Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 501
Alerts This Week
Warning Icon 1 501

Ubuntu 12.04 LTS USN-1819-1 Critical: OpenJDK 6 Code Execution Risk

ubuntu
Calendar Grey May 7, 2013
Scroller Ubuntu
Alert Bulletin USN-2510-5 highlights severe openjdk-8 flaws rectifying security integrity and potential remote access.
Several security issues were fixed in OpenJDK 6.

Summary

Several security issues were fixed in OpenJDK 6.

Software Description:

- openjdk-6: Open Source Java implementation

Details:

Ben Murphy discovered a vulnerability in the OpenJDK JRE related to

information disclosure and data integrity. An attacker could exploit this

to execute arbitrary code. (CVE-2013-0401)

James Forshaw discovered a vulnerability in the OpenJDK JRE related to

information disclosure, data integrity and availability. An attacker could

exploit this to execute arbitrary code. (CVE-2013-1488)

Several vulnerabilities were discovered in the OpenJDK JRE related to

information disclosure, data integrity and availability. An attacker could

exploit these to cause a denial of service or expose sensitive data over

the network. (CVE-2013-1518, CVE-2013-1537, CVE-2013-1557, CVE-2013-1558,

CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2420, CVE-2013-2421,

CVE-2013-2422, CVE-2013-2426, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431,

CVE-2013-2436)

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical code execution information disclosure data integrity ubuntu openjdk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  icedtea-6-jre-cacao             6b27-1.12.5-0ubuntu0.12.04.1
  icedtea-6-jre-jamvm             6b27-1.12.5-0ubuntu0.12.04.1
  openjdk-6-jre                   6b27-1.12.5-0ubuntu0.12.04.1
  openjdk-6-jre-headless          6b27-1.12.5-0ubuntu0.12.04.1
  openjdk-6-jre-lib               6b27-1.12.5-0ubuntu0.12.04.1
  openjdk-6-jre-zero              6b27-1.12.5-0ubuntu0.12.04.1

Ubuntu 11.10:
  icedtea-6-jre-cacao             6b27-1.12.5-0ubuntu0.11.10.1
  icedtea-6-jre-jamvm             6b27-1.12.5-0ubuntu0.11.10.1
  openjdk-6-jre                   6b27-1.12.5-0ubuntu0.11.10.1
  openjdk-6-jre-headless          6b27-1.12.5-0ubuntu0.11.10.1
  openjdk-6-jre-lib               6b27-1.12.5-0ubuntu0.11.10.1
  openjdk-6-jre-zero              6b27-1.12.5-0ubuntu0.11.10.1

Ubuntu 10.04 LTS:
  icedtea-6-jre-cacao             6b27-1.12.5-0ubuntu0.10.04.1
  openjdk-6-jre                   6b27-1.12.5-0ubuntu0.10.04.1
  openjdk-6-jre-headless          6b27-1.12.5-0ubuntu0.10.04.1
  openjdk-6-jre-lib               6b27-1.12.5-0ubuntu0.10.04.1
  openjdk-6-jre-zero              6b27-1.12.5-0ubuntu0.10.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1819-1

CVE-2013-0401, CVE-2013-1488, CVE-2013-1518, CVE-2013-1537,

CVE-2013-1557, CVE-2013-1558, CVE-2013-1569, CVE-2013-2383,

CVE-2013-2384, CVE-2013-2415, CVE-2013-2417, CVE-2013-2419,

CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2424,

CVE-2013-2426, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431

Severity
critical
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-1819-1

Topics%20covered

Topics Covered

security advisory critical code execution information disclosure data integrity ubuntu openjdk

Package Information

https://launchpad.net/ubuntu/+source/openjdk-6/6b27-1.12.5-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b27-1.12.5-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b27-1.12.5-0ubuntu0.10.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.