0766e144b9f99bd7b6
SHA-256: 82000e765e041ca656fdb0d4be7ce2f2f512f0d06db0e516e0db0ef644906c8e
java-1.6.0-openjdk-javadoc-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1e674583d90f3cfb8865b5d9417d1318
SHA-256: f8562437dbfef2baedd2505682133c9eb767401dba6eff685e6d9ca42f961854
java-1.6.0-openjdk-src-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 37de42d9650353d97893dace9cd7f51e
SHA-256: b636afe134b982931fe9ee915fe95048d2f765edd49854ee29a190dd0376446b
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.27.1.10.8.el5_8.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1d6889561cb4647ba2f0f86d920e4702
SHA-256: 17f13bbf01a8e3950112ec2c13c0dc9e3b78db1c6bb32fd2012c7c3ed18f4c5b
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 7f8efa3990ac9466490ea04cc8dd07ef
SHA-256: 8efaeebbe52dcdd4cb85192dc71af444ebbf38703e18024035f005fe08b429ca
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 10c82af8c8d1c69927c8c9187f15fa39
SHA-256: b90de1b16a101e4c387d5452dfefc84ac2be68f7f320e11c516a24e3c2b32d38
java-1.6.0-openjdk-demo-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 3a9893cca20af71f4c005b9e76ef4d24
SHA-256: 9759a4f8706b601d596a09954d0bd3f3ec814ad8118bb5249538aa654870834f
java-1.6.0-openjdk-devel-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 61882b9655fb036666280f84a72c7ab6
SHA-256: f592644320af2e06533ac8bf8bf153e58b756741f40585b19ce359440226491a
java-1.6.0-openjdk-javadoc-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2e553578b5b8f2df68d216df43e310ec
SHA-256: e7cae0f73a133511023a9e9a117810617c721e19383217a1778b24546610932a
java-1.6.0-openjdk-src-1.6.0.0-1.27.1.10.8.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 89ea2061c9508e009e00faa4dabab5c5
SHA-256: 172682a4749cff194b898ba2fbf6aece62a731de971092fac457cb933e0d7a2a
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: de36c61a04ef2bae24db408ad70133ce
SHA-256: 5e5f83f4580eccbd422136bfb3c8c776855b095f82819ee4a506ae6bf6ec809d
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 002a8fba259fa74a87051eba9e0fcbce
SHA-256: 4241702519af1958b761ec66ce83e106771ee1d91345d9943aaf890cd4e9c365
java-1.6.0-openjdk-demo-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: ed89da846593487f607a8c7ec33f11d0
SHA-256: 3bb8cfff3a7e0d79a31e816f5a0178d575b6974ca6de87a835ff87533e99635b
java-1.6.0-openjdk-devel-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: e5267b083a38eb0766e144b9f99bd7b6
SHA-256: 82000e765e041ca656fdb0d4be7ce2f2f512f0d06db0e516e0db0ef644906c8e
java-1.6.0-openjdk-javadoc-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1e674583d90f3cfb8865b5d9417d1318
SHA-256: f8562437dbfef2baedd2505682133c9eb767401dba6eff685e6d9ca42f961854
java-1.6.0-openjdk-src-1.6.0.0-1.27.1.10.8.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 37de42d9650353d97893dace9cd7f51e
SHA-256: b636afe134b982931fe9ee915fe95048d2f765edd49854ee29a190dd0376446b
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

829354 - CVE-2012-1711 OpenJDK: improper protection of CORBA data models (CORBA, 7079902)
829358 - CVE-2012-1717 OpenJDK: insecure temporary file permissions (JRE, 7143606)
829360 - CVE-2012-1716 OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614)
829361 - CVE-2012-1713 OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617)
829371 - CVE-2012-1719 OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851)
829372 - CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872)
829373 - CVE-2012-1723 OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)
829374 - CVE-2012-1724 OpenJDK: XML parsing infinite loop (JAXP, 7157609)
829376 - CVE-2012-1725 OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/