Security Advisory Important: java-1.6.0-openjdk security update

Advisory: RHSA-2014:0685-1
Type: Security Advisory
Severity: Important
Issued on: 2014-06-10
Last updated on: 2014-06-10
Affected Products: Red Hat Enterprise Linux Desktop (v. 7)
Red Hat Enterprise Linux HPC Node (v. 7)
Red Hat Enterprise Linux Server (v. 7)
Red Hat Enterprise Linux Workstation (v. 7)
CVEs (cve.mitre.org): CVE-2014-0429
CVE-2014-0446
CVE-2014-0451
CVE-2014-0452
CVE-2014-0453
CVE-2014-0456
CVE-2014-0457
CVE-2014-0458
CVE-2014-0460
CVE-2014-0461
CVE-2014-1876
CVE-2014-2397
CVE-2014-2398
CVE-2014-2403
CVE-2014-2412
CVE-2014-2414
CVE-2014-2421
CVE-2014-2423
CVE-2014-2427

Details

Updated java-1.6.0-openjdk packages that fix various security issues are
now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime
Environment and the OpenJDK 6 Java Software Development Kit.

An input validation flaw was discovered in the medialib library in the 2D
component. A specially crafted image could trigger Java Virtual Machine
memory corruption when processed. A remote attacker, or an untrusted Java
application or applet, could possibly use this flaw to execute arbitrary
code with the privileges of the user running the Java Virtual Machine.
(CVE-2014-0429)

Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK.
An untrusted Java application or applet could use these flaws to trigger
Java Virtual Machine memory corruption and possibly bypass Java sandbox
restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421)

Multiple improper permission check issues were discovered in the Libraries
component in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass Java sandbox restrictions. (CVE-2014-0457,
CVE-2014-0461)

Multiple improper permission check issues were discovered in the AWT,
JAX-WS, JAXB, Libraries, and Sound components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java sandbox
restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423,
CVE-2014-0452, CVE-2014-2414, CVE-2014-0446, CVE-2014-2427)

Multiple flaws were identified in the Java Naming and Directory Interface
(JNDI) DNS client. These flaws could make it easier for a remote attacker
to perform DNS spoofing attacks. (CVE-2014-0460)

It was discovered that the JAXP component did not properly prevent access
to arbitrary files when a SecurityManager was present. This flaw could
cause a Java application using JAXP to leak sensitive information, or
affect application availability. (CVE-2014-2403)

It was discovered that the Security component in OpenJDK could leak some
timing information when performing PKCS#1 unpadding. This could possibly
lead to the disclosure of some information that was meant to be protected
by encryption. (CVE-2014-0453)

It was discovered that the fix for CVE-2013-5797 did not properly resolve
input sanitization flaws in javadoc. When javadoc documentation was
generated from an untrusted Java source code and hosted on a domain not
controlled by the code author, these issues could make it easier to perform
cross-site scripting (XSS) attacks. (CVE-2014-2398)

An insecure temporary file use flaw was found in the way the unpack200
utility created log files. A local attacker could possibly use this flaw to
perform a symbolic link attack and overwrite arbitrary files with the
privileges of the user running unpack200. (CVE-2014-1876)

All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Updated packages

Red Hat Enterprise Linux Desktop (v. 7)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.src.rpm
File outdated by:  RHSA-2015:1526
    MD5: cfe97bf8c4f695babdb4a03972de1f0c
SHA-256: 4762be05282ab92b128d224f8daba2c03e3685e833416ef46c5b2911dbca517d
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6390de2e42013f3921674fa71bf64c8d
SHA-256: 32b31382c2046bddf19bdd8b03095a89565e5c1bc4dfeb01bcaa30d6d5e53ae8
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 1153b5a20fe3ea5300c00bc570b2d5c6
SHA-256: c03ef0b0eae0f82ace2ab6575f771da6dee9c19ba78a0e10d0ee0630201369e8
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 2c71624dbebf6495cf4ad00cd69520ce
SHA-256: 66e66c18e75eb6f22585b27484b05c3046c000170f40b692afdb63c04e03982e
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:0085
    MD5: fb74113d8326a629efbcd8bc3847ce47
SHA-256: 7a2454d7446317f46443df14095d80004e06960d61888500951fab66c1f3dc8a
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6c80808df998bccd643cee467ac8f6b9
SHA-256: df7686ed8645fc1851a94b5f74103fb4af28624defa83215020f1fbfc0f783f0
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: d441ae3220eed1a168597642f9fc674e
SHA-256: f772f980adbeba8908512cd255dd104b862274a851b7e8c227259dee2f3bec3a
 
Red Hat Enterprise Linux HPC Node (v. 7)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.src.rpm
File outdated by:  RHSA-2015:1526
    MD5: cfe97bf8c4f695babdb4a03972de1f0c
SHA-256: 4762be05282ab92b128d224f8daba2c03e3685e833416ef46c5b2911dbca517d
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6390de2e42013f3921674fa71bf64c8d
SHA-256: 32b31382c2046bddf19bdd8b03095a89565e5c1bc4dfeb01bcaa30d6d5e53ae8
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 1153b5a20fe3ea5300c00bc570b2d5c6
SHA-256: c03ef0b0eae0f82ace2ab6575f771da6dee9c19ba78a0e10d0ee0630201369e8
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 2c71624dbebf6495cf4ad00cd69520ce
SHA-256: 66e66c18e75eb6f22585b27484b05c3046c000170f40b692afdb63c04e03982e
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:0085
    MD5: fb74113d8326a629efbcd8bc3847ce47
SHA-256: 7a2454d7446317f46443df14095d80004e06960d61888500951fab66c1f3dc8a
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6c80808df998bccd643cee467ac8f6b9
SHA-256: df7686ed8645fc1851a94b5f74103fb4af28624defa83215020f1fbfc0f783f0
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: d441ae3220eed1a168597642f9fc674e
SHA-256: f772f980adbeba8908512cd255dd104b862274a851b7e8c227259dee2f3bec3a
 
Red Hat Enterprise Linux Server (v. 7)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.src.rpm
File outdated by:  RHSA-2015:1526
    MD5: cfe97bf8c4f695babdb4a03972de1f0c
SHA-256: 4762be05282ab92b128d224f8daba2c03e3685e833416ef46c5b2911dbca517d
 
PPC:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 8eebd3d9473250a4f8ff3817faade492
SHA-256: cc310ef6848c61ee1f41ece49a2501f554abfef76c8255e14cbcaacae094c461
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1526
    MD5: f81ffd132b0e5c83f36074b2e9e5e21f
SHA-256: d6f654047987fbc90c9fd44514b2dd1c0e5243ee7b6982f78b1948dd66429a7f
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1526
    MD5: b4642f3382238934f0396aa69d5dee80
SHA-256: 56b411057bfac90bc738ccc2f9c0fb8bb562633c770f000b73f3b11a878b6ca1
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6c839d76f74c81e601ca1ad915d822b5
SHA-256: c78c4f21f5926a413f925713d03c43304382eff061d191edfeda18fbd6ecbaab
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6122c1644265f6776990e067338024ea
SHA-256: d0051e70b47388a1a0a03468d6a65b4f82230f94d6686a1b26028b21f81e4fa4
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 7915f9a78df5e3cba1e6c5b66fa0dfee
SHA-256: 08bd9eeff0818d16a2ced1b921bd7d1a6be0b9dcf6d99cb61a219d67b8c8d574
 
s390x:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1526
    MD5: b355e14d64f93618260d54fe67702e9b
SHA-256: 50809043bae2d39d359dffac71b9a7a63173a233e1491b99da4541bad325dc4c
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1526
    MD5: 827e9c96f7c069ef13019d06687cdb68
SHA-256: e504378d20e56051cfce8528278680d68904477b80038956c10a5a5a9d84f6f5
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1526
    MD5: d6c7bb8caec83950b779619ee51aa816
SHA-256: d014d2710b8ccb68f84356e78f93091e28d86b44ca55d5d50d59d078868c15d4
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1526
    MD5: 219e10d4618bf406ec821a8c8f1960de
SHA-256: 52ff5dc3c73628d72cabdff3a5f4574e7c27dd00deaf85b1fe9309ce3194552e
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1526
    MD5: 73b9067d25f2b69db71f96e00b6add6a
SHA-256: 1c957209de97cb0516bb3f9d8aa980d91cc679c33ddc602a24b24ac7f2057792
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1526
    MD5: 13633ab208ea1ea17f74f3209b435135
SHA-256: 7cf96242885f1fc5aff49489a91a91763bf6f5ea9f999a85e4b9a02ea80059d9
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6390de2e42013f3921674fa71bf64c8d
SHA-256: 32b31382c2046bddf19bdd8b03095a89565e5c1bc4dfeb01bcaa30d6d5e53ae8
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 1153b5a20fe3ea5300c00bc570b2d5c6
SHA-256: c03ef0b0eae0f82ace2ab6575f771da6dee9c19ba78a0e10d0ee0630201369e8
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 2c71624dbebf6495cf4ad00cd69520ce
SHA-256: 66e66c18e75eb6f22585b27484b05c3046c000170f40b692afdb63c04e03982e
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: fb74113d8326a629efbcd8bc3847ce47
SHA-256: 7a2454d7446317f46443df14095d80004e06960d61888500951fab66c1f3dc8a
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6c80808df998bccd643cee467ac8f6b9
SHA-256: df7686ed8645fc1851a94b5f74103fb4af28624defa83215020f1fbfc0f783f0
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: d441ae3220eed1a168597642f9fc674e
SHA-256: f772f980adbeba8908512cd255dd104b862274a851b7e8c227259dee2f3bec3a
 
Red Hat Enterprise Linux Workstation (v. 7)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.src.rpm
File outdated by:  RHSA-2015:1526
    MD5: cfe97bf8c4f695babdb4a03972de1f0c
SHA-256: 4762be05282ab92b128d224f8daba2c03e3685e833416ef46c5b2911dbca517d
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6390de2e42013f3921674fa71bf64c8d
SHA-256: 32b31382c2046bddf19bdd8b03095a89565e5c1bc4dfeb01bcaa30d6d5e53ae8
java-1.6.0-openjdk-debuginfo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 1153b5a20fe3ea5300c00bc570b2d5c6
SHA-256: c03ef0b0eae0f82ace2ab6575f771da6dee9c19ba78a0e10d0ee0630201369e8
java-1.6.0-openjdk-demo-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 2c71624dbebf6495cf4ad00cd69520ce
SHA-256: 66e66c18e75eb6f22585b27484b05c3046c000170f40b692afdb63c04e03982e
java-1.6.0-openjdk-devel-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: fb74113d8326a629efbcd8bc3847ce47
SHA-256: 7a2454d7446317f46443df14095d80004e06960d61888500951fab66c1f3dc8a
java-1.6.0-openjdk-javadoc-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: 6c80808df998bccd643cee467ac8f6b9
SHA-256: df7686ed8645fc1851a94b5f74103fb4af28624defa83215020f1fbfc0f783f0
java-1.6.0-openjdk-src-1.6.0.0-6.1.13.3.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1526
    MD5: d441ae3220eed1a168597642f9fc674e
SHA-256: f772f980adbeba8908512cd255dd104b862274a851b7e8c227259dee2f3bec3a
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1060907 - CVE-2014-1876 OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)
1086632 - CVE-2014-2398 OpenJDK: insufficient escaping of window title string (Javadoc, 8026736)
1086645 - CVE-2014-0453 OpenJDK: RSA unpadding timing issues (Security, 8027766)
1087409 - CVE-2014-0429 OpenJDK: Incorrect mlib/raster image validation (2D, 8027841)
1087411 - CVE-2014-0457 OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394)
1087413 - CVE-2014-0456 OpenJDK: System.arraycopy() element race condition (Hotspot, 8029858)
1087417 - CVE-2014-2421 OpenJDK: JPEG decoder input stream handling (2D, 8029854)
1087423 - CVE-2014-2397 OpenJDK: classfile parser invalid BootstrapMethods attribute length (Hotspot, 8034926)
1087426 - CVE-2014-0461 OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)
1087427 - CVE-2014-2412 OpenJDK: AWT thread context handling (AWT, 8025010)
1087428 - CVE-2014-0451 OpenJDK: AWT incorrect FlavorMap seperation (AWT, 8026797)
1087430 - CVE-2014-0458 OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)
1087431 - CVE-2014-2414 OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030)
1087434 - CVE-2014-2423 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026188)
1087436 - CVE-2014-0452 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026801)
1087439 - CVE-2014-0446 OpenJDK: Protect logger handlers (Libraries, 8029740)
1087441 - CVE-2014-2427 OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163)
1087442 - CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)
1087443 - CVE-2014-2403 OpenJDK: JAXP CharInfo file access restriction (JAXP, 8029282)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/