Red Hat Security Advisory

RHSA-2014:1882

java-1.7.0-ibm security update

Released 2014-11-20 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-demo-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-devel-1:1.7.0.8.0-1jpp.1.el6_6 +3
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-demo-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-devel-1:1.7.0.8.0-1jpp.1.el6_6 +1
Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-demo-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-devel-1:1.7.0.8.0-1jpp.1.el6_6 +3
Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.0-ibm-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-demo-1:1.7.0.8.0-1jpp.1.el6_6, java-1.7.0-ibm-devel-1:1.7.0.8.0-1jpp.1.el6_6 +3

Fixes 19 records

TI-2014-02890 CVE-2014-3566 · GHSA-r82h-wc4x-gcp9

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses…

MEDIUM 62

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a…

CVSS 3.1LOW 3.4 Network No auth User interaction EPSS 0.99999 Published 2014-10-15 Partial fix CWE-329

TI-2014-05382 CVE-2014-6532 · GHSA-9x5w-fgxg-c345

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers…

MEDIUM 48

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CV…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04808 Published 2014-10-15 Fixed

TI-2014-05353 CVE-2014-6503 · GHSA-wqrv-8v5g-pgqj

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers…

MEDIUM 48

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04808 Published 2014-10-15 Fixed

TI-2014-05306 CVE-2014-6456 · GHSA-9vh2-rrjh-87xm

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to…

MEDIUM 47

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04536 Published 2014-10-15 Fixed

TI-2014-05343 CVE-2014-6493 · GHSA-x9c3-pfjg-6f43

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers…

MEDIUM 41

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.04884 Published 2014-10-15 Fixed

TI-2014-03510 CVE-2014-4288 · GHSA-jvx7-35cg-w97r

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers…

MEDIUM 41

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.04884 Published 2014-10-15 Fixed

TI-2014-05342 CVE-2014-6492 · GHSA-7h35-9873-jvrx

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on…

MEDIUM 40

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.03886 Published 2014-10-15 Fixed

TI-2014-05356 CVE-2014-6506 · GHSA-4mgp-qq86-9gj5

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE…

LOW 36

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.03317 Published 2014-10-15 Fixed

TI-2014-05308 CVE-2014-6458 · GHSA-vv95-2f9w-r389

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to…

LOW 31

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00417 Published 2014-10-15 Fixed

TI-2014-02447 CVE-2014-3065 · GHSA-7f48-7whf-6c52

Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2…

LOW 31

Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local…

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00559 Published 2014-12-02 Fixed CWE-94

TI-2014-05361 CVE-2014-6511 · GHSA-vv94-8r3c-gfw5

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04053 Published 2014-10-15 Partial fix

TI-2014-05365 CVE-2014-6515 · GHSA-j2pm-q44p-cjf6

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers…

LOW 29

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03429 Published 2014-10-15 Fixed

TI-2014-05326 CVE-2014-6476 · GHSA-ggwq-56q5-rxg8

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to…

LOW 29

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03429 Published 2014-10-15 Fixed

TI-2014-05381 CVE-2014-6531 · GHSA-795p-mp4f-mp92

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE…

LOW 26

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03041 Published 2014-10-15 Fixed

TI-2014-05362 CVE-2014-6512 · GHSA-hrpq-wp36-q3q3

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE…

LOW 26

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03041 Published 2014-10-15 Fixed

TI-2014-05307 CVE-2014-6457 · GHSA-5m53-6w9m-xpwf

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE…

LOW 25

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSS…

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.03517 Published 2014-10-15 Fixed

TI-2014-05408 CVE-2014-6558 · GHSA-x23w-8crm-5546

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE…

LOW 19

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.03137 Published 2014-10-15 Fixed

TI-2014-05377 CVE-2014-6527 · GHSA-9jm9-fhq7-3xp9

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to…

LOW 19

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.03089 Published 2014-10-15 Fixed

TI-2014-05352 CVE-2014-6502 · GHSA-ghvq-8j98-8h72

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE…

LOW 19

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.03089 Published 2014-10-15 Fixed