Skip to navigation

Security Advisory Important: java-1.6.0-openjdk security update

Advisory: RHSA-2012:1222-1
Type: Security Advisory
Severity: Important
Issued on: 2012-09-03
Last updated on: 2012-09-03
Affected Products: Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2012-0547
CVE-2012-1682

Details

Updated java-1.6.0-openjdk packages that fix two security issues are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.

It was discovered that the Beans component in OpenJDK did not perform
permission checks properly. An untrusted Java application or applet could
use this flaw to use classes from restricted packages, allowing it to
bypass Java sandbox restrictions. (CVE-2012-1682)

A hardening fix was applied to the AWT component in OpenJDK, removing
functionality from the restricted SunToolkit class that was used in
combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)

This erratum also upgrades the OpenJDK package to IcedTea6 1.10.9. Refer to
the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux (v. 5 server)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: 49b6a0ad2ad7db7150527165a40b7672
SHA-256: 103534fc2e8b76693de10ebda949a2e3b0907747751d9f52b8ba02f7fabeefd2
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: dce6e33d1202a97a2f66fa651995fa10
SHA-256: 535ec6d332dde94dff1acf0cb42b36309d314eeaa7010bc2b63739f439af0b11
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 3b2ee925a21eb808ea2479492d8c2345
SHA-256: 98b25f9ea90d6cd6b0c070a23f352ef457cf15052b295f7a6c28236043124fbd
java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 364186399aa8e3b3934f990b132b561f
SHA-256: df8e8de95a8ff09df973cb1046a50c04adf9d825630c5e94f4180b47d1027d3e
java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 144dcb1b06ab294ae91fb50c8737608c
SHA-256: 4dcd3948c4b8d50a736f1c2c9065d5e40c91ad6e2eabf2b02033cd052929239c
java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 654117ab93b6664667297841cc820165
SHA-256: 7a6dd3440c1acb35c06253213cc18668a622b6573befa3cd4d47f8e3c3e3bdad
java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: acbf0190b6a585dc2f3fd16fdf4257e6
SHA-256: f7ab27abd766c2c3fc5dd6e3f456b67ee4a13c77a668f00dab5b3aee18b02d65
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 8b4c82e82b9da211a3ae25a0124e5f66
SHA-256: 6afd30f38701bd3d7abf18673c2da25df5c0a9d0ccee1be044b140a600d3d29a
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 15eeeaaad67d01602538474c5d48c7f7
SHA-256: b0ebfef34a25634b05bc1d989bdd34d75ccbb0a0db93f45d8bacb7abbc4bf11d
java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a8dd8cd868f0fc2eb13e95906df3ee8b
SHA-256: 140e1c51b93594e05c03db110571fd4c629c8a81e302d2ce6d35fd94f26cdf37
java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 7563b26039096f9c0a40fa8bc19f54f3
SHA-256: 2fba0f0d025bd8966df71a0e697c698fd0345f59ecab844a6037c1a3ccda3eeb
java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 3f26a6de1632e369448eccdeac06dcb5
SHA-256: b7fb01924dc1a58cd8d0b72188166b4cd5ed3399f73d6b57850ce375a20d11d4
java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 32b705d80aa3c1143d56d47f7d68a1a8
SHA-256: 1555a33c8df0bcef516b4965f39fc48814b091e78b4f19972ea134729638f1e8
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: 49b6a0ad2ad7db7150527165a40b7672
SHA-256: 103534fc2e8b76693de10ebda949a2e3b0907747751d9f52b8ba02f7fabeefd2
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: dce6e33d1202a97a2f66fa651995fa10
SHA-256: 535ec6d332dde94dff1acf0cb42b36309d314eeaa7010bc2b63739f439af0b11
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 3b2ee925a21eb808ea2479492d8c2345
SHA-256: 98b25f9ea90d6cd6b0c070a23f352ef457cf15052b295f7a6c28236043124fbd
java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 364186399aa8e3b3934f990b132b561f
SHA-256: df8e8de95a8ff09df973cb1046a50c04adf9d825630c5e94f4180b47d1027d3e
java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 144dcb1b06ab294ae91fb50c8737608c
SHA-256: 4dcd3948c4b8d50a736f1c2c9065d5e40c91ad6e2eabf2b02033cd052929239c
java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 654117ab93b6664667297841cc820165
SHA-256: 7a6dd3440c1acb35c06253213cc18668a622b6573befa3cd4d47f8e3c3e3bdad
java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: acbf0190b6a585dc2f3fd16fdf4257e6
SHA-256: f7ab27abd766c2c3fc5dd6e3f456b67ee4a13c77a668f00dab5b3aee18b02d65
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 8b4c82e82b9da211a3ae25a0124e5f66
SHA-256: 6afd30f38701bd3d7abf18673c2da25df5c0a9d0ccee1be044b140a600d3d29a
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 15eeeaaad67d01602538474c5d48c7f7
SHA-256: b0ebfef34a25634b05bc1d989bdd34d75ccbb0a0db93f45d8bacb7abbc4bf11d
java-1.6.0-openjdk-demo-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a8dd8cd868f0fc2eb13e95906df3ee8b
SHA-256: 140e1c51b93594e05c03db110571fd4c629c8a81e302d2ce6d35fd94f26cdf37
java-1.6.0-openjdk-devel-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 7563b26039096f9c0a40fa8bc19f54f3
SHA-256: 2fba0f0d025bd8966df71a0e697c698fd0345f59ecab844a6037c1a3ccda3eeb
java-1.6.0-openjdk-javadoc-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 3f26a6de1632e369448eccdeac06dcb5
SHA-256: b7fb01924dc1a58cd8d0b72188166b4cd5ed3399f73d6b57850ce375a20d11d4
java-1.6.0-openjdk-src-1.6.0.0-1.28.1.10.9.el5_8.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 32b705d80aa3c1143d56d47f7d68a1a8
SHA-256: 1555a33c8df0bcef516b4965f39fc48814b091e78b4f19972ea134729638f1e8
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

846709 - Kerberos auth failing to work in openjdk due to two upstream bugs
853097 - CVE-2012-1682 OpenJDK: beans ClassFinder insufficient permission checks (beans, 7162476)
853228 - CVE-2012-0547 OpenJDK: AWT hardening fixes (AWT, 7163201)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/