Red Hat Security Advisory

RHSA-2017:1216

java-1.7.1-ibm security update

Released 2017-05-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8, java-1.7.1-ibm-devel-1:1.7.1.4.1-1jpp.1.el6_8
Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8, java-1.7.1-ibm-devel-1:1.7.1.4.1-1jpp.1.el6_8

Fixes 31 records

TI-2016-02888 CVE-2016-3427 · GHSA-php4-mj74-f79r

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77…

CRITICAL 100KEV

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.92334 Published 2016-04-21 Fixed CWE-284

TI-2016-01993 CVE-2016-2183 · GHSA-w2rw-pv8p-h9c8

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other…

HIGH 83

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obt…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.94697 Published 2016-09-01 Partial fix CWE-200

TI-2017-02441 CVE-2017-3241 · GHSA-j64j-5jrj-hggj

Improper input validation in Oracle Java SE

HIGH 66

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI).

CVSS 3.0CRITICAL 9.0 Network No auth No interaction EPSS 0.32839 Published 2017-01-27 Fixed CWE-20

TI-2016-03058 CVE-2016-3598 · GHSA-vpvv-5xj9-pv4q

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote…

MEDIUM 52

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than C…

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.0669 Published 2016-07-21 Fixed

TI-2016-04822 CVE-2016-5556 · GHSA-h296-rv9c-3fhw

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote…

MEDIUM 51

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.04885 Published 2016-10-25 Fixed CWE-284

TI-2016-02903 CVE-2016-3443 · GHSA-wf68-w3c3-xjhm

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers…

MEDIUM 51

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.05479 Published 2016-04-21 Fixed

TI-2016-00616 CVE-2016-0687 · GHSA-xvgm-5834-vp34

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded…

MEDIUM 50

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.0472 Published 2016-04-21 Fixed

TI-2016-00615 CVE-2016-0686 · GHSA-99gg-jjjf-pjc8

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded…

MEDIUM 50

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.0472 Published 2016-04-21 Fixed

TI-2017-02489 CVE-2017-3289 · GHSA-9wpw-6vg5-7w9g

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 48

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.02463 Published 2017-01-27 Fixed

TI-2017-02472 CVE-2017-3272 · GHSA-c84v-7x2r-5mvq

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 48

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.02997 Published 2017-01-27 Fixed

TI-2017-02453 CVE-2017-3253 · GHSA-4cjw-q36g-5wch

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

MEDIUM 45

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03868 Published 2017-01-27 Fixed

TI-2016-04813 CVE-2016-5546 · GHSA-rrgr-g95w-822m

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

MEDIUM 45

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03167 Published 2017-01-27 Fixed

TI-2016-02909 CVE-2016-3449 · GHSA-v7xg-gp2r-hx5f

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers…

MEDIUM 45

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.

CVSS 3.0HIGH 8.3 Network No auth User interaction EPSS 0.04009 Published 2016-04-21 Fixed

TI-2016-04839 CVE-2016-5573 · GHSA-xpxv-6ccf-795w

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded…

MEDIUM 44

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulne…

CVSS 3.0HIGH 8.3 Network No auth User interaction EPSS 0.03255 Published 2016-10-25 Fixed CWE-264

TI-2016-00334 CVE-2016-0376 · GHSA-j9hc-g284-326f

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6…

MEDIUM 44

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 be…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.05695 Published 2016-06-03 Fixed

TI-2016-00322 CVE-2016-0363 · GHSA-p824-48mj-5qcc

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before…

MEDIUM 42

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.03983 Published 2016-06-03 Fixed CWE-20

TI-2016-04814 CVE-2016-5547 · GHSA-xr6v-8g67-wwxp

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 36

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.03533 Published 2017-01-27 Fixed

TI-2016-02971 CVE-2016-3511 · GHSA-jx5q-93x8-83cj

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect…

LOW 36

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.

CVSS 3.0HIGH 7.7 Local No auth User interaction EPSS 0.00507 Published 2016-07-21 Fixed

TI-2016-04818 CVE-2016-5552 · GHSA-c62w-9mvr-73gf

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 35

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02729 Published 2017-01-27 Fixed

TI-2016-04816 CVE-2016-5549 · GHSA-4p8w-9rpg-4mhm

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 35

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.03144 Published 2017-01-27 Fixed

TI-2016-04815 CVE-2016-5548 · GHSA-m9ww-jj36-frjp

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 34

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02972 Published 2017-01-27 Fixed

TI-2016-04863 CVE-2016-5597 · GHSA-6q5r-8qc5-j49x

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded…

LOW 33

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.03937 Published 2016-10-25 Fixed CWE-200

TI-2016-00232 CVE-2016-0264 · GHSA-3p6j-59jx-xr88

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6…

LOW 32

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8…

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.03925 Published 2016-05-24 Fixed CWE-119

TI-2017-02452 CVE-2017-3252 · GHSA-942v-9xcr-5cqh

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 30

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAAS).

CVSS 3.0MEDIUM 5.8 Network Low privileges User interaction EPSS 0.01933 Published 2017-01-27 Fixed

TI-2016-04820 CVE-2016-5554 · GHSA-6cr3-4q7p-67qc

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded…

LOW 26

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.03097 Published 2016-10-25 Fixed

TI-2017-02461 CVE-2017-3261 · GHSA-4cvq-qgfc-6fqx

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 25

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.02499 Published 2017-01-27 Fixed

TI-2016-02883 CVE-2016-3422 · GHSA-c95q-vf7r-wm72

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers…

LOW 25

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect availability via vectors related to 2D.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.02802 Published 2016-04-21 Fixed

TI-2017-02431 CVE-2017-3231 · GHSA-25f7-696r-m32w

Information disclosure in Oracle Java SE

LOW 24

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.02166 Published 2017-01-27 Fixed CWE-200

TI-2017-02459 CVE-2017-3259 · GHSA-2fjh-pp98-gvch

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).

LOW 22

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).

CVSS 3.0LOW 3.7 Network No auth No interaction EPSS 0.02162 Published 2017-01-27 Fixed

TI-2016-04809 CVE-2016-5542 · GHSA-gjxp-f524-fgrv

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded…

LOW 20

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.

CVSS 3.0LOW 3.1 Network No auth User interaction EPSS 0.02793 Published 2016-10-25 Fixed

TI-2016-02887 CVE-2016-3426 · GHSA-3mj4-w4vq-39pp

Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote…

LOW 20

Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 3.0LOW 3.1 Network No auth User interaction EPSS 0.02795 Published 2016-04-21 Fixed