Red Hat Security Advisory

RHSA-2015:1243

java-1.6.0-sun security update

Released 2015-07-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.6.0-sun-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el7_1 +3
Oracle Java for Red Hat Enterprise Linux Client 5 java-1.6.0-sun-1:1.6.0.101-1jpp.1.el5_11, java-1.6.0-sun-1:1.6.0.101-1jpp.1.el5_11.i586, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el5_11 +9
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.6.0-sun-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el7_1 +3
Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.6.0-sun-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el6_6 +3
Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.6.0-sun-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el6_6 +3
Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.6.0-sun-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el7_1 +3
Oracle Java for Red Hat Enterprise Linux Server 5 java-1.6.0-sun-1:1.6.0.101-1jpp.1.el5_11, java-1.6.0-sun-1:1.6.0.101-1jpp.1.el5_11.i586, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el5_11 +9
Oracle Java for Red Hat Enterprise Linux Server 6 java-1.6.0-sun-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el6_6 +3
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.6.0-sun-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el7_1 +3
Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.6.0-sun-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo-1:1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-devel-1:1.6.0.101-1jpp.1.el6_6 +3

Fixes 18 records

TI-2015-02278 CVE-2015-2590 · GHSA-mhp7-xhx6-9x45

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

CRITICAL 100KEV

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.25469 Published 2015-07-16 Fixed

TI-2015-03970 CVE-2015-4748 · GHSA-fvmj-2grm-x9mr

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and…

HIGH 70

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown ve…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.44632 Published 2015-07-16 Fixed

TI-2015-03381 CVE-2015-4000 · GHSA-v98w-p8f7-9qqf

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server…

MEDIUM 63

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgra…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.9986 Published 2015-05-21 Partial fix CWE-295

TI-2015-03982 CVE-2015-4760 · GHSA-r4j6-f9x3-8g4r

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers…

MEDIUM 59

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07039 Published 2015-07-16 Partial fix

TI-2015-03954 CVE-2015-4732 · GHSA-h7cx-3rw4-cg8f

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

MEDIUM 58

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06464 Published 2015-07-16 Fixed

TI-2015-03953 CVE-2015-4731 · GHSA-44j6-w488-fjgw

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75…

MEDIUM 58

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05772 Published 2015-07-16 Fixed

TI-2015-02316 CVE-2015-2628 · GHSA-f6p6-pp87-87wp

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

MEDIUM 58

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06198 Published 2015-07-16 Fixed

TI-2015-02326 CVE-2015-2638 · GHSA-6mqv-xf3m-2rgf

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java…

MEDIUM 57

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors relat…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05639 Published 2015-07-16 Fixed

TI-2015-02479 CVE-2015-2808 · GHSA-jcj6-c96p-jcmm

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly…

MEDIUM 56

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recover…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.73851 Published 2015-04-01 Partial fix CWE-327

TI-2015-03955 CVE-2015-4733 · GHSA-fg3m-fh8c-xhjv

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

MEDIUM 52

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05772 Published 2015-07-16 Fixed

TI-2015-02309 CVE-2015-2621 · GHSA-47wq-2rqg-gf6v

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03919 Published 2015-07-16 Fixed

TI-2015-02325 CVE-2015-2637 · GHSA-5v9r-5v72-fpvc

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03455 Published 2015-07-16 Fixed

TI-2015-02289 CVE-2015-2601 · GHSA-gjjj-w44p-x78r

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03616 Published 2015-07-16 Fixed

TI-2015-02352 CVE-2015-2664 · GHSA-x5gm-3hm9-cfcj

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to…

LOW 33

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00421 Published 2015-07-16 Fixed

TI-2015-02320 CVE-2015-2632 · GHSA-cf3m-hfmx-8m8q

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers…

LOW 30

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04419 Published 2015-07-16 Partial fix

TI-2015-03971 CVE-2015-4749 · GHSA-fcxj-c3r5-gmvr

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and…

LOW 26

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03319 Published 2015-07-16 Fixed

TI-2015-02313 CVE-2015-2625 · GHSA-r9xx-mc22-4j87

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and…

LOW 26

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.03815 Published 2015-07-16 Fixed

TI-2015-02315 CVE-2015-2627 · GHSA-j9mf-rg23-xfjc

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers…

LOW 25

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.02864 Published 2015-07-16 Fixed