Red Hat Security AdvisoryRHSA-2018:2576
java-1.7.1-ibm security update
Released 2018-08-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +3
- Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +1
- Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +3
- Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.30-1jpp.2.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.30-1jpp.2.el6_10 +3
Fixes 6 records
Priority MEDIUM 40
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files.
CVSS 3.0HIGH 7.4· Network · No auth · User interaction · EPSS 0.04456 · Published 2018-08-20 · Fixed CWE-22
Priority MEDIUM 40
A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03931 · Published 2018-08-20 · Fixed CWE-20
Priority LOW 35
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the abilit…
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00494 · Published 2018-08-14 · Fixed CWE-419
Priority LOW 34
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE).
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.04667 · Published 2018-07-18 · Partial fix
Priority LOW 26
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.03132 · Published 2018-07-18 · Partial fix
Priority LOW 25
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency).
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.04426 · Published 2018-07-18 · Partial fix
THREATIST.IORead the docs