Red Hat Security Advisory

RHSA-2015:1229

java-1.7.0-openjdk security update

Released 2015-07-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-headless-1:1.7.0.85-2.6.1.2.el7_1
Red Hat Enterprise Linux Client Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.2.el7_1 +2
Red Hat Enterprise Linux ComputeNode (v. 7) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-headless-1:1.7.0.85-2.6.1.2.el7_1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.2.el7_1 +2
Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-javadoc-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-src-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux HPC Node (v. 6) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-javadoc-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-src-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux Server (v. 7) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.2.ael7b_1, java-1.7.0-openjdk-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.2.ael7b_1 +3
Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-javadoc-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-src-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux Server Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.85-2.6.1.2.ael7b_1, java-1.7.0-openjdk-accessibility-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.2.ael7b_1 +5
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-openjdk-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-headless-1:1.7.0.85-2.6.1.2.el7_1
Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-javadoc-1:1.7.0.85-2.6.1.3.el6_6, java-1.7.0-openjdk-src-1:1.7.0.85-2.6.1.3.el6_6
Red Hat Enterprise Linux Workstation Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.85-2.6.1.2.el7_1, java-1.7.0-openjdk-javadoc-1:1.7.0.85-2.6.1.2.el7_1 +1

Fixes 14 records

TI-2015-02278 CVE-2015-2590 · GHSA-mhp7-xhx6-9x45

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

CRITICAL 100KEV

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.25469 Published 2015-07-16 Fixed

TI-2015-03970 CVE-2015-4748 · GHSA-fvmj-2grm-x9mr

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and…

HIGH 70

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown ve…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.44632 Published 2015-07-16 Fixed

TI-2015-03381 CVE-2015-4000 · GHSA-v98w-p8f7-9qqf

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server…

MEDIUM 63

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgra…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.9986 Published 2015-05-21 Partial fix CWE-295

TI-2015-03982 CVE-2015-4760 · GHSA-r4j6-f9x3-8g4r

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers…

MEDIUM 59

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07039 Published 2015-07-16 Partial fix

TI-2015-03954 CVE-2015-4732 · GHSA-h7cx-3rw4-cg8f

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

MEDIUM 58

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06464 Published 2015-07-16 Fixed

TI-2015-03953 CVE-2015-4731 · GHSA-44j6-w488-fjgw

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75…

MEDIUM 58

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05772 Published 2015-07-16 Fixed

TI-2015-02316 CVE-2015-2628 · GHSA-f6p6-pp87-87wp

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

MEDIUM 58

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06198 Published 2015-07-16 Fixed

TI-2015-02479 CVE-2015-2808 · GHSA-jcj6-c96p-jcmm

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly…

MEDIUM 56

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recover…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.73851 Published 2015-04-01 Partial fix CWE-327

TI-2015-03955 CVE-2015-4733 · GHSA-fg3m-fh8c-xhjv

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

MEDIUM 52

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05772 Published 2015-07-16 Fixed

TI-2015-02309 CVE-2015-2621 · GHSA-47wq-2rqg-gf6v

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03919 Published 2015-07-16 Fixed

TI-2015-02289 CVE-2015-2601 · GHSA-gjjj-w44p-x78r

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03616 Published 2015-07-16 Fixed

TI-2015-02320 CVE-2015-2632 · GHSA-cf3m-hfmx-8m8q

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers…

LOW 30

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04419 Published 2015-07-16 Partial fix

TI-2015-03971 CVE-2015-4749 · GHSA-fcxj-c3r5-gmvr

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and…

LOW 26

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03319 Published 2015-07-16 Fixed

TI-2015-02313 CVE-2015-2625 · GHSA-r9xx-mc22-4j87

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and…

LOW 26

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.03815 Published 2015-07-16 Fixed