Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code.
An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483)

An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.
(CVE-2016-0466)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)

Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4871, CVE-2016-0402, CVE-2016-0448)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code.
An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483)

An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.
(CVE-2016-0466)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)

Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4871, CVE-2016-0402, CVE-2016-0448)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 and 7 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494)

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR3-FP30 release. All running instances of IBM Java must be restarted for the update to take effect.

This update for java-1_6_0-ibm fixes the following issues by updating to 6.0-16.20 (bsc#963937)

  - CVE-2015-5041: Could could have invoked non-public     interface methods under certain circumstances

  - CVE-2015-7575: The TLS protocol could allow weaker than     expected security caused by a collision attack when     using the MD5 hash function for signing a     ServerKeyExchange message during a TLS handshake. An     attacker could exploit this vulnerability using     man-in-the-middle techniques to impersonate a TLS server     and obtain credentials

  - CVE-2015-7981: libpng could allow a remote attacker to     obtain sensitive information, caused by an out-of-bounds     read in the png_convert_to_rfc1123 function. An attacker     could exploit this vulnerability to obtain sensitive     information

  - CVE-2015-8126: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8472: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8540: libpng is vulnerable to a buffer     overflow, caused by a read underflow in     png_check_keyword in pngwutil.c. By sending an overly     long argument, a remote attacker could overflow a buffer     and execute arbitrary code on the system or cause the     application to crash.

  - CVE-2016-0402: An unspecified vulnerability related to     the Networking component has no confidentiality impact,     partial integrity impact, and no availability impact

  - CVE-2016-0448: An unspecified vulnerability related to     the JMX component could allow a remote attacker to     obtain sensitive information

  - CVE-2016-0466: An unspecified vulnerability related to     the JAXP component could allow a remote attacker to     cause a denial of service

  - CVE-2016-0483: An unspecified vulnerability related to     the AWT component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

  - CVE-2016-0494: An unspecified vulnerability related to     the 2D component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

The following bugs were fixed :

  - bsc#960402: resolve package conflicts in devel package

  - bsc#960286: resolve package conflicts in the fonts     subpackage

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update OpenJDK to 7u95 / IcedTea 2.6.4 including the following fixes :

  - Security fixes

  - S8059054, CVE-2016-0402: Better URL processing

  - S8130710, CVE-2016-0448: Better attributes processing

  - S8132210: Reinforce JMX collector internals

  - S8132988: Better printing dialogues

  - S8133962, CVE-2016-0466: More general limits

  - S8137060: JMX memory management improvements

  - S8139012: Better font substitutions

  - S8139017, CVE-2016-0483: More stable image decoding

  - S8140543, CVE-2016-0494: Arrange font actions

  - S8143185: Cleanup for handling proxies

  - S8143941, CVE-2015-8126, CVE-2015-8472: Update     splashscreen displays

  - S8144773, CVE-2015-7575: Further reduce use of MD5     (SLOTH)

  - S8142882, CVE-2015-4871: rebinding of the receiver of a     DirectMethodHandle may allow a protected method to be     accessed

  - Import of OpenJDK 7 u95 build 0

  - S7167988: PKIX CertPathBuilder in reverse mode doesn't     work if more than one trust anchor is specified

  - S8068761: [TEST_BUG]     java/nio/channels/ServerSocketChannel/AdaptServerSocket.
    java failed with SocketTimeoutException

  - S8074068: Cleanup in     src/share/classes/sun/security/x509/

  - S8075773: jps running as root fails after the fix of     JDK-8050807

  - S8081297: SSL Problem with Tomcat

  - S8131181: Increment minor version of HSx for 7u95 and     initialize the build number

  - S8132082: Let OracleUcrypto accept RSAPrivateKey

  - S8134605: Partial rework of the fix for 8081297

  - S8134861: XSLT: Extension func call cause exception if     namespace URI contains partial package name

  - S8135307: CompletionFailure thrown when calling     FieldDoc.type, if the field's type is missing

  - S8138716: (tz) Support tzdata2015g

  - S8140244: Port fix of JDK-8075773 to MacOSX

  - S8141213: [Parfait]Potentially blocking function     GetArrayLength called in JNI critical region at line 239     of jdk/src/share/native/sun/awt/image/jpeg/jpegdecoder.c     in function GET_ARRAYS

  - S8141287: Add MD5 to jdk.certpath.disabledAlgorithms -     Take 2

  - S8142928: [TEST_BUG]     sun/security/provider/certpath/ReverseBuilder/ReverseBui     ld.java 8u71 failure

  - S8143132: L10n resource file translation update

  - S8144955: Wrong changes were pushed with 8143942

  - S8145551: Test failed with Crash for Improved font     lookups

  - S8147466: Add -fno-strict-overflow to     IndicRearrangementProcessor(,2).cpp

  - Backports

  - S8140244: Port fix of JDK-8075773 to AIX

  - S8133196, PR2712, RH1251935: HTTPS hostname invalid     issue with InetAddress

  - S8140620, PR2710: Find and load default.sf2 as the     default soundbank on Linux

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494)

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR9-FP30 release. All running instances of IBM Java must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201610-08 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK. Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, or cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0057 advisory.

  - libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (CVE-2015-8126,     CVE-2015-8472)

  - OpenJDK: URL deserialization inconsistencies (Networking, 8059054) (CVE-2016-0402)

  - OpenJDK: logging of RMI connection secrets (JMX, 8130710) (CVE-2016-0448)

  - OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) (CVE-2016-0466)

  - OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) (CVE-2016-0483)

  - ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) (CVE-2016-0494)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 71, 7 Update 95, or 6 Update 111. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - AWT
 - JAXP
 - JMX
 - Libraries
 - Networking
 - Security

ID	Name	Product	Family	Published	Updated	Severity
88062	CentOS 6 : java-1.7.0-openjdk (CESA-2016:0053) (SLOTH)	Nessus	CentOS Local Security Checks	1/22/2016	1/4/2021	medium
88080	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20160121) (SLOTH)	Nessus	Scientific Linux Local Security Checks	1/22/2016	1/14/2021	medium
88555	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2016:0099) (SLOTH)	Nessus	Red Hat Local Security Checks	2/3/2016	10/24/2019	critical
119974	SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0428-1) (SLOTH)	Nessus	SuSE Local Security Checks	1/2/2019	1/6/2021	critical
88540	openSUSE Security Update : Java7 (openSUSE-2016-110) (SLOTH)	Nessus	SuSE Local Security Checks	2/3/2016	1/19/2021	high
88556	RHEL 5 : java-1.7.0-ibm (RHSA-2016:0100) (SLOTH)	Nessus	Red Hat Local Security Checks	2/3/2016	10/24/2019	critical
88709	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0431-1) (SLOTH)	Nessus	SuSE Local Security Checks	2/12/2016	1/19/2021	critical
94085	GLSA-201610-08 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/17/2016	1/11/2021	critical
88076	RHEL 7 : java-1.6.0-sun (RHSA-2016:0057)	Nessus	Red Hat Local Security Checks	1/22/2016	4/24/2024	high
700654	Oracle Java SE 6 < Update 111 / 7 < Update 95 / 8 < Update 71 Multiple Vulnerabilities (January 2016 CPU) (SLOTH)	Nessus Network Monitor	Web Clients	5/2/2019	5/17/2019	critical

Detections

Analytics

Plugins Search

medium

medium

critical

critical

high

critical

critical

critical

high

critical