Important: java-1.6.0-openjdk security update
| Advisory: | RHSA-2012:1222-1 |
|---|---|
| Type: | Security Advisory |
| Severity: | Important |
| Issued on: | 2012-09-03 |
| Last updated on: | 2012-09-03 |
| Affected Products: | Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux Desktop (v. 5 client) |
| CVEs (cve.mitre.org): |
CVE-2012-0547 CVE-2012-1682 |
Details
Updated java-1.6.0-openjdk packages that fix two security issues are now
available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.
It was discovered that the Beans component in OpenJDK did not perform
permission checks properly. An untrusted Java application or applet could
use this flaw to use classes from restricted packages, allowing it to
bypass Java sandbox restrictions. (CVE-2012-1682)
A hardening fix was applied to the AWT component in OpenJDK, removing
functionality from the restricted SunToolkit class that was used in
combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)
This erratum also upgrades the OpenJDK package to IcedTea6 1.10.9. Refer to
the NEWS file, linked to in the References, for further information.
All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.
Solution
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Updated packages
| Red Hat Enterprise Linux (v. 5 server) | |
| SRPMS: | |
| java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.src.rpm File outdated by: RHSA-2013:0770 |
MD5: 49b6a0ad2ad7db7150527165a40b7672 SHA-256: 103534fc2e8b76693de10ebda949a2e3b0907747751d9f52b8ba02f7fabeefd2 |
| IA-32: | |
| java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: dce6e33d1202a97a2f66fa651995fa10 SHA-256: 535ec6d332dde94dff1acf0cb42b36309d314eeaa7010bc2b63739f439af0b11 |
| java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 3b2ee925a21eb808ea2479492d8c2345 SHA-256: 98b25f9ea90d6cd6b0c070a23f352ef457cf15052b295f7a6c28236043124fbd |
| java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 364186399aa8e3b3934f990b132b561f SHA-256: df8e8de95a8ff09df973cb1046a50c04adf9d825630c5e94f4180b47d1027d3e |
| java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 144dcb1b06ab294ae91fb50c8737608c SHA-256: 4dcd3948c4b8d50a736f1c2c9065d5e40c91ad6e2eabf2b02033cd052929239c |
| java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 654117ab93b6664667297841cc820165 SHA-256: 7a6dd3440c1acb35c06253213cc18668a622b6573befa3cd4d47f8e3c3e3bdad |
| java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: acbf0190b6a585dc2f3fd16fdf4257e6 SHA-256: f7ab27abd766c2c3fc5dd6e3f456b67ee4a13c77a668f00dab5b3aee18b02d65 |
| x86_64: | |
| java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 8b4c82e82b9da211a3ae25a0124e5f66 SHA-256: 6afd30f38701bd3d7abf18673c2da25df5c0a9d0ccee1be044b140a600d3d29a |
| java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 15eeeaaad67d01602538474c5d48c7f7 SHA-256: b0ebfef34a25634b05bc1d989bdd34d75ccbb0a0db93f45d8bacb7abbc4bf11d |
| java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: a8dd8cd868f0fc2eb13e95906df3ee8b SHA-256: 140e1c51b93594e05c03db110571fd4c629c8a81e302d2ce6d35fd94f26cdf37 |
| java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 7563b26039096f9c0a40fa8bc19f54f3 SHA-256: 2fba0f0d025bd8966df71a0e697c698fd0345f59ecab844a6037c1a3ccda3eeb |
| java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 3f26a6de1632e369448eccdeac06dcb5 SHA-256: b7fb01924dc1a58cd8d0b72188166b4cd5ed3399f73d6b57850ce375a20d11d4 |
| java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 32b705d80aa3c1143d56d47f7d68a1a8 SHA-256: 1555a33c8df0bcef516b4965f39fc48814b091e78b4f19972ea134729638f1e8 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | |
| SRPMS: | |
| java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.src.rpm File outdated by: RHSA-2013:0770 |
MD5: 49b6a0ad2ad7db7150527165a40b7672 SHA-256: 103534fc2e8b76693de10ebda949a2e3b0907747751d9f52b8ba02f7fabeefd2 |
| IA-32: | |
| java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: dce6e33d1202a97a2f66fa651995fa10 SHA-256: 535ec6d332dde94dff1acf0cb42b36309d314eeaa7010bc2b63739f439af0b11 |
| java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 3b2ee925a21eb808ea2479492d8c2345 SHA-256: 98b25f9ea90d6cd6b0c070a23f352ef457cf15052b295f7a6c28236043124fbd |
| java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 364186399aa8e3b3934f990b132b561f SHA-256: df8e8de95a8ff09df973cb1046a50c04adf9d825630c5e94f4180b47d1027d3e |
| java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 144dcb1b06ab294ae91fb50c8737608c SHA-256: 4dcd3948c4b8d50a736f1c2c9065d5e40c91ad6e2eabf2b02033cd052929239c |
| java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: 654117ab93b6664667297841cc820165 SHA-256: 7a6dd3440c1acb35c06253213cc18668a622b6573befa3cd4d47f8e3c3e3bdad |
| java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm File outdated by: RHSA-2013:0770 |
MD5: acbf0190b6a585dc2f3fd16fdf4257e6 SHA-256: f7ab27abd766c2c3fc5dd6e3f456b67ee4a13c77a668f00dab5b3aee18b02d65 |
| x86_64: | |
| java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 8b4c82e82b9da211a3ae25a0124e5f66 SHA-256: 6afd30f38701bd3d7abf18673c2da25df5c0a9d0ccee1be044b140a600d3d29a |
| java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 15eeeaaad67d01602538474c5d48c7f7 SHA-256: b0ebfef34a25634b05bc1d989bdd34d75ccbb0a0db93f45d8bacb7abbc4bf11d |
| java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: a8dd8cd868f0fc2eb13e95906df3ee8b SHA-256: 140e1c51b93594e05c03db110571fd4c629c8a81e302d2ce6d35fd94f26cdf37 |
| java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 7563b26039096f9c0a40fa8bc19f54f3 SHA-256: 2fba0f0d025bd8966df71a0e697c698fd0345f59ecab844a6037c1a3ccda3eeb |
| java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 3f26a6de1632e369448eccdeac06dcb5 SHA-256: b7fb01924dc1a58cd8d0b72188166b4cd5ed3399f73d6b57850ce375a20d11d4 |
| java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm File outdated by: RHSA-2013:0770 |
MD5: 32b705d80aa3c1143d56d47f7d68a1a8 SHA-256: 1555a33c8df0bcef516b4965f39fc48814b091e78b4f19972ea134729638f1e8 |
| (The unlinked packages above are only available from the Red Hat Network) | |
Bugs fixed (see bugzilla for more information)
846709 - Kerberos auth failing to work in openjdk due to two upstream bugs
853097 - CVE-2012-1682 OpenJDK: beans ClassFinder insufficient permission checks (beans, 7162476)
853228 - CVE-2012-0547 OpenJDK: AWT hardening fixes (AWT, 7163201)
References
https://www.redhat.com/security/data/cve/CVE-2012-0547.html
https://www.redhat.com/security/data/cve/CVE-2012-1682.html
https://access.redhat.com/security/updates/classification/#important
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
http://icedtea.classpath.org/hg/release/icedtea6-1.10/file/icedtea6-1.10.9/NEWS
https://www.redhat.com/security/data/cve/CVE-2012-1682.html
https://access.redhat.com/security/updates/classification/#important
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
http://icedtea.classpath.org/hg/release/icedtea6-1.10/file/icedtea6-1.10.9/NEWS
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package
The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/
