rhsa-2009_1201
Vulnerability from csaf_redhat
Published
2009-08-06 21:14
Modified
2024-11-14 10:47
Summary
Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update
Notes
Topic
Updated java-1.6.0-openjdk packages that fix several security issues and a
bug are now available for Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
Details
These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE)
contains the software and tools that users need to run applications written
using the Java programming language.
A flaw was found in the way the XML Digital Signature implementation in the
JRE handled HMAC-based XML signatures. An attacker could use this flaw to
create a crafted signature that could allow them to bypass authentication,
or trick a user, applet, or application into accepting untrusted content.
(CVE-2009-0217)
Several potential information leaks were found in various mutable static
variables. These could be exploited in application scenarios that execute
untrusted scripting code. (CVE-2009-2475)
It was discovered that OpenType checks can be bypassed. This could allow a
rogue application to bypass access restrictions by acquiring references to
privileged objects through finalizer resurrection. (CVE-2009-2476)
A denial of service flaw was found in the way the JRE processes XML. A
remote attacker could use this flaw to supply crafted XML that would lead
to a denial of service. (CVE-2009-2625)
A flaw was found in the JRE audio system. An untrusted applet or
application could use this flaw to gain read access to restricted System
properties. (CVE-2009-2670)
Two flaws were found in the JRE proxy implementation. An untrusted applet
or application could use these flaws to discover the usernames of users
running applets and applications, or obtain web browser cookies and use
them for session hijacking attacks. (CVE-2009-2671, CVE-2009-2672)
An additional flaw was found in the proxy mechanism implementation. This
flaw allowed an untrusted applet or application to bypass access
restrictions and communicate using non-authorized socket or URL connections
to hosts other than the origin host. (CVE-2009-2673)
An integer overflow flaw was found in the way the JRE processes JPEG
images. An untrusted application could use this flaw to extend its
privileges, allowing it to read and write local files, as well as to
execute local applications with the privileges of the user running the
application. (CVE-2009-2674)
An integer overflow flaw was found in the JRE unpack200 functionality. An
untrusted applet or application could extend its privileges, allowing it to
read and write local files, as well as to execute local applications with
the privileges of the user running the applet or application. (CVE-2009-2675)
It was discovered that JDK13Services grants unnecessary privileges to
certain object types. This could be misused by an untrusted applet or
application to use otherwise restricted functionality. (CVE-2009-2689)
An information disclosure flaw was found in the way private Java variables
were handled. An untrusted applet or application could use this flaw to
obtain information from variables that would otherwise be private.
(CVE-2009-2690)
Note: The flaws concerning applets in this advisory, CVE-2009-2475,
CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675,
CVE-2009-2689, and CVE-2009-2690, can only be triggered in
java-1.6.0-openjdk by calling the "appletviewer" application.
This update also fixes the following bug:
* the EVR in the java-1.6.0-openjdk package as shipped with Red Hat
Enterprise Linux allowed the java-1.6.0-openjdk package from the EPEL
repository to take precedence (appear newer). Users using
java-1.6.0-openjdk from EPEL would not have received security updates since
October 2008. This update prevents the packages from EPEL from taking
precedence. (BZ#499079)
All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated java-1.6.0-openjdk packages that fix several security issues and a\nbug are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.", "title": "Topic" }, { "category": "general", "text": "These packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE)\ncontains the software and tools that users need to run applications written\nusing the Java programming language.\n\nA flaw was found in the way the XML Digital Signature implementation in the\nJRE handled HMAC-based XML signatures. An attacker could use this flaw to\ncreate a crafted signature that could allow them to bypass authentication,\nor trick a user, applet, or application into accepting untrusted content.\n(CVE-2009-0217)\n\nSeveral potential information leaks were found in various mutable static\nvariables. These could be exploited in application scenarios that execute\nuntrusted scripting code. (CVE-2009-2475)\n\nIt was discovered that OpenType checks can be bypassed. This could allow a\nrogue application to bypass access restrictions by acquiring references to\nprivileged objects through finalizer resurrection. (CVE-2009-2476)\n\nA denial of service flaw was found in the way the JRE processes XML. A\nremote attacker could use this flaw to supply crafted XML that would lead\nto a denial of service. (CVE-2009-2625)\n\nA flaw was found in the JRE audio system. An untrusted applet or\napplication could use this flaw to gain read access to restricted System\nproperties. (CVE-2009-2670)\n\nTwo flaws were found in the JRE proxy implementation. An untrusted applet\nor application could use these flaws to discover the usernames of users\nrunning applets and applications, or obtain web browser cookies and use\nthem for session hijacking attacks. (CVE-2009-2671, CVE-2009-2672)\n\nAn additional flaw was found in the proxy mechanism implementation. This\nflaw allowed an untrusted applet or application to bypass access\nrestrictions and communicate using non-authorized socket or URL connections\nto hosts other than the origin host. (CVE-2009-2673) \n\nAn integer overflow flaw was found in the way the JRE processes JPEG\nimages. An untrusted application could use this flaw to extend its\nprivileges, allowing it to read and write local files, as well as to\nexecute local applications with the privileges of the user running the\napplication. (CVE-2009-2674)\n\nAn integer overflow flaw was found in the JRE unpack200 functionality. An\nuntrusted applet or application could extend its privileges, allowing it to\nread and write local files, as well as to execute local applications with\nthe privileges of the user running the applet or application. (CVE-2009-2675)\n\nIt was discovered that JDK13Services grants unnecessary privileges to\ncertain object types. This could be misused by an untrusted applet or\napplication to use otherwise restricted functionality. (CVE-2009-2689)\n\nAn information disclosure flaw was found in the way private Java variables\nwere handled. An untrusted applet or application could use this flaw to\nobtain information from variables that would otherwise be private.\n(CVE-2009-2690)\n\nNote: The flaws concerning applets in this advisory, CVE-2009-2475,\nCVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675,\nCVE-2009-2689, and CVE-2009-2690, can only be triggered in\njava-1.6.0-openjdk by calling the \"appletviewer\" application.\n\nThis update also fixes the following bug:\n\n* the EVR in the java-1.6.0-openjdk package as shipped with Red Hat\nEnterprise Linux allowed the java-1.6.0-openjdk package from the EPEL\nrepository to take precedence (appear newer). Users using\njava-1.6.0-openjdk from EPEL would not have received security updates since\nOctober 2008. This update prevents the packages from EPEL from taking\nprecedence. (BZ#499079)\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2009:1201", "url": "https://access.redhat.com/errata/RHSA-2009:1201" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "http://blogs.sun.com/security/entry/advance_notification_of_security_updates5", "url": "http://blogs.sun.com/security/entry/advance_notification_of_security_updates5" }, { "category": "external", "summary": "499079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=499079" }, { "category": "external", "summary": "511915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915" }, { "category": "external", "summary": "512896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512896" }, { "category": "external", "summary": "512907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512907" }, { "category": "external", "summary": "512914", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512914" }, { "category": "external", "summary": "512915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512915" }, { "category": "external", "summary": "512920", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512920" }, { "category": "external", "summary": "512921", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921" }, { "category": "external", "summary": "513215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513215" }, { "category": "external", "summary": "513220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513220" }, { "category": "external", "summary": "513222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222" }, { "category": "external", "summary": "513223", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1201.json" } ], "title": "Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update", "tracking": { "current_release_date": "2024-11-14T10:47:06+00:00", "generator": { "date": "2024-11-14T10:47:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.0" } }, "id": "RHSA-2009:1201", "initial_release_date": "2009-08-06T21:14:00+00:00", "revision_history": [ { "date": "2009-08-06T21:14:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2009-08-06T17:14:44+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T10:47:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 5 client)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:5::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux (v. 5 server)", "product": { "name": "Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:5::server" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "product": { "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "product_id": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-debuginfo@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "product": { "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "product_id": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-javadoc@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "product": { "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "product_id": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-src@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "product": { "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "product_id": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-demo@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "product": { "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "product_id": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-devel@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "product": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "product_id": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk@1.6.0.0-1.2.b09.el5?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "product": { "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "product_id": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-debuginfo@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "product": { "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "product_id": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-javadoc@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "product": { "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "product_id": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-src@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "product": { "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "product_id": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-demo@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "product": { "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "product_id": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk-devel@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "product": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "product_id": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk@1.6.0.0-1.2.b09.el5?arch=i386\u0026epoch=1" } } } ], "category": "architecture", "name": "i386" }, { "branches": [ { "category": "product_version", "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "product": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "product_id": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.6.0-openjdk@1.6.0.0-1.2.b09.el5?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src" }, "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)", "product_id": "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src" }, "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386" }, "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "relates_to_product_reference": "5Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)", "product_id": "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" }, "product_reference": "java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "relates_to_product_reference": "5Server" } ] }, "vulnerabilities": [ { "cve": "CVE-2009-0217", "discovery_date": "2009-07-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "511915" } ], "notes": [ { "category": "description", "text": "The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.", "title": "Vulnerability description" }, { "category": "summary", "text": "xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-0217" }, { "category": "external", "summary": "RHBZ#511915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=511915" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2009-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0217" } ], "release_date": "2009-07-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass" }, { "cve": "CVE-2009-2475", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "513215" } ], "notes": [ { "category": "description", "text": "Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2475" }, { "category": "external", "summary": "RHBZ#513215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513215" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2475", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2475" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2475", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2475" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)" }, { "cve": "CVE-2009-2476", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "513220" } ], "notes": [ { "category": "description", "text": "The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK OpenType checks can be bypassed (6736293)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2476" }, { "category": "external", "summary": "RHBZ#513220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513220" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2476", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2476" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2476", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2476" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK OpenType checks can be bypassed (6736293)" }, { "cve": "CVE-2009-2625", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512921" } ], "notes": [ { "category": "description", "text": "XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: XML parsing Denial-Of-Service (6845701)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2625" }, { "category": "external", "summary": "RHBZ#512921", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2625", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2625" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2625", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2625" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "JDK: XML parsing Denial-Of-Service (6845701)" }, { "cve": "CVE-2009-2670", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512896" } ], "notes": [ { "category": "description", "text": "The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK Untrusted applet System properties access (6738524)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2670" }, { "category": "external", "summary": "RHBZ#512896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512896" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2670", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2670" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2670", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2670" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK Untrusted applet System properties access (6738524)" }, { "cve": "CVE-2009-2671", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512907" } ], "notes": [ { "category": "description", "text": "The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK Proxy mechanism information leaks (6801071)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2671" }, { "category": "external", "summary": "RHBZ#512907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512907" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2671", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2671" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2671", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2671" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "OpenJDK Proxy mechanism information leaks (6801071)" }, { "cve": "CVE-2009-2672", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512907" } ], "notes": [ { "category": "description", "text": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK Proxy mechanism information leaks (6801071)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2672" }, { "category": "external", "summary": "RHBZ#512907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512907" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2672", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2672" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2672", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2672" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "OpenJDK Proxy mechanism information leaks (6801071)" }, { "cve": "CVE-2009-2673", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512914" } ], "notes": [ { "category": "description", "text": "The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK proxy mechanism allows non-authorized socket connections (6801497)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2673" }, { "category": "external", "summary": "RHBZ#512914", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512914" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2673", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2673" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2673", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2673" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "OpenJDK proxy mechanism allows non-authorized socket connections (6801497)" }, { "cve": "CVE-2009-2674", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512915" } ], "notes": [ { "category": "description", "text": "Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow.", "title": "Vulnerability description" }, { "category": "summary", "text": "Java Web Start Buffer JPEG processing integer overflow (6823373)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2674" }, { "category": "external", "summary": "RHBZ#512915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512915" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2674", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2674" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2674", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2674" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Java Web Start Buffer JPEG processing integer overflow (6823373)" }, { "cve": "CVE-2009-2675", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "512920" } ], "notes": [ { "category": "description", "text": "Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file, which leads to a heap-based buffer overflow during decompression.", "title": "Vulnerability description" }, { "category": "summary", "text": "Java Web Start Buffer unpack200 processing integer overflow (6830335)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2675" }, { "category": "external", "summary": "RHBZ#512920", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512920" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2675", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2675" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2675", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2675" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Java Web Start Buffer unpack200 processing integer overflow (6830335)" }, { "cve": "CVE-2009-2689", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "513222" } ], "notes": [ { "category": "description", "text": "JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK JDK13Services grants unnecessary privileges (6777448)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2689" }, { "category": "external", "summary": "RHBZ#513222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513222" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2689", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2689" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2689", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2689" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK JDK13Services grants unnecessary privileges (6777448)" }, { "cve": "CVE-2009-2690", "discovery_date": "2009-07-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "513223" } ], "notes": [ { "category": "description", "text": "The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK private variable information disclosure (6777487)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-2690" }, { "category": "external", "summary": "RHBZ#513223", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=513223" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-2690", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2690" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-2690", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2690" } ], "release_date": "2009-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2009-08-06T21:14:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2009:1201" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Client:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Client:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.src", "5Server:java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5.x86_64", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.i386", "5Server:java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK private variable information disclosure (6777487)" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.