Red Hat Security Advisory

RHSA-2015:1920

java-1.7.0-openjdk security update

Released 2015-10-21 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-headless-1:1.7.0.91-2.6.2.1.el7_1
Red Hat Enterprise Linux Client Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.1.el7_1 +2
Red Hat Enterprise Linux ComputeNode (v. 7) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-headless-1:1.7.0.91-2.6.2.1.el7_1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.1.el7_1 +2
Red Hat Enterprise Linux Desktop (v. 6) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-javadoc-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-src-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux HPC Node (v. 6) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-javadoc-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-src-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux Server (v. 6) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux Server (v. 7) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.1.ael7b_1, java-1.7.0-openjdk-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.1.ael7b_1 +3
Red Hat Enterprise Linux Server Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-javadoc-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-src-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux Server Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.91-2.6.2.1.ael7b_1, java-1.7.0-openjdk-accessibility-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.1.ael7b_1 +5
Red Hat Enterprise Linux Workstation (v. 6) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-openjdk-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-devel-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-headless-1:1.7.0.91-2.6.2.1.el7_1
Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-javadoc-1:1.7.0.91-2.6.2.2.el6_7, java-1.7.0-openjdk-src-1:1.7.0.91-2.6.2.2.el6_7
Red Hat Enterprise Linux Workstation Optional (v. 7) java-1.7.0-openjdk-accessibility-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-demo-1:1.7.0.91-2.6.2.1.el7_1, java-1.7.0-openjdk-javadoc-1:1.7.0.91-2.6.2.1.el7_1 +1

Fixes 17 records

TI-2015-04063 CVE-2015-4843 · GHSA-5hrw-33cx-6w79

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 60

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.08934 Published 2015-10-21 Fixed

TI-2015-04064 CVE-2015-4844 · GHSA-2rrf-qm4c-8229

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 59

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07514 Published 2015-10-21 Partial fix

TI-2015-04055 CVE-2015-4835 · GHSA-hw42-jfwx-84h9

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 58

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06416 Published 2015-10-21 Partial fix

TI-2015-04101 CVE-2015-4883 · GHSA-vw5f-vf9g-7xvr

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2015-04099 CVE-2015-4881 · GHSA-m97c-9fgv-888f

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2015-04078 CVE-2015-4860 · GHSA-x59v-wff7-pprc

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2015-04027 CVE-2015-4805 · GHSA-cq64-ppmj-mrvv

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2015-04028 CVE-2015-4806 · GHSA-wp67-hpr4-56mq

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 42

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03412 Published 2015-10-21 Fixed

TI-2015-04110 CVE-2015-4893 · GHSA-g9px-7f52-qj47

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04637 Published 2015-10-21 Partial fix

TI-2015-04062 CVE-2015-4842 · GHSA-phv4-p2cw-7frr

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04082 Published 2015-10-21 Partial fix

TI-2015-04025 CVE-2015-4803 · GHSA-8p8r-6fqw-9vx7

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 36

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04637 Published 2015-10-21 Partial fix

TI-2015-03956 CVE-2015-4734 · GHSA-w858-6895-v667

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04116 Published 2015-10-21 Partial fix

TI-2015-04127 CVE-2015-4911 · GHSA-cpw3-m2c6-7wch

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 35

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03907 Published 2015-10-21 Partial fix

TI-2015-04119 CVE-2015-4903 · GHSA-wx9q-j373-mc8m

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03438 Published 2015-10-21 Fixed

TI-2015-04100 CVE-2015-4882 · GHSA-rpc4-6m39-x2wh

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03875 Published 2015-10-21 Partial fix

TI-2015-04090 CVE-2015-4872 · GHSA-hvr5-v3pf-2jmv

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03218 Published 2015-10-21 Fixed

TI-2015-04060 CVE-2015-4840 · GHSA-24cm-p92g-3mhv

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51…

LOW 35

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03438 Published 2015-10-21 Partial fix