Date:         Mon, 3 Nov 2014 17:53:48 +0000
Reply-To:     scientific-linux-users@listserv.fnal.gov
Sender:       Security Errata for Scientific Linux
              
From:         Pat Riehecky 
Subject:      Security ERRATA Important: java-1.8.0-openjdk on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis:          Important: java-1.8.0-openjdk security update
Advisory ID:       SLSA-2014:1636-1
Issue Date:        2014-10-15
CVE Numbers:       CVE-2014-6512
                   CVE-2014-6506
                   CVE-2014-6504
                   CVE-2014-6519
                   CVE-2014-6531
                   CVE-2014-6502
                   CVE-2014-6457
                   CVE-2014-6558
                   CVE-2014-6517
                   CVE-2014-6511
                   CVE-2014-6562
                   CVE-2014-6468
--

It was discovered that the Libraries component in OpenJDK failed to
properly handle ZIP archives that contain entries with a NUL byte used in
the file names. An untrusted Java application or applet could use this
flaw to bypass Java sandbox restrictions. (CVE-2014-6562)

Multiple flaws were discovered in the Libraries, 2D, and Hotspot
components in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass certain Java sandbox restrictions. (CVE-2014-6506,
CVE-2014-6531, CVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519)

It was discovered that the StAX XML parser in the JAXP component in
OpenJDK performed expansion of external parameter entities even when
external entity substitution was disabled. A remote attacker could use
this flaw to perform XML eXternal Entity (XXE) attack against applications
using the StAX parser to parse untrusted XML documents. (CVE-2014-6517)

It was discovered that the Hotspot component in OpenJDK failed to properly
handle malformed Shared Archive files. A local attacker able to modify a
Shared Archive file used by a virtual machine of a different user could
possibly use this flaw to escalate their privileges. (CVE-2014-6468)

It was discovered that the DatagramSocket implementation in OpenJDK failed
to perform source address checks for packets received on a connected
socket. A remote attacker could use this flaw to have their packets
processed as if they were received from the expected source.
(CVE-2014-6512)

It was discovered that the TLS/SSL implementation in the JSSE component in
OpenJDK failed to properly verify the server identity during the
renegotiation following session resumption, making it possible for
malicious TLS/SSL servers to perform a Triple Handshake attack against
clients using JSSE and client certificate authentication. (CVE-2014-6457)

It was discovered that the CipherInputStream class implementation in
OpenJDK did not properly handle certain exceptions. This could possibly
allow an attacker to affect the integrity of an encrypted stream handled
by this class. (CVE-2014-6558)

All running instances of OpenJDK Java must be restarted for the update to
take effect.
--

SL6
  x86_64
    java-1.8.0-openjdk-1.8.0.25-1.b17.el6.x86_64.rpm
    java-1.8.0-openjdk-debuginfo-1.8.0.25-1.b17.el6.x86_64.rpm
    java-1.8.0-openjdk-headless-1.8.0.25-1.b17.el6.x86_64.rpm
    java-1.8.0-openjdk-demo-1.8.0.25-1.b17.el6.x86_64.rpm
    java-1.8.0-openjdk-devel-1.8.0.25-1.b17.el6.x86_64.rpm
    java-1.8.0-openjdk-src-1.8.0.25-1.b17.el6.x86_64.rpm
  i386
    java-1.8.0-openjdk-1.8.0.25-1.b17.el6.i686.rpm
    java-1.8.0-openjdk-debuginfo-1.8.0.25-1.b17.el6.i686.rpm
    java-1.8.0-openjdk-headless-1.8.0.25-1.b17.el6.i686.rpm
    java-1.8.0-openjdk-demo-1.8.0.25-1.b17.el6.i686.rpm
    java-1.8.0-openjdk-devel-1.8.0.25-1.b17.el6.i686.rpm
    java-1.8.0-openjdk-src-1.8.0.25-1.b17.el6.i686.rpm
  noarch
    java-1.8.0-openjdk-javadoc-1.8.0.25-1.b17.el6.noarch.rpm

- Scientific Linux Development Team