Red Hat Security Advisory

RHSA-2014:0134

java-1.7.0-ibm security update

Released 2014-02-04 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10, java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10.i386, java-1.7.0-ibm-demo-1:1.7.0.6.1-1jpp.1.el5_10 +9
Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-demo-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-devel-1:1.7.0.6.1-1jpp.1.el6_5 +3
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-demo-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-devel-1:1.7.0.6.1-1jpp.1.el6_5 +1
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10, java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10.i386, java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10.ppc +15
Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-demo-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-devel-1:1.7.0.6.1-1jpp.1.el6_5 +3
Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-demo-1:1.7.0.6.1-1jpp.1.el6_5, java-1.7.0-ibm-devel-1:1.7.0.6.1-1jpp.1.el6_5 +3

Fixes 26 records

TI-2013-05042 CVE-2013-5907 · GHSA-f4vm-g8q2-m52q

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and…

MEDIUM 54

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unk…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0816 Published 2014-01-15 Partial fix

TI-2014-00407 CVE-2014-0428 · GHSA-26mx-fqqx-jrm9

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

MEDIUM 52

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06126 Published 2014-01-15 Fixed

TI-2014-00401 CVE-2014-0422 · GHSA-9m4w-3pwq-4rhj

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

MEDIUM 52

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06126 Published 2014-01-15 Fixed

TI-2014-00394 CVE-2014-0415 · GHSA-cqqp-93v3-9577

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

MEDIUM 52

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0624 Published 2014-01-15 Fixed

TI-2014-00389 CVE-2014-0410 · GHSA-h55x-f7m7-p9jh

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

MEDIUM 52

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0624 Published 2014-01-15 Fixed

TI-2014-00396 CVE-2014-0417 · GHSA-3vpv-9g36-x8h4

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and…

MEDIUM 48

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and Java SE Embedded 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0536 Published 2014-01-15 Fixed

TI-2013-05025 CVE-2013-5889 · GHSA-288c-8vm9-x4gr

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

MEDIUM 48

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0536 Published 2014-01-15 Fixed

TI-2014-00367 CVE-2014-0387 · GHSA-f894-vhcw-ww3j

Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on…

MEDIUM 42

Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.05406 Published 2014-01-15 Fixed

TI-2014-00403 CVE-2014-0424 · GHSA-8c58-33g9-wwwv

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

MEDIUM 40

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04393 Published 2014-01-15 Fixed

TI-2014-00353 CVE-2014-0373 · GHSA-r3gh-pvf4-6v4v

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows…

MEDIUM 40

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04287 Published 2014-01-15 Fixed

TI-2013-05014 CVE-2013-5878 · GHSA-v5jp-9wvr-f556

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and…

MEDIUM 40

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04312 Published 2014-01-15 Fixed

TI-2014-00383 CVE-2014-0403 · GHSA-654g-jrw5-fmvv

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

LOW 32

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-20…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.03482 Published 2014-01-15 Fixed

TI-2014-00355 CVE-2014-0375 · GHSA-wch9-56hq-q6hv

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

LOW 32

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.03482 Published 2014-01-15 Fixed

TI-2014-00402 CVE-2014-0423 · GHSA-3pf2-g488-cwrg

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and…

LOW 31

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unkno…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.03661 Published 2014-01-15 Fixed

TI-2014-00395 CVE-2014-0416 · GHSA-jj69-rwgw-8vmj

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04056 Published 2014-01-15 Fixed

TI-2013-05035 CVE-2013-5899 · GHSA-pw7h-wfmq-9ph4

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

LOW 30

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03927 Published 2014-01-15 Fixed

TI-2013-05032 CVE-2013-5896 · GHSA-7v64-rv29-rwhf

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04344 Published 2014-01-15 Fixed

TI-2013-05023 CVE-2013-5887 · GHSA-hcc6-h77r-jqhr

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

LOW 30

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04174 Published 2014-01-15 Fixed

TI-2014-00356 CVE-2014-0376 · GHSA-vw24-mx3m-5g44

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03826 Published 2014-01-15 Fixed

TI-2014-00348 CVE-2014-0368 · GHSA-q4xg-x575-6r33

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03854 Published 2014-01-15 Fixed

TI-2013-05045 CVE-2013-5910 · GHSA-7rr9-w99c-9r9h

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and…

LOW 29

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03826 Published 2014-01-15 Fixed

TI-2013-05020 CVE-2013-5884 · GHSA-3q7r-xm4q-jhg9

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality via vectors related to CORBA.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03854 Published 2014-01-15 Fixed

TI-2013-04023 CVE-2013-4578 · GHSA-6xg2-jpwh-hh9f

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a…

LOW 29

jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.025 Published 2017-12-29 Fixed CWE-74

TI-2013-05034 CVE-2013-5898 · GHSA-xw76-9x56-hp8j

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to…

LOW 25

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.03512 Published 2014-01-15 Fixed

TI-2014-00390 CVE-2014-0411 · GHSA-mqjj-vv82-vh6r

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and…

LOW 23

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.02348 Published 2014-01-15 Fixed

TI-2013-05024 CVE-2013-5888 · GHSA-j9h6-v4h6-47g9

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, when running with GNOME…

LOW 22

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, when running with GNOME, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 4.6 Local No auth Interaction — EPSS 0.00456 Published 2014-01-15 Fixed