Red Hat Security Advisory

RHSA-2015:1006

java-1.6.0-ibm security update

Released 2015-05-13 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.16.4-1jpp.1.el5 +13
Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-demo-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-devel-1:1.6.0.16.4-1jpp.1.el6_6 +4
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-demo-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-devel-1:1.6.0.16.4-1jpp.1.el6_6 +2
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el5.i386, java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el5.ppc +21
Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-demo-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-devel-1:1.6.0.16.4-1jpp.1.el6_6 +6
Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-demo-1:1.6.0.16.4-1jpp.1.el6_6, java-1.6.0-ibm-devel-1:1.6.0.16.4-1jpp.1.el6_6 +4

Fixes 13 records

TI-2015-00431 CVE-2015-0469 · GHSA-23mh-jxf4-vm3h

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote…

MEDIUM 58

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06408 Published 2015-04-16 Partial fix

TI-2015-02479 CVE-2015-2808 · GHSA-jcj6-c96p-jcmm

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly…

MEDIUM 56

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recover…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.73851 Published 2015-04-01 Partial fix CWE-327

TI-2015-00164 CVE-2015-0192 · GHSA-3q8x-6m7c-5p98

Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6…

MEDIUM 56

Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors rela…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04059 Published 2015-07-02 Fixed CWE-269

TI-2015-00452 CVE-2015-0491 · GHSA-2fc3-hgx7-wphv

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX…

MEDIUM 51

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05572 Published 2015-04-16 Fixed

TI-2015-00421 CVE-2015-0459 · GHSA-g8gr-6v75-xhc5

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX…

MEDIUM 51

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different v…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0572 Published 2015-04-16 Fixed

TI-2015-00420 CVE-2015-0458 · GHSA-3987-vfrq-6p9c

Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote…

MEDIUM 41

Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.04954 Published 2015-04-16 Fixed

TI-2015-00442 CVE-2015-0480 · GHSA-vhvr-cgg2-5j24

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote…

LOW 32

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.03091 Published 2015-04-16 Fixed

TI-2005-01018 CVE-2005-1080 · GHSA-g7vc-f4x5-69xx

Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK…

LOW 32

Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05846 Published 2005-04-12 Fixed

TI-2015-01720 CVE-2015-1914 · GHSA-f6r5-5pp4-r7jw

IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0…

LOW 30

IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the J…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04009 Published 2015-07-02 Fixed CWE-200

TI-2015-00449 CVE-2015-0488 · GHSA-942j-rfmc-q4mq

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit…

LOW 29

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03629 Published 2015-04-16 Fixed

TI-2015-00440 CVE-2015-0478 · GHSA-gp6q-r5x8-3f6p

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit…

LOW 25

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02833 Published 2015-04-16 Fixed

TI-2015-00439 CVE-2015-0477 · GHSA-gjp3-335p-r7fw

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote…

LOW 25

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02833 Published 2015-04-16 Fixed

TI-2015-00129 CVE-2015-0138 · GHSA-wff6-5qmg-74j3

GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1…

LOW 25

GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Director…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02795 Published 2015-03-25 Fixed CWE-310