Security Advisory Critical: java-1.7.1-ibm security update

Advisory: RHSA-2014:0705-1
Type: Security Advisory
Severity: Critical
Issued on: 2014-06-10
Last updated on: 2014-06-10
Affected Products: Red Hat Enterprise Linux Desktop Supplementary (v. 7)
Red Hat Enterprise Linux HPC Node Supplementary (v. 7)
Red Hat Enterprise Linux Server Supplementary (v. 7)
Red Hat Enterprise Linux Workstation Supplementary (v. 7)
CVEs (cve.mitre.org): CVE-2013-5878
CVE-2013-5884
CVE-2013-5887
CVE-2013-5888
CVE-2013-5889
CVE-2013-5896
CVE-2013-5898
CVE-2013-5899
CVE-2013-5907
CVE-2013-5910
CVE-2013-6629
CVE-2013-6954
CVE-2014-0368
CVE-2014-0373
CVE-2014-0375
CVE-2014-0376
CVE-2014-0387
CVE-2014-0403
CVE-2014-0410
CVE-2014-0411
CVE-2014-0415
CVE-2014-0416
CVE-2014-0417
CVE-2014-0422
CVE-2014-0423
CVE-2014-0424
CVE-2014-0428
CVE-2014-0429
CVE-2014-0446
CVE-2014-0448
CVE-2014-0449
CVE-2014-0451
CVE-2014-0452
CVE-2014-0453
CVE-2014-0454
CVE-2014-0455
CVE-2014-0457
CVE-2014-0458
CVE-2014-0459
CVE-2014-0460
CVE-2014-0461
CVE-2014-0878
CVE-2014-1876
CVE-2014-2398
CVE-2014-2401
CVE-2014-2402
CVE-2014-2409
CVE-2014-2412
CVE-2014-2414
CVE-2014-2420
CVE-2014-2421
CVE-2014-2423
CVE-2014-2427
CVE-2014-2428

Details

Updated java-1.7.1-ibm packages that fix several security issues are now
available for Red Hat Enterprise Linux 7 Supplementary.

The Red Hat Security Response Team has rated this update as having Critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment
and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime
Environment and the IBM Java Software Development Kit. Detailed
vulnerability descriptions are linked from the IBM Security alerts
page, listed in the References section. (CVE-2013-5878, CVE-2013-5884,
CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898,
CVE-2013-5899, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954,
CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387,
CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416,
CVE-2014-0417, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428,
CVE-2014-0429, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451,
CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0457,
CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876,
CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2409, CVE-2014-2412,
CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427,
CVE-2014-2428)

All users of java-1.7.1-ibm are advised to upgrade to these updated
packages, containing the IBM Java SE 7R1 SR1 release. All running instances
of IBM Java must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Updated packages

Red Hat Enterprise Linux Desktop Supplementary (v. 7)

x86_64:
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: e8a6e39bf6ff4d89130e5e36f4dea021
SHA-256: 346d39458d118098a7d6baf48ddc77f2b4a1d716b01fd0c9b39b0704c7840dbb
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: cf2d27be46945a782f199d0933bc84ab
SHA-256: 41338e799eb7452d9d3de2115844a75097e411690c44adb984290df7605874e1
java-1.7.1-ibm-demo-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 7cd73573bfd8c1bbed9065998f43f217
SHA-256: 01dc72015ff807bf30b7a7e474a8537d92334e4b067bb7157d6b3702ae2fee54
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: 6087243b45425a8c5525dec9d67dd793
SHA-256: 852060a4525220b16b90268c980680d65109cc292e34d407f6646b47992e7362
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: c02a055592606e6809a025f354ab1517
SHA-256: a02df5cf0b64b788a7dc989ae2bb4a5d9a07dfa03d8cd4bd08bca1909ed7c531
java-1.7.1-ibm-jdbc-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: ac88e61138dcf30560217b6dd7626821
SHA-256: 724b3549868321268bfd4e438a1e4ecca2c8fa630a39a3dc06485bb2af7d129c
java-1.7.1-ibm-plugin-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 5debf7b9b1277dcb0d277df6944685ec
SHA-256: 1bd39c56cdbe67bab9b3d74cf1cd7704ab975e29c7cd5076b5a23a59dc5b6379
java-1.7.1-ibm-src-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 56c7487df1c58327b3849654bc0fce68
SHA-256: f7b257792fd898a806730c82701816bed90810d3de8af369a53fdde88dac5b90
 
Red Hat Enterprise Linux HPC Node Supplementary (v. 7)

x86_64:
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: e8a6e39bf6ff4d89130e5e36f4dea021
SHA-256: 346d39458d118098a7d6baf48ddc77f2b4a1d716b01fd0c9b39b0704c7840dbb
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: cf2d27be46945a782f199d0933bc84ab
SHA-256: 41338e799eb7452d9d3de2115844a75097e411690c44adb984290df7605874e1
java-1.7.1-ibm-demo-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 7cd73573bfd8c1bbed9065998f43f217
SHA-256: 01dc72015ff807bf30b7a7e474a8537d92334e4b067bb7157d6b3702ae2fee54
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: 6087243b45425a8c5525dec9d67dd793
SHA-256: 852060a4525220b16b90268c980680d65109cc292e34d407f6646b47992e7362
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: c02a055592606e6809a025f354ab1517
SHA-256: a02df5cf0b64b788a7dc989ae2bb4a5d9a07dfa03d8cd4bd08bca1909ed7c531
java-1.7.1-ibm-src-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 56c7487df1c58327b3849654bc0fce68
SHA-256: f7b257792fd898a806730c82701816bed90810d3de8af369a53fdde88dac5b90
 
Red Hat Enterprise Linux Server Supplementary (v. 7)

PPC:
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.ppc.rpm
File outdated by:  RHSA-2015:1020
    MD5: de2f6ea5288c6adfe5fc23ef66c2348d
SHA-256: 4b55824c92b239a61d15380c85330d5de2c6d35ff289da542d9d6becb9e7642f
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1020
    MD5: ef974a966300606c07282dd5cc03f706
SHA-256: a60d9f740e1b2854b49e53cc00983dd73bfdf3849c80abd917e6725ab8a2ae65
java-1.7.1-ibm-demo-1.7.1.1.0-1jpp.2.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1020
    MD5: c6ddea0e6de4dd48c79db83e4f0f8166
SHA-256: d8b731b5c0b44fc868a2833208c2fdac32cc77e32d8c7286acf5ef100aaba69a
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.ppc.rpm
File outdated by:  RHSA-2015:1020
    MD5: d2f572f032015d771e3e7673c483c030
SHA-256: 6e7d8b3c4e12f24dd4632938db284f32c4a2df9d53a6ab11d0c44c387a5e8cbc
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 7ced38fa8be661f085377f997ceeafb7
SHA-256: 0c4776f8dde4bb29b56139124182accfe4eb7a2731452eaa4a76f15b18a162d1
java-1.7.1-ibm-jdbc-1.7.1.1.0-1jpp.2.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 0914c595f0ece81923c2c54a8945fc31
SHA-256: a6d53cf78e07b49f5fcb7defcf7feb9603063228ea18635259c142a900609311
java-1.7.1-ibm-plugin-1.7.1.1.0-1jpp.2.el7_0.ppc.rpm
File outdated by:  RHSA-2015:1020
    MD5: 2c1554de4288f68070612a63b636e261
SHA-256: 3022c047494b4472264bb95b33425959ee234ca5442f971f821f6d87bbb4c1e6
java-1.7.1-ibm-src-1.7.1.1.0-1jpp.2.el7_0.ppc64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 7e9f354f8548e4707fc9f2cdd53e5702
SHA-256: 8a9599c132f0b68bc5fb6fb0503a57ec138a702dc1f890173d5c8bb3cc24dd31
 
s390x:
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.s390.rpm
File outdated by:  RHSA-2015:1020
    MD5: d2cd60ae41b4a4613946867e18c92e2d
SHA-256: 536c01413f4665f71ef215b02dda2abe70aee9eee864f4a6810b9130b90db38f
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1020
    MD5: ddbf647aec23771e75dbf9e6f0e0b857
SHA-256: b1769426968d9b0e93e8d619fe1efc1c49453a82f4e0ff9cd52fb27d896c209e
java-1.7.1-ibm-demo-1.7.1.1.0-1jpp.2.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1020
    MD5: c3c8f969f37eff33d1a9798ae1aed055
SHA-256: 71183f591ad2af3d7a2e34f56ca2688c2d73866960cdb2520656d8a9068600d5
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.s390.rpm
File outdated by:  RHSA-2015:1020
    MD5: 03c81dc574bf590359f4547806bd5fae
SHA-256: 50cf6e7f773c5fe6499d3aaa9c4b9f3b35a2b2ca22ea9bf1492920879085b851
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1020
    MD5: 8e9488d32f971d9aba53d7794039209c
SHA-256: 8c4cbccbdd07ef465cf417da834fa5790641465f4e13ec55d5576d0224bae976
java-1.7.1-ibm-jdbc-1.7.1.1.0-1jpp.2.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1020
    MD5: 288503da3445ec1f726fd66b12229794
SHA-256: fb31c156544e421a5ed0a731bc84f23e71542e1609f3c4dce241dadd0967d4eb
java-1.7.1-ibm-src-1.7.1.1.0-1jpp.2.el7_0.s390x.rpm
File outdated by:  RHSA-2015:1020
    MD5: 643abaf3a84634c58f13ea318e0ec24f
SHA-256: c0b1939ee1713de6aa63899748bd79dae83e2736ed958d3725b6ec38cdccc80f
 
x86_64:
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: e8a6e39bf6ff4d89130e5e36f4dea021
SHA-256: 346d39458d118098a7d6baf48ddc77f2b4a1d716b01fd0c9b39b0704c7840dbb
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: cf2d27be46945a782f199d0933bc84ab
SHA-256: 41338e799eb7452d9d3de2115844a75097e411690c44adb984290df7605874e1
java-1.7.1-ibm-demo-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 7cd73573bfd8c1bbed9065998f43f217
SHA-256: 01dc72015ff807bf30b7a7e474a8537d92334e4b067bb7157d6b3702ae2fee54
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: 6087243b45425a8c5525dec9d67dd793
SHA-256: 852060a4525220b16b90268c980680d65109cc292e34d407f6646b47992e7362
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: c02a055592606e6809a025f354ab1517
SHA-256: a02df5cf0b64b788a7dc989ae2bb4a5d9a07dfa03d8cd4bd08bca1909ed7c531
java-1.7.1-ibm-jdbc-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: ac88e61138dcf30560217b6dd7626821
SHA-256: 724b3549868321268bfd4e438a1e4ecca2c8fa630a39a3dc06485bb2af7d129c
java-1.7.1-ibm-plugin-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 5debf7b9b1277dcb0d277df6944685ec
SHA-256: 1bd39c56cdbe67bab9b3d74cf1cd7704ab975e29c7cd5076b5a23a59dc5b6379
java-1.7.1-ibm-src-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 56c7487df1c58327b3849654bc0fce68
SHA-256: f7b257792fd898a806730c82701816bed90810d3de8af369a53fdde88dac5b90
 
Red Hat Enterprise Linux Workstation Supplementary (v. 7)

x86_64:
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: e8a6e39bf6ff4d89130e5e36f4dea021
SHA-256: 346d39458d118098a7d6baf48ddc77f2b4a1d716b01fd0c9b39b0704c7840dbb
java-1.7.1-ibm-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: cf2d27be46945a782f199d0933bc84ab
SHA-256: 41338e799eb7452d9d3de2115844a75097e411690c44adb984290df7605874e1
java-1.7.1-ibm-demo-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 7cd73573bfd8c1bbed9065998f43f217
SHA-256: 01dc72015ff807bf30b7a7e474a8537d92334e4b067bb7157d6b3702ae2fee54
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.i686.rpm
File outdated by:  RHSA-2015:1020
    MD5: 6087243b45425a8c5525dec9d67dd793
SHA-256: 852060a4525220b16b90268c980680d65109cc292e34d407f6646b47992e7362
java-1.7.1-ibm-devel-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: c02a055592606e6809a025f354ab1517
SHA-256: a02df5cf0b64b788a7dc989ae2bb4a5d9a07dfa03d8cd4bd08bca1909ed7c531
java-1.7.1-ibm-jdbc-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: ac88e61138dcf30560217b6dd7626821
SHA-256: 724b3549868321268bfd4e438a1e4ecca2c8fa630a39a3dc06485bb2af7d129c
java-1.7.1-ibm-plugin-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 5debf7b9b1277dcb0d277df6944685ec
SHA-256: 1bd39c56cdbe67bab9b3d74cf1cd7704ab975e29c7cd5076b5a23a59dc5b6379
java-1.7.1-ibm-src-1.7.1.1.0-1jpp.2.el7_0.x86_64.rpm
File outdated by:  RHSA-2015:1020
    MD5: 56c7487df1c58327b3849654bc0fce68
SHA-256: f7b257792fd898a806730c82701816bed90810d3de8af369a53fdde88dac5b90
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1031734 - CVE-2013-6629 libjpeg: information leak (read of uninitialized memory)
1045561 - CVE-2013-6954 libpng: unhandled zero-length PLTE chunk or NULL palette
1051519 - CVE-2014-0428 OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767)
1051528 - CVE-2014-0422 OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758)
1051699 - CVE-2014-0373 OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126)
1051823 - CVE-2013-5878 OpenJDK: null xmlns handling issue (Security, 8025026)
1051911 - CVE-2013-5884 OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193)
1051912 - CVE-2014-0416 OpenJDK: insecure subject principals set handling (JAAS, 8024306)
1051923 - CVE-2014-0376 OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018)
1052915 - CVE-2013-5907 ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034)
1052919 - CVE-2014-0368 OpenJDK: insufficient Socket checkListen checks (Networking, 8011786)
1052942 - CVE-2013-5910 OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417)
1053010 - CVE-2014-0411 OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)
1053066 - CVE-2014-0423 OpenJDK: XXE issue in decoder (Beans, 8023245)
1053266 - CVE-2013-5896 OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022)
1053495 - CVE-2014-0410 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053496 - CVE-2014-0415 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053499 - CVE-2013-5889 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053501 - CVE-2014-0417 Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (2D)
1053502 - CVE-2014-0387 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053504 - CVE-2014-0424 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053507 - CVE-2014-0403 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053508 - CVE-2014-0375 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053515 - CVE-2013-5887 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053516 - CVE-2013-5899 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053517 - CVE-2013-5888 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1053518 - CVE-2013-5898 Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
1060907 - CVE-2014-1876 OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)
1086632 - CVE-2014-2398 OpenJDK: insufficient escaping of window title string (Javadoc, 8026736)
1086645 - CVE-2014-0453 OpenJDK: RSA unpadding timing issues (Security, 8027766)
1087409 - CVE-2014-0429 OpenJDK: Incorrect mlib/raster image validation (2D, 8027841)
1087411 - CVE-2014-0457 OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394)
1087417 - CVE-2014-2421 OpenJDK: JPEG decoder input stream handling (2D, 8029854)
1087424 - CVE-2014-0455 OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844)
1087426 - CVE-2014-0461 OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)
1087427 - CVE-2014-2412 OpenJDK: AWT thread context handling (AWT, 8025010)
1087428 - CVE-2014-0451 OpenJDK: AWT incorrect FlavorMap seperation (AWT, 8026797)
1087430 - CVE-2014-0458 OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)
1087431 - CVE-2014-2414 OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030)
1087434 - CVE-2014-2423 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026188)
1087436 - CVE-2014-0452 OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026801)
1087438 - CVE-2014-2402 OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)
1087439 - CVE-2014-0446 OpenJDK: Protect logger handlers (Libraries, 8029740)
1087440 - CVE-2014-0454 OpenJDK: Prevent SIGNATURE_PRIMITIVE_SET from being modified (Security, 8029745)
1087441 - CVE-2014-2427 OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163)
1087442 - CVE-2014-0460 OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)
1087444 - CVE-2014-0459 lcms: insufficient ICC profile version validation (OpenJDK 2D, 8031335)
1088024 - CVE-2014-0448 Oracle JDK: unspecified vulnerability fixed in 7u55 and 8u5 (Deployment)
1088025 - CVE-2014-2428 Oracle JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment)
1088027 - CVE-2014-2409 Oracle JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment)
1088028 - CVE-2014-0449 Oracle JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment)
1088030 - CVE-2014-2401 Oracle JDK: unspecified vulnerability fixed in 5.0u75, 6u75, 7u55 and 8u5 (2D)
1088031 - CVE-2014-2420 Oracle JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment)


References

https://www.redhat.com/security/data/cve/CVE-2013-5878.html
https://www.redhat.com/security/data/cve/CVE-2013-5884.html
https://www.redhat.com/security/data/cve/CVE-2013-5887.html
https://www.redhat.com/security/data/cve/CVE-2013-5888.html
https://www.redhat.com/security/data/cve/CVE-2013-5889.html
https://www.redhat.com/security/data/cve/CVE-2013-5896.html
https://www.redhat.com/security/data/cve/CVE-2013-5898.html
https://www.redhat.com/security/data/cve/CVE-2013-5899.html
https://www.redhat.com/security/data/cve/CVE-2013-5907.html
https://www.redhat.com/security/data/cve/CVE-2013-5910.html
https://www.redhat.com/security/data/cve/CVE-2013-6629.html
https://www.redhat.com/security/data/cve/CVE-2013-6954.html
https://www.redhat.com/security/data/cve/CVE-2014-0368.html
https://www.redhat.com/security/data/cve/CVE-2014-0373.html
https://www.redhat.com/security/data/cve/CVE-2014-0375.html
https://www.redhat.com/security/data/cve/CVE-2014-0376.html
https://www.redhat.com/security/data/cve/CVE-2014-0387.html
https://www.redhat.com/security/data/cve/CVE-2014-0403.html
https://www.redhat.com/security/data/cve/CVE-2014-0410.html
https://www.redhat.com/security/data/cve/CVE-2014-0411.html
https://www.redhat.com/security/data/cve/CVE-2014-0415.html
https://www.redhat.com/security/data/cve/CVE-2014-0416.html
https://www.redhat.com/security/data/cve/CVE-2014-0417.html
https://www.redhat.com/security/data/cve/CVE-2014-0422.html
https://www.redhat.com/security/data/cve/CVE-2014-0423.html
https://www.redhat.com/security/data/cve/CVE-2014-0424.html
https://www.redhat.com/security/data/cve/CVE-2014-0428.html
https://www.redhat.com/security/data/cve/CVE-2014-0429.html
https://www.redhat.com/security/data/cve/CVE-2014-0446.html
https://www.redhat.com/security/data/cve/CVE-2014-0448.html
https://www.redhat.com/security/data/cve/CVE-2014-0449.html
https://www.redhat.com/security/data/cve/CVE-2014-0451.html
https://www.redhat.com/security/data/cve/CVE-2014-0452.html
https://www.redhat.com/security/data/cve/CVE-2014-0453.html
https://www.redhat.com/security/data/cve/CVE-2014-0454.html
https://www.redhat.com/security/data/cve/CVE-2014-0455.html
https://www.redhat.com/security/data/cve/CVE-2014-0457.html
https://www.redhat.com/security/data/cve/CVE-2014-0458.html
https://www.redhat.com/security/data/cve/CVE-2014-0459.html
https://www.redhat.com/security/data/cve/CVE-2014-0460.html
https://www.redhat.com/security/data/cve/CVE-2014-0461.html
https://www.redhat.com/security/data/cve/CVE-2014-0878.html
https://www.redhat.com/security/data/cve/CVE-2014-1876.html
https://www.redhat.com/security/data/cve/CVE-2014-2398.html
https://www.redhat.com/security/data/cve/CVE-2014-2401.html
https://www.redhat.com/security/data/cve/CVE-2014-2402.html
https://www.redhat.com/security/data/cve/CVE-2014-2409.html
https://www.redhat.com/security/data/cve/CVE-2014-2412.html
https://www.redhat.com/security/data/cve/CVE-2014-2414.html
https://www.redhat.com/security/data/cve/CVE-2014-2420.html
https://www.redhat.com/security/data/cve/CVE-2014-2421.html
https://www.redhat.com/security/data/cve/CVE-2014-2423.html
https://www.redhat.com/security/data/cve/CVE-2014-2427.html
https://www.redhat.com/security/data/cve/CVE-2014-2428.html
https://access.redhat.com/security/updates/classification/#critical
https://www.ibm.com/developerworks/java/jdk/alerts/


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/