Red Hat Security Advisory

RHSA-2015:0079

java-1.7.0-oracle security update

Released 2015-01-22 · Red Hat rating Critical · View on Red Hat →

Fixed in

Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.7.0-oracle-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.2.el7 +3
Oracle Java for Red Hat Enterprise Linux Client 5 java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el5_11, java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el5_11.i586, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.1.el5_11 +9
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.7.0-oracle-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.2.el7 +1
Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.1.el6 +3
Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.1.el6 +3
Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.7.0-oracle-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.2.el7 +3
Oracle Java for Red Hat Enterprise Linux Server 5 java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el5_11, java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el5_11.i586, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.1.el5_11 +9
Oracle Java for Red Hat Enterprise Linux Server 6 java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.1.el6 +3
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-oracle-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.2.el7 +3
Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.7.0-oracle-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-devel-1:1.7.0.75-1jpp.1.el6, java-1.7.0-oracle-javafx-1:1.7.0.75-1jpp.1.el6 +3

Fixes 15 records

TI-2014-02890 CVE-2014-3566 · GHSA-r82h-wc4x-gcp9

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses…

MEDIUM 62

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a…

CVSS 3.1LOW 3.4 Network No auth User interaction EPSS 0.99999 Published 2014-10-15 Partial fix CWE-329

TI-2014-05443 CVE-2014-6593 · GHSA-fpfc-8gg5-hw57

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE…

MEDIUM 55

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related t…

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.66374 Published 2015-01-21 Fixed

TI-2015-00372 CVE-2015-0408 · GHSA-p95j-84hm-vv9m

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote…

MEDIUM 53

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06877 Published 2015-01-21 Fixed

TI-2014-05451 CVE-2014-6601 · GHSA-cp93-48x3-6m3g

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers…

MEDIUM 53

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06877 Published 2015-01-21 Fixed

TI-2015-00359 CVE-2015-0395 · GHSA-7w4x-vjmm-65hg

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote…

MEDIUM 49

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05909 Published 2015-01-21 Fixed

TI-2015-00376 CVE-2015-0412 · GHSA-5rmc-hxjg-x3qp

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.01459 Published 2015-01-21 Fixed

TI-2015-00370 CVE-2015-0406 · GHSA-9vj8-hjc2-m5vp

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers…

LOW 33

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.03899 Published 2015-01-21 Fixed

TI-2015-00374 CVE-2015-0410 · GHSA-52j6-f8wf-g688

Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle…

LOW 31

Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affe…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05032 Published 2015-01-21 Fixed

TI-2015-00367 CVE-2015-0403 · GHSA-gvqf-ccjr-pp89

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to…

LOW 31

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00437 Published 2015-01-21 Fixed

TI-2015-00371 CVE-2015-0407 · GHSA-gr6w-54mw-4jfq

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote…

LOW 30

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04351 Published 2015-01-21 Fixed

TI-2015-00347 CVE-2015-0383 · GHSA-mh42-q7jv-64p4

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE…

LOW 25

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related…

CVSS 2.0MEDIUM 5.4 Local No auth Interaction — EPSS 0.00453 Published 2015-01-21 Fixed

TI-2014-05441 CVE-2014-6591 · GHSA-7hw8-8c2x-83rg

Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72…

LOW 20

Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-20…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.0405 Published 2015-01-21 Partial fix

TI-2014-05437 CVE-2014-6587 · GHSA-6v6g-fc35-c9jw

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to…

LOW 20

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 4.3 Local Low privileges Interaction — EPSS 0.00405 Published 2015-01-21 Fixed

TI-2014-05435 CVE-2014-6585 · GHSA-mr97-jqw9-fp77

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote…

LOW 20

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.04297 Published 2015-01-21 Partial fix

TI-2015-00377 CVE-2015-0413 · GHSA-r2m8-6gh4-252x

Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect…

LOW 11

Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.

CVSS 2.0LOW 1.9 Local No auth Interaction — EPSS 0.00396 Published 2015-01-21 Fixed