Red Hat Security Advisory

RHSA-2014:0889

java-1.7.0-openjdk security update

Released 2014-07-16 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-headless-1:1.7.0.65-2.5.1.2.el7_0
Red Hat Enterprise Linux Client Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el7_0 +2
Red Hat Enterprise Linux ComputeNode (v. 7) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-headless-1:1.7.0.65-2.5.1.2.el7_0
Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el7_0 +2
Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5
Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el6_5 +2
Red Hat Enterprise Linux HPC Node (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5
Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el6_5 +2
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-javadoc-1:1.7.0.65-2.5.1.2.el6_5
Red Hat Enterprise Linux Server (v. 7) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-headless-1:1.7.0.65-2.5.1.2.el7_0
Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-src-1:1.7.0.65-2.5.1.2.el6_5
Red Hat Enterprise Linux Server Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-javadoc-1:1.7.0.65-2.5.1.2.el7_0 +1
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-javadoc-1:1.7.0.65-2.5.1.2.el6_5
Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-devel-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-headless-1:1.7.0.65-2.5.1.2.el7_0
Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el6_5, java-1.7.0-openjdk-src-1:1.7.0.65-2.5.1.2.el6_5
Red Hat Enterprise Linux Workstation Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-demo-1:1.7.0.65-2.5.1.2.el7_0, java-1.7.0-openjdk-javadoc-1:1.7.0.65-2.5.1.2.el7_0 +1

Fixes 13 records

TI-2014-03487 CVE-2014-4262 · GHSA-ffj9-frgf-p668

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote…

MEDIUM 49

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05577 Published 2014-07-17 Fixed

TI-2014-03444 CVE-2014-4219 · GHSA-2xqm-8vg5-2563

Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers…

MEDIUM 49

Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05577 Published 2014-07-17 Fixed

TI-2014-01999 CVE-2014-2490 · GHSA-5vjw-xx6j-g68j

Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5…

MEDIUM 49

Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06118 Published 2014-07-17 Fixed

TI-2014-03448 CVE-2014-4223 · GHSA-x77f-3hr5-3569

Unspecified vulnerability in Oracle Java SE 7u60 allows remote attackers to affect…

MEDIUM 48

Unspecified vulnerability in Oracle Java SE 7u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-2483.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04751 Published 2014-07-17 Fixed

TI-2014-03441 CVE-2014-4216 · GHSA-5rv2-7w2c-4mcq

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote…

MEDIUM 48

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0536 Published 2014-07-17 Fixed

TI-2014-01992 CVE-2014-2483 · GHSA-9pmr-9fpq-fq64

Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and…

MEDIUM 48

Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a d…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05233 Published 2014-07-17 Fixed

TI-2014-03434 CVE-2014-4209 · GHSA-r9j2-2c3g-m8hv

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote…

LOW 35

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03826 Published 2014-07-17 Fixed

TI-2014-03491 CVE-2014-4266 · GHSA-g7wm-p554-cmgm

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to…

LOW 30

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04056 Published 2014-07-17 Partial fix

TI-2014-03477 CVE-2014-4252 · GHSA-x8j3-h997-4f6g

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04086 Published 2014-07-17 Fixed

TI-2014-03443 CVE-2014-4218 · GHSA-7qv6-5jq4-2xp7

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03826 Published 2014-07-17 Fixed

TI-2014-03446 CVE-2014-4221 · GHSA-9r43-hq7q-4qmr

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to…

LOW 26

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03482 Published 2014-07-17 Fixed

TI-2014-03488 CVE-2014-4263 · GHSA-5p67-pmrc-9vx3

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit…

LOW 25

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key…

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.03501 Published 2014-07-17 Fixed

TI-2014-03469 CVE-2014-4244 · GHSA-wh23-xv82-6pg8

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit…

LOW 25

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.03501 Published 2014-07-17 Fixed