ID

VAR-201304-0184

CVE

CVE-2013-1569

TITLE

Oracle Java SE of Java Runtime Environment In 2D Processing vulnerability

DESCRIPTION

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2. (DoS) An attack may be carried out. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the fontmanager native component. There is a vulnerability when processing Ligature Substitution subtables embedded in a "mort" table, which can result in a stack-based buffer overflow. This allows a malicious applet to execute attacker-supplied code resulting in remote code execution under the context of the current user. This vulnerability affects the following supported versions: 7 Update 17, 6 Update 43, 5.0 Update 41. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03809278 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03809278 Version: 1 HPSBUX02889 SSRT101252 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2013-07-01 Last Updated: 2013-07-01 Potential Security Impact: Remote unauthorized access, disclosure of information, and other vulnerabilities Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other exploits. HP-UX B.11.11, B.11.23, and B.11.31 running HP JDK and JRE v6.0.18 and earlier. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2013-0401 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1491 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1518 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1537 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1540 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2013-1557 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1558 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1563 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 CVE-2013-1569 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2383 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2384 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2394 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 CVE-2013-2417 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2013-2418 (AV:L/AC:L/Au:N/C:P/I:P/A:P) 4.6 CVE-2013-2419 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2013-2420 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2422 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2424 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2013-2429 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 CVE-2013-2430 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 CVE-2013-2432 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2433 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2013-2434 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2435 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-2439 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2013-2440 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following Java version upgrade to resolve these vulnerabilities. The upgrade is available from the following location http://www.hp.com/java OS Version Release Version HP-UX B.11.11, B.11.23, B.11.31 JDK and JRE v6.0.19 or subsequent MANUAL ACTIONS: Yes - Update For Java v6.0 update to Java v6.0.19 or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.11 HP-UX B.11.23 =========== Jdk60.JDK60-COM Jdk60.JDK60-PA20 Jdk60.JDK60-PA20W Jre60.JRE60-COM Jre60.JRE60-COM-DOC Jre60.JRE60-PA20 Jre60.JRE60-PA20-HS Jre60.JRE60-PA20W Jre60.JRE60-PA20W-HS Jdk60.JDK60-IPF32 Jdk60.JDK60-IPF64 Jre60.JRE60-COM Jre60.JRE60-IPF32 Jre60.JRE60-IPF32-HS Jre60.JRE60-IPF64 Jre60.JRE60-IPF64-HS action: install revision 1.6.0.19.00 or subsequent HP-UX B.11.23 HP-UX B.11.31 =========== Jdk60.JDK60-COM Jdk60.JDK60-IPF32 Jdk60.JDK60-IPF64 Jre60.JRE60-IPF32 Jre60.JRE60-IPF32-HS Jre60.JRE60-IPF64 Jre60.JRE60-IPF64-HS Jre60.JRE60-COM Jre60.JRE60-IPF32 Jre60.JRE60-IPF32-HS Jre60.JRE60-IPF64 Jre60.JRE60-IPF64-HS action: install revision 1.6.0.19.00 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 1 July 2013 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2013 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. Description: This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. (CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743) Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. ============================================================================ Ubuntu Security Notice USN-2522-3 March 10, 2015 icu vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: ICU could be made to crash or run programs as your login if it processed specially crafted data. Software Description: - icu: International Components for Unicode library Details: USN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the font patches caused a regression when using LibreOffice Calc. The patches have now been updated to fix the regression. We apologize for the inconvenience. Original advisory details: It was discovered that ICU incorrectly handled memory operations when processing fonts. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419) It was discovered that ICU incorrectly handled memory operations when processing fonts. (CVE-2014-6585, CVE-2014-6591) It was discovered that ICU incorrectly handled memory operations when processing regular expressions. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654) It was discovered that ICU collator implementation incorrectly handled memory operations. CVE-2013-1569 Glyph table issue. CVE-2013-2383 Glyph table issue. CVE-2013-2384 Font layout issue. CVE-2013-2419 Font processing issue. CVE-2014-6585 Out-of-bounds read. CVE-2014-6591 Additional out-of-bounds reads. CVE-2014-7923 Memory corruption in regular expression comparison. CVE-2014-7926 Memory corruption in regular expression comparison. CVE-2014-7940 Uninitialized memory. CVE-2014-9654 More regular expression flaws. For the stable distribution (wheezy), these problems have been fixed in version 4.8.1.1-12+deb7u2. For the upcoming stable (jessie) and unstable (sid) distributions, these problems have been fixed in version 52.1-7.1. We recommend that you upgrade your icu packages. Hi @ll, Apples current iTunes 11.2.2 for Windows comes with the following COMPLETELY outdated and vulnerable 3rd party libraries (as part of AppleApplicationSupport.msi): * libeay32.dll and ssleay32.dll 0.9.8d are more than SEVEN years old and have at least 27 unfixed CVEs! the current version is 0.9.8za, see <http://www.openssl.org/news/> * libcurl.dll 7.16.2 is more than SEVEN years old and has at least 18 unfixed CVEs! the current version is 7.37.0; see <http://curl.haxx.se/docs/security.html> for the fixed vulnerabilities! * libxml2.dll 2.6.0.0 is more than TEN years old and has at least 17 unfixed CVEs! the current version is 2.9.1, for the latest vulnerability see CVE-2013-0339 * icuuc40.dll, icuin40.dll, icudt49.dll, libicuuc.dll and libicuin.dll 49.1.1 have at least 4 unfixed CVEs: CVE-2013-2419, CVE-2013-2383, CVE-2013-2384, CVE-2013-1569 Until Apples developers start to develop a sense for safety and security: stay away from their (Windows) software! regards Stefan Kanthak Timeline: ~~~~~~~~~ 2014-06-06 informed vendor 2014-06-06 vendor sent automated response ... no more reaction 2014-07-03 requested status ... no answer 2014-07-07 report published . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.6.0-openjdk security update Advisory ID: RHSA-2013:0770-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0770.html Issue date: 2013-04-24 CVE Names: CVE-2013-0401 CVE-2013-1488 CVE-2013-1518 CVE-2013-1537 CVE-2013-1557 CVE-2013-1558 CVE-2013-1569 CVE-2013-2383 CVE-2013-2384 CVE-2013-2415 CVE-2013-2417 CVE-2013-2419 CVE-2013-2420 CVE-2013-2421 CVE-2013-2422 CVE-2013-2424 CVE-2013-2426 CVE-2013-2429 CVE-2013-2430 CVE-2013-2431 ===================================================================== 1. Summary: Updated java-1.6.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. Multiple flaws were discovered in the font layout engine in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384) Multiple improper permission check issues were discovered in the Beans, Libraries, JAXP, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-1558, CVE-2013-2422, CVE-2013-1518, CVE-2013-1557) The previous default value of the java.rmi.server.useCodebaseOnly property permitted the RMI implementation to automatically load classes from remotely specified locations. (CVE-2013-1537) Note: The fix for CVE-2013-1537 changes the default value of the property to true, restricting class loading to the local CLASSPATH and locations specified in the java.rmi.server.codebase property. Refer to Red Hat Bugzilla bug 952387 for additional details. The 2D component did not properly process certain images. An untrusted Java application or applet could possibly use this flaw to trigger Java Virtual Machine memory corruption. (CVE-2013-2420) It was discovered that the Hotspot component did not properly handle certain intrinsic frames, and did not correctly perform MethodHandle lookups. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-2431, CVE-2013-2421) It was discovered that JPEGImageReader and JPEGImageWriter in the ImageIO component did not protect against modification of their state while performing certain native code operations. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-2429, CVE-2013-2430) The JDBC driver manager could incorrectly call the toString() method in JDBC drivers, and the ConcurrentHashMap class could incorrectly call the defaultReadObject() method. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. (CVE-2013-1488, CVE-2013-2426) The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2013-0401) Flaws were discovered in the Network component's InetAddress serialization, and the 2D component's font handling. An untrusted Java application or applet could possibly use these flaws to crash the Java Virtual Machine. (CVE-2013-2417, CVE-2013-2419) The MBeanInstantiator class implementation in the OpenJDK JMX component did not properly check class access before creating new instances. An untrusted Java application or applet could use this flaw to create instances of non-public classes. (CVE-2013-2424) It was discovered that JAX-WS could possibly create temporary files with insecure permissions. A local attacker could use this flaw to access temporary files created by an application using JAX-WS. (CVE-2013-2415) This erratum also upgrades the OpenJDK package to IcedTea6 1.11.10. Refer to the NEWS file, linked to in the References, for further information. All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 920245 - CVE-2013-0401 OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305) 920247 - CVE-2013-1488 OpenJDK: JDBC driver manager improper toString calls (CanSecWest 2013, Libraries, 8009814) 952387 - CVE-2013-1537 OpenJDK: remote code loading enabled by default (RMI, 8001040) 952389 - CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542) 952509 - CVE-2013-2424 OpenJDK: MBeanInstantiator insufficient class access checks (JMX, 8006435) 952521 - CVE-2013-2429 OpenJDK: JPEGImageWriter state corruption (ImageIO, 8007918) 952524 - CVE-2013-2430 OpenJDK: JPEGImageReader state corruption (ImageIO, 8007667) 952638 - CVE-2013-2420 OpenJDK: image processing vulnerability (2D, 8007617) 952640 - CVE-2013-1558 OpenJDK: java.beans.ThreadGroupContext missing restrictions (Beans, 7200507) 952642 - CVE-2013-2422 OpenJDK: MethodUtil trampoline class incorrect restrictions (Libraries, 8009857) 952645 - CVE-2013-2431 OpenJDK: Hotspot intrinsic frames vulnerability (Hotspot, 8004336) 952646 - CVE-2013-1518 OpenJDK: JAXP missing security restrictions (JAXP, 6657673) 952648 - CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329) 952649 - CVE-2013-2421 OpenJDK: Hotspot MethodHandle lookup error (Hotspot, 8009699) 952653 - CVE-2013-2426 OpenJDK: ConcurrentHashMap incorrectly calls defaultReadObject() method (Libraries, 8009063) 952656 - CVE-2013-2419 OpenJDK: font processing errors (2D, 8001031) 952657 - CVE-2013-2417 OpenJDK: Network InetAddress serialization information disclosure (Networking, 8000724) 952708 - CVE-2013-2383 OpenJDK: font layout and glyph table errors (2D, 8004986) 952709 - CVE-2013-2384 OpenJDK: font layout and glyph table errors (2D, 8004987) 952711 - CVE-2013-1569 OpenJDK: font layout and glyph table errors (2D, 8004994) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.el5_9.src.rpm i386: java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-src-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm x86_64: java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.el5_9.src.rpm i386: java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm java-1.6.0-openjdk-src-1.6.0.0-1.40.1.11.11.el5_9.i386.rpm x86_64: java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.0-1.40.1.11.11.el5_9.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm i386: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm i386: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm i386: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm i386: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm i386: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.61.1.11.11.el6_4.src.rpm i386: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.0-1.61.1.11.11.el6_4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-0401.html https://www.redhat.com/security/data/cve/CVE-2013-1488.html https://www.redhat.com/security/data/cve/CVE-2013-1518.html https://www.redhat.com/security/data/cve/CVE-2013-1537.html https://www.redhat.com/security/data/cve/CVE-2013-1557.html https://www.redhat.com/security/data/cve/CVE-2013-1558.html https://www.redhat.com/security/data/cve/CVE-2013-1569.html https://www.redhat.com/security/data/cve/CVE-2013-2383.html https://www.redhat.com/security/data/cve/CVE-2013-2384.html https://www.redhat.com/security/data/cve/CVE-2013-2415.html https://www.redhat.com/security/data/cve/CVE-2013-2417.html https://www.redhat.com/security/data/cve/CVE-2013-2419.html https://www.redhat.com/security/data/cve/CVE-2013-2420.html https://www.redhat.com/security/data/cve/CVE-2013-2421.html https://www.redhat.com/security/data/cve/CVE-2013-2422.html https://www.redhat.com/security/data/cve/CVE-2013-2424.html https://www.redhat.com/security/data/cve/CVE-2013-2426.html https://www.redhat.com/security/data/cve/CVE-2013-2429.html https://www.redhat.com/security/data/cve/CVE-2013-2430.html https://www.redhat.com/security/data/cve/CVE-2013-2431.html https://access.redhat.com/security/updates/classification/#important http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.10/NEWS 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFReB4YXlSAg2UNWIIRApIkAJ9/Kk9e0UPaBMyunYAZ5ZL0yGNPZQCdFwLB R1NB2qcpqvapX4RyyM2OH0E= =rAdI -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2013-0401) James Forshaw discovered a vulnerability in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2013-1518, CVE-2013-1537, CVE-2013-1557, CVE-2013-1558, CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2426, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2436) Two vulnerabilities were discovered in the OpenJDK JRE related to confidentiality. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-2415, CVE-2013-2424) Two vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service

AFFECTED PRODUCTS