Red Hat Security Advisory

RHSA-2016:0101

java-1.6.0-ibm security update

Released 2016-02-02 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.16.20-1jpp.1.el5 +13
Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +4
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +2
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5.i386, java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5.ppc +21
Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +4
Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +4

Fixes 11 records

TI-2016-00436 CVE-2016-0483 · GHSA-7xjq-3wg8-c44c

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65…

MEDIUM 64

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.14714 Published 2016-01-21 Fixed

TI-2016-00447 CVE-2016-0494 · GHSA-2rw6-f687-5qwg

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java…

MEDIUM 59

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability vi…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07211 Published 2016-01-21 Fixed

TI-2015-07025 CVE-2015-8540 · GHSA-7qhq-6293-wrx3

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through…

MEDIUM 47

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote atta…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.06484 Published 2016-04-14 Partial fix CWE-189

TI-2015-04228 CVE-2015-5041 · GHSA-7v4m-8wwx-8xgc

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20…

MEDIUM 46

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.03901 Published 2016-06-06 Fixed CWE-200

TI-2015-06751 CVE-2015-8126 · GHSA-rr6q-q2jh-948f

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in…

MEDIUM 45

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow r…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.10339 Published 2015-11-13 Partial fix CWE-120

TI-2015-06985 CVE-2015-8472 · GHSA-h5hh-r95x-mmfq

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x…

MEDIUM 41

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of s…

CVSS 3.0HIGH 7.3 Network No auth No interaction EPSS 0.06054 Published 2016-01-21 Partial fix CWE-119

TI-2016-00419 CVE-2016-0466 · GHSA-v75m-88cc-6483

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in…

LOW 37

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via ve…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05453 Published 2016-01-21 Fixed

TI-2016-00356 CVE-2016-0402 · GHSA-hfgr-56jc-3hcm

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java…

LOW 36

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networ…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04644 Published 2016-01-21 Fixed

TI-2015-06633 CVE-2015-7981 · GHSA-fr3h-2jww-582m

The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before…

LOW 32

The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06359 Published 2015-11-24 Partial fix CWE-200

TI-2015-06299 CVE-2015-7575 · GHSA-7x7m-5xcm-74v2

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before…

LOW 32

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Prot…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02904 Published 2016-01-09 Partial fix CWE-19

TI-2016-00401 CVE-2016-0448 · GHSA-4wfm-8gw8-6vq9

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java…

LOW 25

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.03531 Published 2016-01-21 Fixed