Red Hat Security Advisory

RHSA-2014:0026

java-1.7.0-openjdk security update

Released 2014-01-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5
Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el6_5 +2
Red Hat Enterprise Linux HPC Node (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5
Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el6_5 +2
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el6_5
Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el6_5
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el6_5
Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el6_5, java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el6_5

Fixes 15 records

TI-2013-05042 CVE-2013-5907 · GHSA-f4vm-g8q2-m52q

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and…

MEDIUM 54

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unk…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0816 Published 2014-01-15 Partial fix

TI-2014-00407 CVE-2014-0428 · GHSA-26mx-fqqx-jrm9

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

MEDIUM 52

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06126 Published 2014-01-15 Fixed

TI-2014-00401 CVE-2014-0422 · GHSA-9m4w-3pwq-4rhj

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

MEDIUM 52

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06126 Published 2014-01-15 Fixed

TI-2013-05029 CVE-2013-5893 · GHSA-q5hj-g9q3-fcqh

Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK…

MEDIUM 48

Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05262 Published 2014-01-15 Fixed

TI-2014-00353 CVE-2014-0373 · GHSA-r3gh-pvf4-6v4v

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows…

MEDIUM 40

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04287 Published 2014-01-15 Fixed

TI-2013-05014 CVE-2013-5878 · GHSA-v5jp-9wvr-f556

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and…

MEDIUM 40

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04312 Published 2014-01-15 Fixed

TI-2014-00402 CVE-2014-0423 · GHSA-3pf2-g488-cwrg

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and…

LOW 31

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unkno…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.03661 Published 2014-01-15 Fixed

TI-2014-00395 CVE-2014-0416 · GHSA-jj69-rwgw-8vmj

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04056 Published 2014-01-15 Fixed

TI-2013-05032 CVE-2013-5896 · GHSA-7v64-rv29-rwhf

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04344 Published 2014-01-15 Fixed

TI-2014-00356 CVE-2014-0376 · GHSA-vw24-mx3m-5g44

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03826 Published 2014-01-15 Fixed

TI-2014-00348 CVE-2014-0368 · GHSA-q4xg-x575-6r33

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03854 Published 2014-01-15 Fixed

TI-2013-05045 CVE-2013-5910 · GHSA-7rr9-w99c-9r9h

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and…

LOW 29

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03826 Published 2014-01-15 Fixed

TI-2013-05020 CVE-2013-5884 · GHSA-3q7r-xm4q-jhg9

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality via vectors related to CORBA.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03854 Published 2014-01-15 Fixed

TI-2013-04023 CVE-2013-4578 · GHSA-6xg2-jpwh-hh9f

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a…

LOW 29

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.025 Published 2017-12-29 Fixed CWE-74

TI-2014-00390 CVE-2014-0411 · GHSA-mqjj-vv82-vh6r

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and…

LOW 23

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.02348 Published 2014-01-15 Fixed