ID

VAR-201306-0139

CVE

CVE-2013-1571

TITLE

Oracle Javadoc HTML frame injection vulnerability

DESCRIPTION

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc. Oracle Java Development Toolkit (JDK) include Javadoc Generated by the tool HTML The file contains a vulnerability that can display the contents of any website in a frame within the page. For details, check the information provided by the developer.The contents of any website may be displayed in a frame within the web page and used for phishing scams, etc. Oracle Java SE is prone to a frame-injection vulnerability. Successful exploits may allow attackers to redirect victims to a malicious website. This may lead to other attacks. This vulnerability affects the following supported versions: 7 Update 21 , 6 Update 45 , 5.0 Update 45 , JavaFX 2.2.21. A flaw was found in the way the tomcat6 init script handled the tomcat6-initd.log log file. A malicious web application deployed on Tomcat could use this flaw to perform a symbolic link attack to change the ownership of an arbitrary system file to that of the tomcat user, allowing them to escalate their privileges to root (CVE-2013-1976). It was discovered that Tomcat incorrectly handled certain authentication requests. Note: With this update, tomcat6-initd.log has been moved from /var/log/tomcat6/ to the /var/log/ directory. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption (CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469). Integer overflow flaws were found in the way AWT processed certain input. An attacker could use these flaws to execute arbitrary code with the privileges of the user running an untrusted Java applet or application (CVE-2013-2459). Multiple improper permission check issues were discovered in the Sound and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-2448, CVE-2013-2457, CVE-2013-2453). Multiple flaws in the Serialization, Networking, Libraries and CORBA components can be exploited by an untrusted Java application or applet to gain access to potentially sensitive information (CVE-2013-2456, CVE-2013-2447, CVE-2013-2455, CVE-2013-2452, CVE-2013-2443, CVE-2013-2446). It was discovered that the Hotspot component did not properly handle out-of-memory errors. An untrusted Java application or applet could possibly use these flaws to terminate the Java Virtual Machine (CVE-2013-2445). It was discovered that the AWT component did not properly manage certain resources and that the ObjectStreamClass of the Serialization component did not properly handle circular references. An untrusted Java application or applet could possibly use these flaws to cause a denial of service (CVE-2013-2444, CVE-2013-2450). It was discovered that the Libraries component contained certain errors related to XML security and the class loader. A remote attacker could possibly exploit these flaws to bypass intended security mechanisms or disclose potentially sensitive information and cause a denial of service (CVE-2013-2407, CVE-2013-2461). It was discovered that JConsole did not properly inform the user when establishing an SSL connection failed. An attacker could exploit this flaw to gain access to potentially sensitive information (CVE-2013-2412). If such documentation was accessible over a network, and a remote attacker could trick a user into visiting a specially-crafted URL, it would lead to arbitrary web content being displayed next to the documentation. This could be used to perform a phishing attack by providing frame content that spoofed a login form on the site hosting the vulnerable documentation (CVE-2013-1571). It was discovered that the 2D component created shared memory segments with insecure permissions. A local attacker could use this flaw to read or write to the shared memory segment (CVE-2013-1500). It was discovered that the Networking component did not properly enforce exclusive port binding. A local attacker could exploit this flaw to bind to ports intended to be exclusively bound (CVE-2013-2451). This updates IcedTea6 to version 1.11.12, which fixes these issues, as well as several other bugs. Additionally, this OpenJDK update causes icedtea-web, the Java browser plugin, to crash, so icedtea-web has been patched to fix this. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1500 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1571 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2407 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2412 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2443 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2444 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2445 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2446 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2447 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2448 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2449 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2450 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2452 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2453 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2454 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2455 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2456 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2457 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2458 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2459 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2460 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2461 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2463 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2465 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2469 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2470 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2471 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2451 https://rhn.redhat.com/errata/RHSA-2013-1014.html _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: 3ae552d38d7cd10be746e4703279f789 mes5/i586/icedtea-web-1.3.2-0.4mdvmes5.2.i586.rpm cb106d5fa87dcb272347ccc6ff4c1c24 mes5/i586/icedtea-web-javadoc-1.3.2-0.4mdvmes5.2.i586.rpm 2ae9cb967329a454731c3c5c50118fb5 mes5/i586/java-1.6.0-openjdk-1.6.0.0-35.b24.6mdvmes5.2.i586.rpm 05afab461704f00714707dd22f4811be mes5/i586/java-1.6.0-openjdk-demo-1.6.0.0-35.b24.6mdvmes5.2.i586.rpm dc372b36845109db264de4d33301d9e5 mes5/i586/java-1.6.0-openjdk-devel-1.6.0.0-35.b24.6mdvmes5.2.i586.rpm 55cdf45405844e373f60c3bcac1c3fbc mes5/i586/java-1.6.0-openjdk-javadoc-1.6.0.0-35.b24.6mdvmes5.2.i586.rpm 48653ecc4f9b945fafbf43e972465a18 mes5/i586/java-1.6.0-openjdk-src-1.6.0.0-35.b24.6mdvmes5.2.i586.rpm 6652ab0958ffe2b11b061f8281c3e5a7 mes5/SRPMS/icedtea-web-1.3.2-0.4mdvmes5.2.src.rpm 977e2c2d131ba350b6dd15cfd1bbf14c mes5/SRPMS/java-1.6.0-openjdk-1.6.0.0-35.b24.6mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 6ffbc522ac4a2db8212ac963de525576 mes5/x86_64/icedtea-web-1.3.2-0.4mdvmes5.2.x86_64.rpm 2bc2c2b9ce03a4785ef061ca66156aaa mes5/x86_64/icedtea-web-javadoc-1.3.2-0.4mdvmes5.2.x86_64.rpm 841d31717e695fd649290fd561400a4d mes5/x86_64/java-1.6.0-openjdk-1.6.0.0-35.b24.6mdvmes5.2.x86_64.rpm 51bd267b7c1b2efe641e080deb68fe96 mes5/x86_64/java-1.6.0-openjdk-demo-1.6.0.0-35.b24.6mdvmes5.2.x86_64.rpm 68fb561cd1b10758db8d9d6aa7d24487 mes5/x86_64/java-1.6.0-openjdk-devel-1.6.0.0-35.b24.6mdvmes5.2.x86_64.rpm 775811371aca053a714df2d570c19720 mes5/x86_64/java-1.6.0-openjdk-javadoc-1.6.0.0-35.b24.6mdvmes5.2.x86_64.rpm 7ce118640d8e59d659b020febe513427 mes5/x86_64/java-1.6.0-openjdk-src-1.6.0.0-35.b24.6mdvmes5.2.x86_64.rpm 6652ab0958ffe2b11b061f8281c3e5a7 mes5/SRPMS/icedtea-web-1.3.2-0.4mdvmes5.2.src.rpm 977e2c2d131ba350b6dd15cfd1bbf14c mes5/SRPMS/java-1.6.0-openjdk-1.6.0.0-35.b24.6mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFR47+cmqjQ0CJFipgRAmnTAJ4lalit4V4VWsSE6KHeem9qtHb+9gCgmJ/U GUelRnMi6Rq7d9NhnTCwrlg= =rErU -----END PGP SIGNATURE----- . For the stable distribution (wheezy), these problems have been fixed in version 7u25-2.3.10-1~deb7u1. In addition icedtea-web needed to be updated to 1.4-3~deb7u1. For the unstable distribution (sid), these problems have been fixed in version 7u25-2.3.10-1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.5.0-ibm security update Advisory ID: RHSA-2013:1081-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1081.html Issue date: 2013-07-16 CVE Names: CVE-2013-1500 CVE-2013-1571 CVE-2013-2443 CVE-2013-2444 CVE-2013-2446 CVE-2013-2447 CVE-2013-2448 CVE-2013-2450 CVE-2013-2452 CVE-2013-2454 CVE-2013-2455 CVE-2013-2456 CVE-2013-2457 CVE-2013-2459 CVE-2013-2463 CVE-2013-2464 CVE-2013-2465 CVE-2013-2469 CVE-2013-2470 CVE-2013-2471 CVE-2013-2472 CVE-2013-2473 CVE-2013-3743 ===================================================================== 1. Summary: Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, ppc, s390x, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2452, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743) Red Hat would like to thank Tim Brown for reporting CVE-2013-1500, and US-CERT for reporting CVE-2013-1571. US-CERT acknowledges Oracle as the original reporter of CVE-2013-1571. All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR16-FP3 release. All running instances of IBM Java must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 973474 - CVE-2013-1571 OpenJDK: Frame injection in generated HTML (Javadoc, 8012375) 975099 - CVE-2013-2470 OpenJDK: ImagingLib byte lookup processing (2D, 8011243) 975102 - CVE-2013-2471 OpenJDK: Incorrect IntegerComponentRaster size checks (2D, 8011248) 975107 - CVE-2013-2472 OpenJDK: Incorrect ShortBandedRaster size checks (2D, 8011253) 975110 - CVE-2013-2473 OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257) 975115 - CVE-2013-2463 OpenJDK: Incorrect image attribute verification (2D, 8012438) 975118 - CVE-2013-2465 OpenJDK: Incorrect image channel verification (2D, 8012597) 975120 - CVE-2013-2469 OpenJDK: Incorrect image layout verification (2D, 8012601) 975121 - CVE-2013-2459 OpenJDK: Various AWT integer overflow checks (AWT, 8009071) 975125 - CVE-2013-2448 OpenJDK: Better access restrictions (Sound, 8006328) 975129 - CVE-2013-2454 OpenJDK: SerialJavaObject package restriction (JDBC, 8009554) 975131 - CVE-2013-2444 OpenJDK: Resource denial of service (AWT, 8001038) 975132 - CVE-2013-2446 OpenJDK: output stream access restrictions (CORBA, 8000642) 975133 - CVE-2013-2457 OpenJDK: Proper class checking (JMX, 8008120) 975137 - CVE-2013-2443 OpenJDK: AccessControlContext check order issue (Libraries, 8001330) 975138 - CVE-2013-2452 OpenJDK: Unique VMIDs (Libraries, 8001033) 975139 - CVE-2013-2455 OpenJDK: getEnclosing* checks (Libraries, 8007812) 975140 - CVE-2013-2447 OpenJDK: Prevent revealing the local address (Networking, 8001318) 975141 - CVE-2013-2450 OpenJDK: ObjectStreamClass circular reference denial of service (Serialization, 8000638) 975142 - CVE-2013-2456 OpenJDK: ObjectOutputStream access checks (Serialization, 8008132) 975148 - CVE-2013-1500 OpenJDK: Insecure shared memory permissions (2D, 8001034) 975757 - CVE-2013-2464 Oracle JDK: unspecified vulnerability fixed in 7u25 (2D) 975767 - CVE-2013-3743 Oracle JDK: unspecified vulnerability fixed in 6u51 and 5u51 (AWT) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.i386.rpm ppc: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.ppc64.rpm java-1.5.0-ibm-accessibility-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.ppc64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.ppc.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.s390.rpm java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.s390x.rpm java-1.5.0-ibm-accessibility-1.5.0.16.3-1jpp.1.el5_9.s390x.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.s390.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.s390x.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.s390.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.s390x.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el5_9.s390.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.s390.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.i386.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el5_9.x86_64.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.i686.rpm x86_64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.i686.rpm ppc64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.ppc64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.ppc.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.ppc64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el6_4.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el6_4.ppc.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.s390x.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.s390x.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.s390.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.s390x.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el6_4.s390.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-plugin-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.i686.rpm x86_64: java-1.5.0-ibm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.3-1jpp.1.el6_4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-1500.html https://www.redhat.com/security/data/cve/CVE-2013-1571.html https://www.redhat.com/security/data/cve/CVE-2013-2443.html https://www.redhat.com/security/data/cve/CVE-2013-2444.html https://www.redhat.com/security/data/cve/CVE-2013-2446.html https://www.redhat.com/security/data/cve/CVE-2013-2447.html https://www.redhat.com/security/data/cve/CVE-2013-2448.html https://www.redhat.com/security/data/cve/CVE-2013-2450.html https://www.redhat.com/security/data/cve/CVE-2013-2452.html https://www.redhat.com/security/data/cve/CVE-2013-2454.html https://www.redhat.com/security/data/cve/CVE-2013-2455.html https://www.redhat.com/security/data/cve/CVE-2013-2456.html https://www.redhat.com/security/data/cve/CVE-2013-2457.html https://www.redhat.com/security/data/cve/CVE-2013-2459.html https://www.redhat.com/security/data/cve/CVE-2013-2463.html https://www.redhat.com/security/data/cve/CVE-2013-2464.html https://www.redhat.com/security/data/cve/CVE-2013-2465.html https://www.redhat.com/security/data/cve/CVE-2013-2469.html https://www.redhat.com/security/data/cve/CVE-2013-2470.html https://www.redhat.com/security/data/cve/CVE-2013-2471.html https://www.redhat.com/security/data/cve/CVE-2013-2472.html https://www.redhat.com/security/data/cve/CVE-2013-2473.html https://www.redhat.com/security/data/cve/CVE-2013-3743.html https://access.redhat.com/security/updates/classification/#important https://www.ibm.com/developerworks/java/jdk/alerts/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFR5ZFTXlSAg2UNWIIRAmLoAKCfy4f4XRFpBUc9H7Spg769mGd7rQCdGND3 FM5RCdlpLpFn3epzI03f4mg= =kncq -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-1907-1 July 16, 2013 openjdk-7 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 Summary: Several security issues were fixed in OpenJDK 7. Software Description: - openjdk-7: Open Source Java implementation Details: Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. (CVE-2013-1500, CVE-2013-2454, CVE-2013-2458) A vulnerability was discovered in the OpenJDK Javadoc related to data integrity. (CVE-2013-1571) A vulnerability was discovered in the OpenJDK JRE related to information disclosure and availability. (CVE-2013-2407) Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. (CVE-2013-2412, CVE-2013-2443, CVE-2013-2446, CVE-2013-2447, CVE-2013-2449, CVE-2013-2452, CVE-2013-2456) Several vulnerabilities were discovered in the OpenJDK JRE related to availability. (CVE-2013-2444, CVE-2013-2445, CVE-2013-2450) Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. (CVE-2013-2448, CVE-2013-2451, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473) Several vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2013-2453, CVE-2013-2455, CVE-2013-2457) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: icedtea-7-jre-jamvm 7u25-2.3.10-1ubuntu0.13.04.2 openjdk-7-doc 7u25-2.3.10-1ubuntu0.13.04.2 openjdk-7-jre 7u25-2.3.10-1ubuntu0.13.04.2 openjdk-7-jre-headless 7u25-2.3.10-1ubuntu0.13.04.2 openjdk-7-jre-lib 7u25-2.3.10-1ubuntu0.13.04.2 openjdk-7-jre-zero 7u25-2.3.10-1ubuntu0.13.04.2 Ubuntu 12.10: icedtea-7-jre-cacao 7u25-2.3.10-1ubuntu0.12.10.2 icedtea-7-jre-jamvm 7u25-2.3.10-1ubuntu0.12.10.2 openjdk-7-doc 7u25-2.3.10-1ubuntu0.12.10.2 openjdk-7-jre 7u25-2.3.10-1ubuntu0.12.10.2 openjdk-7-jre-headless 7u25-2.3.10-1ubuntu0.12.10.2 openjdk-7-jre-lib 7u25-2.3.10-1ubuntu0.12.10.2 openjdk-7-jre-zero 7u25-2.3.10-1ubuntu0.12.10.2 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes

AFFECTED PRODUCTS