Red Hat Security AdvisoryRHSA-2017:1221
java-1.7.1-ibm security update
Released 2017-05-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.1.el7_3 +3
- Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.1.el7_3 +1
- Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.2.el6_9 +3
- Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.2.el6_9 +1
- Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.2.el6_9 +3
- Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3.ppc, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.1.el7_3 +6
- Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.2.el6_9, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.2.el6_9 +3
- Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.1.el7_3, java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.1.el7_3 +3
Fixes 10 records
Priority MEDIUM 59
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0755 · Published 2017-05-23 · Fixed
Priority MEDIUM 51
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05766 · Published 2017-05-23 · Fixed
Priority MEDIUM 48
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.05204 · Published 2017-05-23 · Fixed CWE-1335
Priority MEDIUM 48
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04875 · Published 2017-05-23 · Fixed
Priority MEDIUM 42
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data.
CVSS 3.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.03632 · Published 2017-05-22 · Fixed CWE-611
Priority LOW 37
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE).
CVSS 3.0HIGH 7.7· Local · No auth · User interaction · EPSS 0.0079 · Published 2017-04-24 · Partial fix
Priority LOW 24
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
CVSS 3.0MEDIUM 4.2· Network · No auth · User interaction · EPSS 0.02493 · Published 2017-04-24 · Partial fix
Priority LOW 23
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.02991 · Published 2017-04-24 · Partial fix
Priority LOW 22
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.0198 · Published 2017-04-24 · Partial fix
Priority LOW 19
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security).
CVSS 3.0LOW 3.1· Network · No auth · User interaction · EPSS 0.01993 · Published 2017-04-24 · Partial fix
THREATIST.IORead the docs