Articles / Red Hat: Updated java-1.6.0…

Red Hat: Updated java-1.6.0-openjdk packages fix several security issues

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. It was discovered that Java2D did not properly check graphics rendering objects before passing them to the native renderer. Malicious input, or an untrusted Java application or applet could use this flaw to crash the Java Virtual Machine (JVM), or bypass Java sandbox restrictions. It was discovered that the exception thrown on deserialization failure did not always contain a proper identification of the cause of the failure. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

The AtomicReferenceArray class implementation did not properly check if the array was of the expected Object type. A malicious Java application or applet could use this flaw to bypass Java sandbox restrictions. It was discovered that the use of TimeZone.setDefault() was not restricted by the SecurityManager, allowing an untrusted Java application or applet to set a new default time zone, and hence bypass Java sandbox restrictions. The HttpServer class did not limit the number of headers read from HTTP requests. A remote attacker could use this flaw to make an application using HttpServer use an excessive amount of CPU time via a specially-crafted request.

The Java Sound component did not properly check buffer boundaries. Malicious input, or an untrusted Java application or applet could use this flaw to cause the Java Virtual Machine (JVM) to crash or disclose a portion of its memory. A flaw was found in the AWT KeyboardFocusManager that could allow an untrusted Java application or applet to acquire keyboard focus and possibly steal sensitive information. It was discovered that the CORBA (Common Object Request Broker Architecture) implementation in Java did not properly protect repository identifiers on certain CORBA objects. This could have been used to modify immutable object data.

An off-by-one flaw, causing a stack overflow, was found in the unpacker for ZIP files. A specially-crafted ZIP archive could cause the Java Virtual Machine (JVM) to crash when opened.

Updated packages are available from ftp.redhat.com.

  -----BEGIN PGP SIGNED MESSAGE-----
  Hash: SHA1

  =====================================================================
                    Red Hat Security Advisory

  Synopsis:          Important: java-1.6.0-openjdk security update
  Advisory ID:       RHSA-2012:0322-01
  Product:           Red Hat Enterprise Linux
  Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-0322.html
  Issue date:        2012-02-21
  CVE Names:         CVE-2011-3563 CVE-2011-3571 CVE-2011-5035 
                    CVE-2012-0497 CVE-2012-0501 CVE-2012-0502 
                    CVE-2012-0503 CVE-2012-0505 CVE-2012-0506 
  =====================================================================

  1. Summary:

  Updated java-1.6.0-openjdk packages that fix several security issues are
  now available for Red Hat Enterprise Linux 5.

  The Red Hat Security Response Team has rated this update as having
  important security impact. Common Vulnerability Scoring System (CVSS) base
  scores, which give detailed severity ratings, are available for each
  vulnerability from the CVE links in the References section.

  2. Relevant releases/architectures:

  Red Hat Enterprise Linux (v. 5 server) - i386, x86_64
  Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

  3. Description:

  These packages provide the OpenJDK 6 Java Runtime Environment and the
  OpenJDK 6 Software Development Kit.

  It was discovered that Java2D did not properly check graphics rendering
  objects before passing them to the native renderer. Malicious input, or an
  untrusted Java application or applet could use this flaw to crash the Java
  Virtual Machine (JVM), or bypass Java sandbox restrictions. (CVE-2012-0497)

  It was discovered that the exception thrown on deserialization failure did
  not always contain a proper identification of the cause of the failure. An
  untrusted Java application or applet could use this flaw to bypass Java
  sandbox restrictions. (CVE-2012-0505)

  The AtomicReferenceArray class implementation did not properly check if
  the array was of the expected Object[] type. A malicious Java application
  or applet could use this flaw to bypass Java sandbox restrictions.
  (CVE-2011-3571)

  It was discovered that the use of TimeZone.setDefault() was not restricted
  by the SecurityManager, allowing an untrusted Java application or applet to
  set a new default time zone, and hence bypass Java sandbox restrictions.
  (CVE-2012-0503)

  The HttpServer class did not limit the number of headers read from HTTP
  requests. A remote attacker could use this flaw to make an application
  using HttpServer use an excessive amount of CPU time via a
  specially-crafted request. This update introduces a header count limit
  controlled using the sun.net.httpserver.maxReqHeaders property. The default
  value is 200. (CVE-2011-5035)

  The Java Sound component did not properly check buffer boundaries.
  Malicious input, or an untrusted Java application or applet could use this
  flaw to cause the Java Virtual Machine (JVM) to crash or disclose a portion
  of its memory. (CVE-2011-3563)

  A flaw was found in the AWT KeyboardFocusManager that could allow an
  untrusted Java application or applet to acquire keyboard focus and possibly
  steal sensitive information. (CVE-2012-0502)

  It was discovered that the CORBA (Common Object Request Broker
  Architecture) implementation in Java did not properly protect repository
  identifiers on certain CORBA objects. This could have been used to modify
  immutable object data. (CVE-2012-0506)

  An off-by-one flaw, causing a stack overflow, was found in the unpacker for
  ZIP files. A specially-crafted ZIP archive could cause the Java Virtual
  Machine (JVM) to crash when opened. (CVE-2012-0501)

  This erratum also upgrades the OpenJDK package to IcedTea6 1.10.6. Refer to
  the NEWS file, linked to in the References, for further information.

  All users of java-1.6.0-openjdk are advised to upgrade to these updated
  packages, which resolve these issues. All running instances of OpenJDK Java
  must be restarted for the update to take effect.

  4. Solution:

  Before applying this update, make sure all previously-released errata
  relevant to your system have been applied.

  This update is available via the Red Hat Network. Details on how to
  use the Red Hat Network to apply this update are available at
  https://access.redhat.com/kb/docs/DOC-11259

  5. Bugs fixed (http://bugzilla.redhat.com/):

  788606 - CVE-2011-5035 OpenJDK: HttpServer no header count limit (Lightweight HTTP Server, 7126960)
  788624 - CVE-2012-0501 OpenJDK: off-by-one bug in ZIP reading code (JRE, 7118283)
  788976 - CVE-2012-0503 OpenJDK: unrestricted use of TimeZone.setDefault() (i18n, 7110687)
  788994 - CVE-2011-3571 OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)
  789295 - CVE-2011-3563 OpenJDK: JavaSound incorrect bounds check (Sound, 7088367)
  789297 - CVE-2012-0502 OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683)
  789299 - CVE-2012-0505 OpenJDK: incomplete info in the deserialization exception (Serialization, 7110700)
  789300 - CVE-2012-0506 OpenJDK: mutable repository identifiers (CORBA, 7110704)
  789301 - CVE-2012-0497 OpenJDK: insufficient checking of the graphics rendering object (2D, 7112642)

  6. Package List:

  Red Hat Enterprise Linux Desktop (v. 5 client):

  Source:
  ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8.src.rpm

  i386:
  java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-debuginfo-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-demo-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-devel-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-javadoc-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-src-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm

  x86_64:
  java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-debuginfo-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-demo-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-devel-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-javadoc-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-src-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm

  Red Hat Enterprise Linux (v. 5 server):

  Source:
  ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8.src.rpm

  i386:
  java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-debuginfo-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-demo-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-devel-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-javadoc-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm
  java-1.6.0-openjdk-src-1.6.0.0-1.25.1.10.6.el5_8.i386.rpm

  x86_64:
  java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-debuginfo-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-demo-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-devel-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-javadoc-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm
  java-1.6.0-openjdk-src-1.6.0.0-1.25.1.10.6.el5_8.x86_64.rpm

  These packages are GPG signed by Red Hat for security.  Our key and 
  details on how to verify the signature are available from
  https://access.redhat.com/security/team/key/#package

  7. References:

  https://www.redhat.com/security/data/cve/CVE-2011-3563.html
  https://www.redhat.com/security/data/cve/CVE-2011-3571.html
  https://www.redhat.com/security/data/cve/CVE-2011-5035.html
  https://www.redhat.com/security/data/cve/CVE-2012-0497.html
  https://www.redhat.com/security/data/cve/CVE-2012-0501.html
  https://www.redhat.com/security/data/cve/CVE-2012-0502.html
  https://www.redhat.com/security/data/cve/CVE-2012-0503.html
  https://www.redhat.com/security/data/cve/CVE-2012-0505.html
  https://www.redhat.com/security/data/cve/CVE-2012-0506.html
  https://access.redhat.com/security/updates/classification/#important
  http://icedtea.classpath.org/hg/release/icedtea6-1.10/file/icedtea6-1.10.6/NEWS
  http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html

  8. Contact:

  The Red Hat security contact is <secalert@redhat.com>.  More contact
  details at https://access.redhat.com/security/team/contact/

  Copyright 2012 Red Hat, Inc.
  -----BEGIN PGP SIGNATURE-----
  Version: GnuPG v1.4.4 (GNU/Linux)

  iD8DBQFPRBvTXlSAg2UNWIIRArkfAJ9B74k5cUjTIZGepTvbu+3kEcMpIgCgo2FR
  eIi8N5jfo4lIBLPu4EKFpVo=
  =ChsF
  -----END PGP SIGNATURE-----
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.