-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: java-1.7.1-ibm security update
Advisory ID:       RHSA-2018:2569-01
Product:           Red Hat Enterprise Linux Supplementary
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2569
Issue date:        2018-08-27
CVE Names:         CVE-2018-1517 CVE-2018-1656 CVE-2018-2940 
                   CVE-2018-2952 CVE-2018-2973 CVE-2018-12539 
====================================================================
1. Summary:

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux
7 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64

3. Description:

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment
and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP30.

Security Fix(es):

* IBM JDK: privilege escalation via insufficiently restricted access to
Attach API (CVE-2018-12539)

* IBM JDK: DoS in the java.math component (CVE-2018-1517)

* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
(CVE-2018-1656)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (Libraries) (CVE-2018-2940)

* OpenJDK: insufficient index validation in PatternSyntaxException
getMessage() (Concurrency, 8199547) (CVE-2018-2952)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (JSSE) (CVE-2018-2973)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take
effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)
1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)
1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries)
1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API
1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component

6. Package List:

Red Hat Enterprise Linux Client Supplementary (v. 7):

x86_64:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):

x86_64:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 7):

ppc64:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.ppc64.rpm

ppc64le:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm

s390x:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.s390x.rpm

x86_64:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 7):

x86_64:
java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1517
https://access.redhat.com/security/cve/CVE-2018-1656
https://access.redhat.com/security/cve/CVE-2018-2940
https://access.redhat.com/security/cve/CVE-2018-2952
https://access.redhat.com/security/cve/CVE-2018-2973
https://access.redhat.com/security/cve/CVE-2018-12539
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW4QJKtzjgjWX9erEAQiKwg//c16aTmEv5kD0NHoSPu1ufxxKFI6rC1l2
7lhIgpyQii2/dzRdiUVsBInBbrdO9Z/DRPKlFGNIMJsZAI5USuQ4hOmjZl7FlUai
/Z2FTSqT5XpKS7BzBAhrk3gLmH52AbKe8VEk/nVOdikXjCvkY0XpyF5FWX7ymNMd
d73pyolA97mx8FPN0UD+633WZjCKmJjJf/gQfPQezgOKO676A+96T7mvNhkaoy+k
xbM/UpjJMFRzULmDyFLC9T5nSq3TZBnQaB258iEQsa/9TLAnqtZe7ezw6Uk1e1nj
8wMvIvfBAvyTmsk9EfOkIFdotgeIZmXddV0G06QW48mbLjALXef1eZDvBRPAV9Nv
EdpQjvaQ8c2byAcwOEeUUxTdyABxiyIZRDgtHtuM4rsN+ah7Tez88EUfoas1X/7T
IJ/784ccAf4ZIU4arry7LFgBy8/KT08xr7GzNoOYq47uJKrN1YV71/h5WD379kGa
zn5y8c6E+gNKLMixo8SA7WwvfiTuj5HFtJuKCleotYEvKUFec4BH1ewwai4+KwWm
LitNCvLrL8bf4x8WYZ3Nr3g0TDf3TNrNrlKs23vpEc88Bs4lXu4jDO7ht+NWiuPZ
LqfLtO9Wmx8tPkR+Mr0NgauRWSWF6bCSfhUeM72WHq4fTN3Vz4RA2AT1ClcaUVpM
o3wyl2gCERI=TtSo
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2018-2569:01 Important: java-1.7.1-ibm security update

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 7 Supplementary

Summary

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 7 to version 7R1 SR4-FP30.
Security Fix(es):
* IBM JDK: privilege escalation via insufficiently restricted access to Attach API (CVE-2018-12539)
* IBM JDK: DoS in the java.math component (CVE-2018-1517)
* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework (CVE-2018-1656)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) (CVE-2018-2940)
* OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) (CVE-2018-2952)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) (CVE-2018-2973)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Summary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take effect.

References

https://access.redhat.com/security/cve/CVE-2018-1517 https://access.redhat.com/security/cve/CVE-2018-1656 https://access.redhat.com/security/cve/CVE-2018-2940 https://access.redhat.com/security/cve/CVE-2018-2952 https://access.redhat.com/security/cve/CVE-2018-2973 https://access.redhat.com/security/cve/CVE-2018-12539 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Client Supplementary (v. 7):
x86_64: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):
x86_64: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 7):
ppc64: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.ppc64.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.ppc64.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.ppc64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.ppc64.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.ppc64.rpm
ppc64le: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.ppc64le.rpm
s390x: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.s390x.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.s390x.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.s390x.rpm java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.s390x.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.s390x.rpm
x86_64: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 7):
x86_64: java-1.7.1-ibm-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.4.30-1jpp.1.el7.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.30-1jpp.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity

Advisory ID: RHSA-2018:2569-01

Product: Red Hat Enterprise Linux Supplementary

Advisory URL: https://access.redhat.com/errata/RHSA-2018:2569

Issued Date: : 2018-08-27

CVE Names: CVE-2018-1517 CVE-2018-1656 CVE-2018-2940 CVE-2018-2952 CVE-2018-2973 CVE-2018-12539

Topic

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux7 Supplementary.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.