====================================================================                   Red Hat Security Advisory

Synopsis:          Critical: java-1.7.0-oracle security update
Advisory ID:       RHSA-2014:1657-01
Product:           Oracle Java for Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2014:1657.html
Issue date:        2014-10-16
CVE Names:         CVE-2014-4288 CVE-2014-6456 CVE-2014-6457 
                   CVE-2014-6458 CVE-2014-6476 CVE-2014-6492 
                   CVE-2014-6493 CVE-2014-6502 CVE-2014-6503 
                   CVE-2014-6504 CVE-2014-6506 CVE-2014-6511 
                   CVE-2014-6512 CVE-2014-6515 CVE-2014-6517 
                   CVE-2014-6519 CVE-2014-6527 CVE-2014-6531 
                   CVE-2014-6532 CVE-2014-6558 
====================================================================
1. Summary:

Updated java-1.7.0-oracle packages that fix several security issues are now
available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Relevant releases/architectures:

Oracle Java for Red Hat Enterprise Linux Client (v. 7) - x86_64
Oracle Java for Red Hat Enterprise Linux Client 5 - i386, x86_64
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) - x86_64
Oracle Java for Red Hat Enterprise Linux Desktop 5 - i386, x86_64
Oracle Java for Red Hat Enterprise Linux Desktop 6 - i386, x86_64
Oracle Java for Red Hat Enterprise Linux HPC Node 6 - x86_64
Oracle Java for Red Hat Enterprise Linux Server (v. 7) - x86_64
Oracle Java for Red Hat Enterprise Linux Server 6 - i386, x86_64
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Oracle Java for Red Hat Enterprise Linux Workstation 6 - i386, x86_64

3. Description:

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and
the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime
Environment and the Oracle Java Software Development Kit. Further
information about these flaws can be found on the Oracle Java SE Critical
Patch Update Advisory page, listed in the References section.
(CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476,
CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6504,
CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6517,
CVE-2014-6519, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558)

The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat
Product Security.

All users of java-1.7.0-oracle are advised to upgrade to these updated
packages, which provide Oracle Java 7 Update 72 and resolve these issues.
All running instances of Oracle Java must be restarted for the update to
take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1071210 - CVE-2014-6512 OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509)
1150155 - CVE-2014-6506 OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564)
1150182 - CVE-2014-6504 OpenJDK: incorrect optimization of range checks in C2 compiler (Hotspot, 8022783)
1150273 - CVE-2014-6519 OpenJDK: missing BootstrapMethods bounds check (Hotspot, 8041717)
1150651 - CVE-2014-6531 OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274)
1150669 - CVE-2014-6502 OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)
1151046 - CVE-2014-6457 OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066)
1151063 - CVE-2014-6558 OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846)
1151364 - CVE-2014-6517 OpenJDK: StAX parser parameter entity XXE (JAXP, 8039533)
1151517 - CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)
1152756 - CVE-2014-6532 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152757 - CVE-2014-6503 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152758 - CVE-2014-6456 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)
1152759 - CVE-2014-6492 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152760 - CVE-2014-6493 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152761 - CVE-2014-4288 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152763 - CVE-2014-6458 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152765 - CVE-2014-6476 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)
1152766 - CVE-2014-6515 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
1152767 - CVE-2014-6527 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)

6. Package List:

Oracle Java for Red Hat Enterprise Linux Client 5:

i386:
java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.i586.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Desktop 5:

i386:
java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.i586.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.i586.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Desktop 6:

i386:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.i686.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux HPC Node 6:

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Server 6:

i386:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.i686.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Workstation 6:

i386:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.i686.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.i686.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Client (v. 7):

Source:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7):

Source:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Server (v. 7):

Source:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm

Oracle Java for Red Hat Enterprise Linux Workstation (v. 7):

Source:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm

x86_64:
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm
java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el7.x86_64.rpm
java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2014-4288.html
https://www.redhat.com/security/data/cve/CVE-2014-6456.html
https://www.redhat.com/security/data/cve/CVE-2014-6457.html
https://www.redhat.com/security/data/cve/CVE-2014-6458.html
https://www.redhat.com/security/data/cve/CVE-2014-6476.html
https://www.redhat.com/security/data/cve/CVE-2014-6492.html
https://www.redhat.com/security/data/cve/CVE-2014-6493.html
https://www.redhat.com/security/data/cve/CVE-2014-6502.html
https://www.redhat.com/security/data/cve/CVE-2014-6503.html
https://www.redhat.com/security/data/cve/CVE-2014-6504.html
https://www.redhat.com/security/data/cve/CVE-2014-6506.html
https://www.redhat.com/security/data/cve/CVE-2014-6511.html
https://www.redhat.com/security/data/cve/CVE-2014-6512.html
https://www.redhat.com/security/data/cve/CVE-2014-6515.html
https://www.redhat.com/security/data/cve/CVE-2014-6517.html
https://www.redhat.com/security/data/cve/CVE-2014-6519.html
https://www.redhat.com/security/data/cve/CVE-2014-6527.html
https://www.redhat.com/security/data/cve/CVE-2014-6531.html
https://www.redhat.com/security/data/cve/CVE-2014-6532.html
https://www.redhat.com/security/data/cve/CVE-2014-6558.html
https://access.redhat.com/security/updates/classification/#critical
https://www.oracle.com/security-alerts/cpuoct2014.html

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.

Red Hat: 2014:1657-01: java-1.7.0-oracle: Critical Advisory

Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7

Summary

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6504, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6517, CVE-2014-6519, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558)
The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security.
All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 72 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.



Summary


Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

References

https://www.redhat.com/security/data/cve/CVE-2014-4288.html https://www.redhat.com/security/data/cve/CVE-2014-6456.html https://www.redhat.com/security/data/cve/CVE-2014-6457.html https://www.redhat.com/security/data/cve/CVE-2014-6458.html https://www.redhat.com/security/data/cve/CVE-2014-6476.html https://www.redhat.com/security/data/cve/CVE-2014-6492.html https://www.redhat.com/security/data/cve/CVE-2014-6493.html https://www.redhat.com/security/data/cve/CVE-2014-6502.html https://www.redhat.com/security/data/cve/CVE-2014-6503.html https://www.redhat.com/security/data/cve/CVE-2014-6504.html https://www.redhat.com/security/data/cve/CVE-2014-6506.html https://www.redhat.com/security/data/cve/CVE-2014-6511.html https://www.redhat.com/security/data/cve/CVE-2014-6512.html https://www.redhat.com/security/data/cve/CVE-2014-6515.html https://www.redhat.com/security/data/cve/CVE-2014-6517.html https://www.redhat.com/security/data/cve/CVE-2014-6519.html https://www.redhat.com/security/data/cve/CVE-2014-6527.html https://www.redhat.com/security/data/cve/CVE-2014-6531.html https://www.redhat.com/security/data/cve/CVE-2014-6532.html https://www.redhat.com/security/data/cve/CVE-2014-6558.html https://access.redhat.com/security/updates/classification/#critical https://www.oracle.com/security-alerts/cpuoct2014.html

Package List

Oracle Java for Red Hat Enterprise Linux Client 5:
i386: java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.i586.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Desktop 5:
i386: java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.i586.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.i586.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.4.el5_11.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.4.el5_11.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Desktop 6:
i386: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.i686.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux HPC Node 6:
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Server 6:
i386: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.i686.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Workstation 6:
i386: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.i686.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.i686.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el6.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Client (v. 7):
Source: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7):
Source: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Server (v. 7):
Source: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7):
Source: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.src.rpm
x86_64: java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.i686.rpm java-1.7.0-oracle-devel-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.72-1jpp.2.el7.x86_64.rpm java-1.7.0-oracle-src-1.7.0.72-1jpp.2.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package


Severity
Advisory ID: RHSA-2014:1657-01
Product: Oracle Java for Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2014:1657.html
Issued Date: : 2014-10-16
CVE Names: CVE-2014-4288 CVE-2014-6456 CVE-2014-6457 CVE-2014-6458 CVE-2014-6476 CVE-2014-6492 CVE-2014-6493 CVE-2014-6502 CVE-2014-6503 CVE-2014-6504 CVE-2014-6506 CVE-2014-6511 CVE-2014-6512 CVE-2014-6515 CVE-2014-6517 CVE-2014-6519 CVE-2014-6527 CVE-2014-6531 CVE-2014-6532 CVE-2014-6558

Topic

Updated java-1.7.0-oracle packages that fix several security issues are nowavailable for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7.Red Hat Product Security has rated this update as having Critical securityimpact. Common Vulnerability Scoring System (CVSS) base scores, which givedetailed severity ratings, are available for each vulnerability from theCVE links in the References section.


Topic


 

Relevant Releases Architectures

Oracle Java for Red Hat Enterprise Linux Client (v. 7) - x86_64

Oracle Java for Red Hat Enterprise Linux Client 5 - i386, x86_64

Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) - x86_64

Oracle Java for Red Hat Enterprise Linux Desktop 5 - i386, x86_64

Oracle Java for Red Hat Enterprise Linux Desktop 6 - i386, x86_64

Oracle Java for Red Hat Enterprise Linux HPC Node 6 - x86_64

Oracle Java for Red Hat Enterprise Linux Server (v. 7) - x86_64

Oracle Java for Red Hat Enterprise Linux Server 6 - i386, x86_64

Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Oracle Java for Red Hat Enterprise Linux Workstation 6 - i386, x86_64


Bugs Fixed

1071210 - CVE-2014-6512 OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509)

1150155 - CVE-2014-6506 OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564)

1150182 - CVE-2014-6504 OpenJDK: incorrect optimization of range checks in C2 compiler (Hotspot, 8022783)

1150273 - CVE-2014-6519 OpenJDK: missing BootstrapMethods bounds check (Hotspot, 8041717)

1150651 - CVE-2014-6531 OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274)

1150669 - CVE-2014-6502 OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)

1151046 - CVE-2014-6457 OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066)

1151063 - CVE-2014-6558 OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846)

1151364 - CVE-2014-6517 OpenJDK: StAX parser parameter entity XXE (JAXP, 8039533)

1151517 - CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)

1152756 - CVE-2014-6532 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152757 - CVE-2014-6503 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152758 - CVE-2014-6456 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)

1152759 - CVE-2014-6492 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152760 - CVE-2014-6493 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152761 - CVE-2014-4288 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152763 - CVE-2014-6458 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152765 - CVE-2014-6476 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)

1152766 - CVE-2014-6515 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

1152767 - CVE-2014-6527 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)


Related News

Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven
Microsoft Update Mayhem: Rescuing Linux Dual-Boot Systems from Secure Boot Woes
2 - 4 min read
Microsoft's recent patch, intended to strengthen Secure Boot defenses, has resulted in an unexpected setback for Linux-Windows dual-boot setups

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved