Red Hat Security Advisory

RHSA-2017:2999

java-1.8.0-oracle security update

Released 2017-10-23 · Red Hat rating Critical · View on Red Hat →

Fixed in

Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.8.0-oracle-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.5.el7 +3
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.8.0-oracle-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.5.el7 +1
Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.8.0-oracle-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.1.el6 +3
Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.8.0-oracle-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.1.el6 +3
Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.8.0-oracle-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.5.el7 +3
Oracle Java for Red Hat Enterprise Linux Server 6 java-1.8.0-oracle-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.1.el6 +3
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.8.0-oracle-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.5.el7, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.5.el7 +3
Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.8.0-oracle-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-devel-1:1.8.0.151-1jpp.1.el6, java-1.8.0-oracle-javafx-1:1.8.0.151-1jpp.1.el6 +3

Fixes 21 records

TI-2016-07970 CVE-2016-9841 · GHSA-5f8r-846v-423w

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…

MEDIUM 59

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0755 Published 2017-05-23 Fixed

TI-2016-07972 CVE-2016-9843 · GHSA-q27x-567x-5347

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers…

MEDIUM 51

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05766 Published 2017-05-23 Fixed

TI-2017-07636 CVE-2017-10285 · GHSA-gmm7-r638-2wvf

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 49

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI).

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.03143 Published 2017-10-19 Partial fix

TI-2017-07689 CVE-2017-10346 · GHSA-m98w-5j58-c7m7

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 48

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02962 Published 2017-10-19 Partial fix

TI-2016-07971 CVE-2016-9842 · GHSA-3686-jjcf-4w27

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent…

MEDIUM 48

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05204 Published 2017-05-23 Fixed CWE-1335

TI-2016-07969 CVE-2016-9840 · GHSA-wrj6-35fr-8xw5

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…

MEDIUM 48

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04875 Published 2017-05-23 Fixed

TI-2017-07698 CVE-2017-10355 · GHSA-c7m6-53c4-386j

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

MEDIUM 47

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.16181 Published 2017-10-19 Partial fix

TI-2017-07652 CVE-2017-10309 · GHSA-5269-8f5r-q5c5

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).

MEDIUM 43

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.08794 Published 2017-10-19 Fixed

TI-2017-07727 CVE-2017-10388 · GHSA-8j2p-7p84-f2f5

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 41

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.03206 Published 2017-10-19 Partial fix

TI-2017-07625 CVE-2017-10274 · GHSA-22qx-hc7j-pqmg

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO).

LOW 37

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO).

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.02635 Published 2017-10-19 Fixed

TI-2017-07700 CVE-2017-10357 · GHSA-g4h8-pg44-c6f7

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07693 CVE-2017-10350 · GHSA-gxhg-2xqp-6h9p

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07692 CVE-2017-10349 · GHSA-rm36-hx9f-89cx

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07691 CVE-2017-10348 · GHSA-v47r-hqv5-fhh8

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07690 CVE-2017-10347 · GHSA-jvfh-rgp2-xc77

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03114 Published 2017-10-19 Partial fix

TI-2017-07632 CVE-2017-10281 · GHSA-6r8c-cj9q-27wh

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 36

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2016-08241 CVE-2016-10165 · GHSA-2j4r-j436-59p3

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote…

LOW 36

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bo…

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.02762 Published 2017-02-03 Partial fix CWE-125

TI-2017-07640 CVE-2017-10293 · GHSA-42p8-x3rm-58mv

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc).

LOW 30

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01489 Published 2017-10-19 Fixed

TI-2017-07699 CVE-2017-10356 · GHSA-48hc-p2wv-prx2

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 29

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security).

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00754 Published 2017-10-19 Partial fix

TI-2017-07642 CVE-2017-10295 · GHSA-vg5w-8wf5-8234

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 23

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.02199 Published 2017-10-19 Partial fix

TI-2017-07688 CVE-2017-10345 · GHSA-p7q9-c7hh-v46v

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 20

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.02442 Published 2017-10-19 Partial fix