Red Hat Security Advisory

RHSA-2009:1694

java-1.6.0-ibm security update

Released 2009-12-23 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.ppc +18
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.7-1jpp.2.el5 +13
Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.ppc +21
Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11

Fixes 14 records

TI-2009-03392 CVE-2009-3555 · GHSA-f7w7-6pjc-wwm6

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft…

CRITICAL 91

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87264 Published 2009-11-09 Fixed in 7.0.10, 6.0.32 +1 CWE-300

TI-2009-03675 CVE-2009-3867 · GHSA-h62j-9mvm-r9mf

Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK…

HIGH 78

Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.73193 Published 2009-11-05 Fixed CWE-119

TI-2009-03677 CVE-2009-3869 · GHSA-xf34-q2g4-cjm6

Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit…

HIGH 76

Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JR…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.65353 Published 2009-11-05 Fixed CWE-119

TI-2009-03681 CVE-2009-3874 · GHSA-pf3m-9ffm-83vh

Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun…

MEDIUM 52

Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote att…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09498 Published 2009-11-05 Fixed CWE-189

TI-2009-03673 CVE-2009-3865 · GHSA-vm5p-j4c4-475p

The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in…

MEDIUM 52

The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09401 Published 2009-11-05 Fixed CWE-94

TI-2009-03678 CVE-2009-3871 · GHSA-w956-24m6-883w

Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit…

MEDIUM 50

Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06817 Published 2009-11-05 Fixed CWE-119

TI-2009-03674 CVE-2009-3866 · GHSA-768x-w4jc-f2gp

The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not…

MEDIUM 49

The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code b…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06182 Published 2009-11-05 Fixed CWE-264

TI-2009-03680 CVE-2009-3873 · GHSA-jgrv-c256-j463

The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6…

MEDIUM 47

The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04195 Published 2009-11-05 Fixed CWE-119

TI-2009-03679 CVE-2009-3872 · GHSA-hvww-vwv6-cwhq

Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0…

MEDIUM 47

Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remot…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04246 Published 2009-11-05 Fixed

TI-2009-03676 CVE-2009-3868 · GHSA-4vcf-rm59-vhrv

Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and…

MEDIUM 47

Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attack…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04246 Published 2009-11-05 Fixed CWE-119

TI-2009-00202 CVE-2009-0217 · GHSA-8hfm-837h-hjg5

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as…

LOW 32

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4,…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06363 Published 2009-07-14 Fixed in 1.4.3

TI-2009-03684 CVE-2009-3877 · GHSA-23vf-7h8p-j4qp

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE…

LOW 31

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a de…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04905 Published 2009-11-05 Fixed CWE-399

TI-2009-03683 CVE-2009-3876 · GHSA-6cmw-6629-4xwg

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE…

LOW 29

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03475 Published 2009-11-05 Fixed CWE-399

TI-2009-03682 CVE-2009-3875 · GHSA-p88x-7ffg-vgpw

The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in…

LOW 29

The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03168 Published 2009-11-05 Fixed CWE-310