Scientific Linux: SLSA-2014:0406-1 Critical: Java OpenJDK Issues

Date: Fri, 11 Apr 2014 10:45:05 -0500
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Updated Package kmod-openafs for SL 6.x i386/x86_64
MIME-Version: 1.0

Synopsis: openafs bugfix update
Issue date: 2014-04-11
--
The previously released kmod-openafs did not correctly clean up stale
links under certain conditions.

This bug may have prevented OpenAFS from functioning on effected systems.

This updated package should resolve the issue.

--
SL 6.x
 SRPMS:
 openafs.SLx-1.6.5.1-149.src.rpm
 x86_64:
 kmod-openafs-431-1.6.5.1-149.sl6.431.11.2.x86_64.rpm
 i386:
 kmod-openafs-431-1.6.5.1-149.sl6.431.11.2.i686.rpm

--
Pat Riehecky
Scientific Linux Developer
Date: Tue, 15 Apr 2014 09:34:49 -0500
Reply-To: Bonnie King 
Sender: Security Errata for Scientific Linux
 
From: Bonnie King 
Subject: FASTBUGS for SL 5x i386, x86_64 now available
Comments: To: This email address is being protected from spambots. You need JavaScript enabled to view it.
In-Reply-To: <53319B4B.9010107@fnal.gov>
MIME-Version: 1.0

The following FASTBUGS have been uploaded to

i386:
cpuspeed-1.2.1-11.el5_10.i386.rpm
xorg-x11-server-sdk-1.1.1-48.101.el5_10.3.i386.rpm
xorg-x11-server-Xdmx-1.1.1-48.101.el5_10.3.i386.rpm
xorg-x11-server-Xephyr-1.1.1-48.101.el5_10.3.i386.rpm
xorg-x11-server-Xnest-1.1.1-48.101.el5_10.3.i386.rpm
xorg-x11-server-Xorg-1.1.1-48.101.el5_10.3.i386.rpm
xorg-x11-server-Xvfb-1.1.1-48.101.el5_10.3.i386.rpm
xorg-x11-server-Xvnc-source-1.1.1-48.101.el5_10.3.i386.rpm

x86_64:
cpuspeed-1.2.1-11.el5_10.x86_64.rpm
xorg-x11-server-sdk-1.1.1-48.101.el5_10.3.x86_64.rpm
xorg-x11-server-Xdmx-1.1.1-48.101.el5_10.3.x86_64.rpm
xorg-x11-server-Xephyr-1.1.1-48.101.el5_10.3.x86_64.rpm
xorg-x11-server-Xnest-1.1.1-48.101.el5_10.3.x86_64.rpm
xorg-x11-server-Xorg-1.1.1-48.101.el5_10.3.x86_64.rpm
xorg-x11-server-Xvfb-1.1.1-48.101.el5_10.3.x86_64.rpm
xorg-x11-server-Xvnc-source-1.1.1-48.101.el5_10.3.x86_64.rpm
Date: Tue, 15 Apr 2014 11:39:43 -0500
Reply-To: Bonnie King 
Sender: Security Errata for Scientific Linux
 
From: Bonnie King 
Subject: FASTBUGS for SL 6x i386, x86_64 now available
Comments: To: This email address is being protected from spambots. You need JavaScript enabled to view it.
In-Reply-To: <533ADA30.3090602@fnal.gov>
MIME-Version: 1.0

The following FASTBUGS have been uploaded to

i386:
clusterlib-3.0.12.1-59.el6_5.2.i686.rpm
clusterlib-devel-3.0.12.1-59.el6_5.2.i686.rpm
cman-3.0.12.1-59.el6_5.2.i686.rpm
corosync-1.4.1-17.el6_5.1.i686.rpm
corosynclib-1.4.1-17.el6_5.1.i686.rpm
corosynclib-devel-1.4.1-17.el6_5.1.i686.rpm
gfs2-utils-3.0.12.1-59.el6_5.2.i686.rpm
krb5-devel-1.10.3-15.el6_5.1.i686.rpm
krb5-libs-1.10.3-15.el6_5.1.i686.rpm
krb5-pkinit-openssl-1.10.3-15.el6_5.1.i686.rpm
krb5-server-1.10.3-15.el6_5.1.i686.rpm
krb5-server-ldap-1.10.3-15.el6_5.1.i686.rpm
krb5-workstation-1.10.3-15.el6_5.1.i686.rpm
libvirt-0.10.2-29.el6_5.7.i686.rpm
libvirt-client-0.10.2-29.el6_5.7.i686.rpm
libvirt-devel-0.10.2-29.el6_5.7.i686.rpm
libvirt-python-0.10.2-29.el6_5.7.i686.rpm
nss-softokn-3.14.3-10.el6_5.i686.rpm
nss-softokn-devel-3.14.3-10.el6_5.i686.rpm
nss-softokn-freebl-3.14.3-10.el6_5.i686.rpm
nss-softokn-freebl-devel-3.14.3-10.el6_5.i686.rpm
qemu-guest-agent-0.12.1.2-2.415.el6_5.7.i686.rpm
rrdtool-1.3.8-7.el6.i686.rpm
rrdtool-devel-1.3.8-7.el6.i686.rpm
rrdtool-doc-1.3.8-7.el6.i686.rpm
rrdtool-perl-1.3.8-7.el6.i686.rpm
rrdtool-php-1.3.8-7.el6.i686.rpm
rrdtool-python-1.3.8-7.el6.i686.rpm
rrdtool-ruby-1.3.8-7.el6.i686.rpm
rrdtool-tcl-1.3.8-7.el6.i686.rpm
syslinux-4.02-9.el6_5.i686.rpm
syslinux-devel-4.02-9.el6_5.i686.rpm
syslinux-extlinux-4.02-9.el6_5.i686.rpm
syslinux-perl-4.02-9.el6_5.i686.rpm
syslinux-tftpboot-4.02-9.el6_5.i686.rpm
syslinux-4.02-16.el6_5.i686.rpm
syslinux-devel-4.02-16.el6_5.i686.rpm
syslinux-extlinux-4.02-16.el6_5.i686.rpm
syslinux-extlinux-nonlinux-4.02-16.el6_5.i686.rpm
syslinux-nonlinux-4.02-16.el6_5.i686.rpm
syslinux-perl-4.02-16.el6_5.i686.rpm
syslinux-tftpboot-4.02-16.el6_5.i686.rpm

x86_64:
clusterlib-3.0.12.1-59.el6_5.2.i686.rpm
clusterlib-3.0.12.1-59.el6_5.2.x86_64.rpm
clusterlib-devel-3.0.12.1-59.el6_5.2.i686.rpm
clusterlib-devel-3.0.12.1-59.el6_5.2.x86_64.rpm
cman-3.0.12.1-59.el6_5.2.x86_64.rpm
corosync-1.4.1-17.el6_5.1.x86_64.rpm
corosynclib-1.4.1-17.el6_5.1.i686.rpm
corosynclib-1.4.1-17.el6_5.1.x86_64.rpm
corosynclib-devel-1.4.1-17.el6_5.1.i686.rpm
corosynclib-devel-1.4.1-17.el6_5.1.x86_64.rpm
gfs2-utils-3.0.12.1-59.el6_5.2.x86_64.rpm
krb5-devel-1.10.3-15.el6_5.1.i686.rpm
krb5-devel-1.10.3-15.el6_5.1.x86_64.rpm
krb5-libs-1.10.3-15.el6_5.1.i686.rpm
krb5-libs-1.10.3-15.el6_5.1.x86_64.rpm
krb5-pkinit-openssl-1.10.3-15.el6_5.1.x86_64.rpm
krb5-server-1.10.3-15.el6_5.1.x86_64.rpm
krb5-server-ldap-1.10.3-15.el6_5.1.i686.rpm
krb5-server-ldap-1.10.3-15.el6_5.1.x86_64.rpm
krb5-workstation-1.10.3-15.el6_5.1.x86_64.rpm
libvirt-0.10.2-29.el6_5.7.x86_64.rpm
libvirt-client-0.10.2-29.el6_5.7.i686.rpm
libvirt-client-0.10.2-29.el6_5.7.x86_64.rpm
libvirt-devel-0.10.2-29.el6_5.7.i686.rpm
libvirt-devel-0.10.2-29.el6_5.7.x86_64.rpm
libvirt-lock-sanlock-0.10.2-29.el6_5.7.x86_64.rpm
libvirt-python-0.10.2-29.el6_5.7.x86_64.rpm
nss-softokn-3.14.3-10.el6_5.i686.rpm
nss-softokn-3.14.3-10.el6_5.x86_64.rpm
nss-softokn-devel-3.14.3-10.el6_5.i686.rpm
nss-softokn-devel-3.14.3-10.el6_5.x86_64.rpm
nss-softokn-freebl-3.14.3-10.el6_5.i686.rpm
nss-softokn-freebl-3.14.3-10.el6_5.x86_64.rpm
nss-softokn-freebl-devel-3.14.3-10.el6_5.i686.rpm
nss-softokn-freebl-devel-3.14.3-10.el6_5.x86_64.rpm
qemu-guest-agent-0.12.1.2-2.415.el6_5.7.x86_64.rpm
qemu-img-0.12.1.2-2.415.el6_5.7.x86_64.rpm
qemu-kvm-0.12.1.2-2.415.el6_5.7.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.415.el6_5.7.x86_64.rpm
rrdtool-1.3.8-7.el6.i686.rpm
rrdtool-1.3.8-7.el6.x86_64.rpm
rrdtool-devel-1.3.8-7.el6.i686.rpm
rrdtool-devel-1.3.8-7.el6.x86_64.rpm
rrdtool-doc-1.3.8-7.el6.x86_64.rpm
rrdtool-perl-1.3.8-7.el6.x86_64.rpm
rrdtool-php-1.3.8-7.el6.x86_64.rpm
rrdtool-python-1.3.8-7.el6.x86_64.rpm
rrdtool-ruby-1.3.8-7.el6.x86_64.rpm
rrdtool-tcl-1.3.8-7.el6.x86_64.rpm
syslinux-4.02-9.el6_5.x86_64.rpm
syslinux-devel-4.02-9.el6_5.i686.rpm
syslinux-devel-4.02-9.el6_5.x86_64.rpm
syslinux-extlinux-4.02-9.el6_5.x86_64.rpm
syslinux-perl-4.02-9.el6_5.x86_64.rpm
syslinux-tftpboot-4.02-9.el6_5.x86_64.rpm
syslinux-4.02-16.el6_5.x86_64.rpm
syslinux-devel-4.02-16.el6_5.i686.rpm
syslinux-devel-4.02-16.el6_5.x86_64.rpm
syslinux-extlinux-4.02-16.el6_5.x86_64.rpm
syslinux-perl-4.02-16.el6_5.x86_64.rpm
syslinux-tftpboot-4.02-16.el6_5.x86_64.rpm
Date: Wed, 16 Apr 2014 14:46:44 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Critical: java-1.7.0-openjdk on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Critical: java-1.7.0-openjdk security update
Advisory ID: SLSA-2014:0406-1
Issue Date: 2014-04-16
CVE Numbers: CVE-2014-1876
 CVE-2014-2398
 CVE-2014-0453
 CVE-2014-0429
 CVE-2014-0457
 CVE-2014-0456
 CVE-2014-2421
 CVE-2014-2397
 CVE-2014-0455
 CVE-2014-0461
 CVE-2014-2412
 CVE-2014-0451
 CVE-2014-0458
 CVE-2014-2414
 CVE-2014-2423
 CVE-2014-0452
 CVE-2014-2402
 CVE-2014-0446
 CVE-2014-0454
 CVE-2014-2427
 CVE-2014-0460
 CVE-2014-2403
 CVE-2014-0459
 CVE-2014-2413
--

An input validation flaw was discovered in the medialib library in the 2D
component. A specially crafted image could trigger Java Virtual Machine
memory corruption when processed. A remote attacker, or an untrusted Java
application or applet, could possibly use this flaw to execute arbitrary
code with the privileges of the user running the Java Virtual Machine.
(CVE-2014-0429)

Multiple flaws were discovered in the Hotspot and 2D components in
OpenJDK. An untrusted Java application or applet could use these flaws to
trigger Java Virtual Machine memory corruption and possibly bypass Java
sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421)

Multiple improper permission check issues were discovered in the Libraries
component in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass Java sandbox restrictions. (CVE-2014-0457,
CVE-2014-0455, CVE-2014-0461)

Multiple improper permission check issues were discovered in the AWT, JAX-
WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK. An
untrusted Java application or applet could use these flaws to bypass
certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451,
CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402,
CVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459)

Multiple flaws were identified in the Java Naming and Directory Interface
(JNDI) DNS client. These flaws could make it easier for a remote attacker
to perform DNS spoofing attacks. (CVE-2014-0460)

It was discovered that the JAXP component did not properly prevent access
to arbitrary files when a SecurityManager was present. This flaw could
cause a Java application using JAXP to leak sensitive information, or
affect application availability. (CVE-2014-2403)

It was discovered that the Security component in OpenJDK could leak some
timing information when performing PKCS#1 unpadding. This could possibly
lead to the disclosure of some information that was meant to be protected
by encryption. (CVE-2014-0453)

It was discovered that the fix for CVE-2013-5797 did not properly resolve
input sanitization flaws in javadoc. When javadoc documentation was
generated from an untrusted Java source code and hosted on a domain not
controlled by the code author, these issues could make it easier to
perform cross-site scripting (XSS) attacks. (CVE-2014-2398)

An insecure temporary file use flaw was found in the way the unpack200
utility created log files. A local attacker could possibly use this flaw
to perform a symbolic link attack and overwrite arbitrary files with the
privileges of the user running unpack200. (CVE-2014-1876)

Note: If the web browser plug-in provided by the icedtea-web package was
installed, the issues exposed via Java applets could have been exploited
without user interaction if a user visited a malicious website.

All running instances of OpenJDK Java must be restarted for the update to
take effect.
--

SL6
 x86_64
 java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
 java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
 java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
 java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
 java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.x86_64.rpm
 i386
 java-1.7.0-openjdk-1.7.0.55-2.4.7.1.el6_5.i686.rpm
 java-1.7.0-openjdk-debuginfo-1.7.0.55-2.4.7.1.el6_5.i686.rpm
 java-1.7.0-openjdk-demo-1.7.0.55-2.4.7.1.el6_5.i686.rpm
 java-1.7.0-openjdk-devel-1.7.0.55-2.4.7.1.el6_5.i686.rpm
 java-1.7.0-openjdk-src-1.7.0.55-2.4.7.1.el6_5.i686.rpm
 noarch
 java-1.7.0-openjdk-javadoc-1.7.0.55-2.4.7.1.el6_5.noarch.rpm

- Scientific Linux Development Team