Skip to navigation

Security Advisory Critical: java-1.6.0-openjdk security update

Advisory: RHSA-2012:1384-1
Type: Security Advisory
Severity: Critical
Issued on: 2012-10-17
Last updated on: 2012-10-17
Affected Products: Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server EUS (v. 6.3.z)
Red Hat Enterprise Linux Workstation (v. 6)
CVEs (cve.mitre.org): CVE-2012-3216
CVE-2012-4416
CVE-2012-5068
CVE-2012-5069
CVE-2012-5071
CVE-2012-5072
CVE-2012-5073
CVE-2012-5075
CVE-2012-5077
CVE-2012-5079
CVE-2012-5081
CVE-2012-5084
CVE-2012-5085
CVE-2012-5086
CVE-2012-5089

Details

Updated java-1.6.0-openjdk packages that fix several security issues are
now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans,
Swing, and JMX components in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2012-5086, CVE-2012-5084, CVE-2012-5089)

Multiple improper permission check issues were discovered in the Scripting,
JMX, Concurrency, Libraries, and Security components in OpenJDK. An
untrusted Java application or applet could use these flaws to bypass
certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071,
CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of
an incompatible class while performing provider lookup. An untrusted Java
application or applet could use this flaw to bypass certain Java sandbox
restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS
implementation did not properly handle handshake records containing an
overly large data length value. An unauthenticated, remote attacker could
possibly use this flaw to cause an SSL/TLS server to terminate with an
exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain
actions in an insecure manner. An untrusted Java application or applet
could possibly use this flaw to disclose sensitive information.
(CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it
to not perform array initialization in certain cases. An untrusted Java
application or applet could use this flaw to disclose portions of the
virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect
against the creation of multiple seeders. An untrusted Java application or
applet could possibly use this flaw to disclose sensitive information.
(CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash
code of the canonicalized path name. An untrusted Java application or
applet could possibly use this flaw to determine certain system paths, such
as the current working directory. (CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by
default. Gopher support can be enabled by setting the newly introduced
property, "jdk.net.registerGopherProtocol", to true. (CVE-2012-5085)

Note: If the web browser plug-in provided by the icedtea-web package was
installed, the issues exposed via Java applets could have been exploited
without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.5. Refer to
the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux Desktop (v. 6)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: e4eabdaa0299cd4d39488d3d0a0a4819
SHA-256: f785905a3d9142333074f280eedcf51a4fd1d97622b2ba4a08d0011a2afa401f
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2637151e823afd03547daa0ef0722ebb
SHA-256: bcd43644a3af691417161813d1654a672a29a0429e4df175b9fd9102d9117944
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: c0c09e47d43ebfca75111eb8b3d3824a
SHA-256: 54a21253216f12c358b048988cc483072fda828ebdc02eb1af1ec2064295d912
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: a5d2988c68a7e0ca9b49a5c42a7c7422
SHA-256: b6da99e08b1e88295deca27dc25ac33651b7ec90a385ad2353fd8467464f347a
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 0bdfd5ed60a087e88be33768fe084db6
SHA-256: a9c72ed1d2501591c41469d6b594c0ab3155fb2ee9f6505ee9d2193986cdcdf8
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: fc07d47f8e94ed131d6b91deef0c446e
SHA-256: 132b1f160532cf16cb5b058e26b372359b1a0c8c23ff395bbfd8053c9bf318af
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4b840833b3bf7f28ed83f63259a171d5
SHA-256: 221ed19c7038907abfd9c335d2802461ad61e3579aad36a36a302833cfa4b114
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1bd96bda49f9568c99b0a5a6abae808b
SHA-256: e6e79e13e74e9fa0fb20656264a4943fe5b590e9a1e30f688b985be9c8b34e30
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 94e5c16016e5425b51c402daffa239ee
SHA-256: 0c961fd22d5bb3dfe297f060d47c9f2afd0e5c08d31ea459d9d27e63325ed288
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4f7c9967edcd0d9e8a29f2d9b5b10829
SHA-256: acef011ab841214213395170bf0534281e07bdd05f0fc3bd44621569b1aef7fc
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 109fd4387d3aa3dbc2b253e402b8ecf0
SHA-256: dfe7609c157346f4edf0384e5509e7593e3640701eb0ea696ce4e76488a6c59f
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a2d38f502aff4c94880132e529a8e6fe
SHA-256: 56fd0380b5c1085486aa95191fef1292026216944e7e83a6bc8a9785c01fdf16
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: f8e50739895b8aa249aba06eb5be96e9
SHA-256: 39b46193e17c44f5e4eeecd7095b18e45f505a09b83941cc4d04ef574517278d
 
Red Hat Enterprise Linux HPC Node (v. 6)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: e4eabdaa0299cd4d39488d3d0a0a4819
SHA-256: f785905a3d9142333074f280eedcf51a4fd1d97622b2ba4a08d0011a2afa401f
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1bd96bda49f9568c99b0a5a6abae808b
SHA-256: e6e79e13e74e9fa0fb20656264a4943fe5b590e9a1e30f688b985be9c8b34e30
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 94e5c16016e5425b51c402daffa239ee
SHA-256: 0c961fd22d5bb3dfe297f060d47c9f2afd0e5c08d31ea459d9d27e63325ed288
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4f7c9967edcd0d9e8a29f2d9b5b10829
SHA-256: acef011ab841214213395170bf0534281e07bdd05f0fc3bd44621569b1aef7fc
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 109fd4387d3aa3dbc2b253e402b8ecf0
SHA-256: dfe7609c157346f4edf0384e5509e7593e3640701eb0ea696ce4e76488a6c59f
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a2d38f502aff4c94880132e529a8e6fe
SHA-256: 56fd0380b5c1085486aa95191fef1292026216944e7e83a6bc8a9785c01fdf16
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: f8e50739895b8aa249aba06eb5be96e9
SHA-256: 39b46193e17c44f5e4eeecd7095b18e45f505a09b83941cc4d04ef574517278d
 
Red Hat Enterprise Linux Server (v. 6)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: e4eabdaa0299cd4d39488d3d0a0a4819
SHA-256: f785905a3d9142333074f280eedcf51a4fd1d97622b2ba4a08d0011a2afa401f
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2637151e823afd03547daa0ef0722ebb
SHA-256: bcd43644a3af691417161813d1654a672a29a0429e4df175b9fd9102d9117944
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: c0c09e47d43ebfca75111eb8b3d3824a
SHA-256: 54a21253216f12c358b048988cc483072fda828ebdc02eb1af1ec2064295d912
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: a5d2988c68a7e0ca9b49a5c42a7c7422
SHA-256: b6da99e08b1e88295deca27dc25ac33651b7ec90a385ad2353fd8467464f347a
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 0bdfd5ed60a087e88be33768fe084db6
SHA-256: a9c72ed1d2501591c41469d6b594c0ab3155fb2ee9f6505ee9d2193986cdcdf8
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: fc07d47f8e94ed131d6b91deef0c446e
SHA-256: 132b1f160532cf16cb5b058e26b372359b1a0c8c23ff395bbfd8053c9bf318af
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4b840833b3bf7f28ed83f63259a171d5
SHA-256: 221ed19c7038907abfd9c335d2802461ad61e3579aad36a36a302833cfa4b114
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1bd96bda49f9568c99b0a5a6abae808b
SHA-256: e6e79e13e74e9fa0fb20656264a4943fe5b590e9a1e30f688b985be9c8b34e30
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 94e5c16016e5425b51c402daffa239ee
SHA-256: 0c961fd22d5bb3dfe297f060d47c9f2afd0e5c08d31ea459d9d27e63325ed288
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4f7c9967edcd0d9e8a29f2d9b5b10829
SHA-256: acef011ab841214213395170bf0534281e07bdd05f0fc3bd44621569b1aef7fc
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 109fd4387d3aa3dbc2b253e402b8ecf0
SHA-256: dfe7609c157346f4edf0384e5509e7593e3640701eb0ea696ce4e76488a6c59f
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a2d38f502aff4c94880132e529a8e6fe
SHA-256: 56fd0380b5c1085486aa95191fef1292026216944e7e83a6bc8a9785c01fdf16
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: f8e50739895b8aa249aba06eb5be96e9
SHA-256: 39b46193e17c44f5e4eeecd7095b18e45f505a09b83941cc4d04ef574517278d
 
Red Hat Enterprise Linux Server EUS (v. 6.3.z)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: e4eabdaa0299cd4d39488d3d0a0a4819
SHA-256: f785905a3d9142333074f280eedcf51a4fd1d97622b2ba4a08d0011a2afa401f
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2013:0273
    MD5: 2637151e823afd03547daa0ef0722ebb
SHA-256: bcd43644a3af691417161813d1654a672a29a0429e4df175b9fd9102d9117944
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2013:0273
    MD5: c0c09e47d43ebfca75111eb8b3d3824a
SHA-256: 54a21253216f12c358b048988cc483072fda828ebdc02eb1af1ec2064295d912
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2013:0273
    MD5: a5d2988c68a7e0ca9b49a5c42a7c7422
SHA-256: b6da99e08b1e88295deca27dc25ac33651b7ec90a385ad2353fd8467464f347a
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2013:0273
    MD5: 0bdfd5ed60a087e88be33768fe084db6
SHA-256: a9c72ed1d2501591c41469d6b594c0ab3155fb2ee9f6505ee9d2193986cdcdf8
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2013:0273
    MD5: fc07d47f8e94ed131d6b91deef0c446e
SHA-256: 132b1f160532cf16cb5b058e26b372359b1a0c8c23ff395bbfd8053c9bf318af
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2013:0273
    MD5: 4b840833b3bf7f28ed83f63259a171d5
SHA-256: 221ed19c7038907abfd9c335d2802461ad61e3579aad36a36a302833cfa4b114
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2013:0273
    MD5: 1bd96bda49f9568c99b0a5a6abae808b
SHA-256: e6e79e13e74e9fa0fb20656264a4943fe5b590e9a1e30f688b985be9c8b34e30
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2013:0273
    MD5: 94e5c16016e5425b51c402daffa239ee
SHA-256: 0c961fd22d5bb3dfe297f060d47c9f2afd0e5c08d31ea459d9d27e63325ed288
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2013:0273
    MD5: 4f7c9967edcd0d9e8a29f2d9b5b10829
SHA-256: acef011ab841214213395170bf0534281e07bdd05f0fc3bd44621569b1aef7fc
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2013:0273
    MD5: 109fd4387d3aa3dbc2b253e402b8ecf0
SHA-256: dfe7609c157346f4edf0384e5509e7593e3640701eb0ea696ce4e76488a6c59f
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2013:0273
    MD5: a2d38f502aff4c94880132e529a8e6fe
SHA-256: 56fd0380b5c1085486aa95191fef1292026216944e7e83a6bc8a9785c01fdf16
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2013:0273
    MD5: f8e50739895b8aa249aba06eb5be96e9
SHA-256: 39b46193e17c44f5e4eeecd7095b18e45f505a09b83941cc4d04ef574517278d
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.src.rpm
File outdated by:  RHSA-2014:0408
    MD5: e4eabdaa0299cd4d39488d3d0a0a4819
SHA-256: f785905a3d9142333074f280eedcf51a4fd1d97622b2ba4a08d0011a2afa401f
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2637151e823afd03547daa0ef0722ebb
SHA-256: bcd43644a3af691417161813d1654a672a29a0429e4df175b9fd9102d9117944
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: c0c09e47d43ebfca75111eb8b3d3824a
SHA-256: 54a21253216f12c358b048988cc483072fda828ebdc02eb1af1ec2064295d912
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: a5d2988c68a7e0ca9b49a5c42a7c7422
SHA-256: b6da99e08b1e88295deca27dc25ac33651b7ec90a385ad2353fd8467464f347a
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 0bdfd5ed60a087e88be33768fe084db6
SHA-256: a9c72ed1d2501591c41469d6b594c0ab3155fb2ee9f6505ee9d2193986cdcdf8
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: fc07d47f8e94ed131d6b91deef0c446e
SHA-256: 132b1f160532cf16cb5b058e26b372359b1a0c8c23ff395bbfd8053c9bf318af
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.i686.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4b840833b3bf7f28ed83f63259a171d5
SHA-256: 221ed19c7038907abfd9c335d2802461ad61e3579aad36a36a302833cfa4b114
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 1bd96bda49f9568c99b0a5a6abae808b
SHA-256: e6e79e13e74e9fa0fb20656264a4943fe5b590e9a1e30f688b985be9c8b34e30
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 94e5c16016e5425b51c402daffa239ee
SHA-256: 0c961fd22d5bb3dfe297f060d47c9f2afd0e5c08d31ea459d9d27e63325ed288
java-1.6.0-openjdk-demo-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 4f7c9967edcd0d9e8a29f2d9b5b10829
SHA-256: acef011ab841214213395170bf0534281e07bdd05f0fc3bd44621569b1aef7fc
java-1.6.0-openjdk-devel-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 109fd4387d3aa3dbc2b253e402b8ecf0
SHA-256: dfe7609c157346f4edf0384e5509e7593e3640701eb0ea696ce4e76488a6c59f
java-1.6.0-openjdk-javadoc-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a2d38f502aff4c94880132e529a8e6fe
SHA-256: 56fd0380b5c1085486aa95191fef1292026216944e7e83a6bc8a9785c01fdf16
java-1.6.0-openjdk-src-1.6.0.0-1.50.1.11.5.el6_3.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: f8e50739895b8aa249aba06eb5be96e9
SHA-256: 39b46193e17c44f5e4eeecd7095b18e45f505a09b83941cc4d04ef574517278d
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

856124 - CVE-2012-4416 OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606)
865346 - CVE-2012-3216 OpenJDK: java.io.FilePermission information leak (Libraries, 6631398)
865348 - CVE-2012-5068 OpenJDK: RhinoScriptEngine security bypass (Scripting, 7143535)
865354 - CVE-2012-5077 OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)
865357 - CVE-2012-5073 OpenJDK: LogManager security bypass (Libraries, 7169884)
865363 - CVE-2012-5075 OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888)
865365 - CVE-2012-5072 OpenJDK: AccessController.doPrivilegedWithCombiner() information disclosure (Security, 7172522)
865370 - CVE-2012-5081 OpenJDK: JSSE denial of service (JSSE, 7186286)
865428 - CVE-2012-5086 OpenJDK: XMLDecoder sandbox restriction bypass (Beans, 7195917)
865511 - CVE-2012-5084 OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194)
865514 - CVE-2012-5089 OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296)
865519 - CVE-2012-5071 OpenJDK: DescriptorSupport insufficient package access checks (JMX, 7192975)
865531 - CVE-2012-5069 OpenJDK: Executors state handling issues (Concurrency, 7189103)
865541 - CVE-2012-5085 OpenJDK: disable Gopher support by default (Gopher, 7189567)
865568 - CVE-2012-5079 OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/