rhsa-2014_0027
Vulnerability from csaf_redhat
Published
2014-01-15 00:59
Modified
2024-11-14 14:26
Summary
Red Hat Security Advisory: java-1.7.0-openjdk security update
Notes
Topic
Updated java-1.7.0-openjdk packages that fix various security issues are
now available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
These packages provide the OpenJDK 7 Java Runtime Environment and the
OpenJDK 7 Software Development Kit.
An input validation flaw was discovered in the font layout engine in the 2D
component. A specially crafted font file could trigger Java Virtual Machine
memory corruption when processed. An untrusted Java application or applet
could possibly use this flaw to bypass Java sandbox restrictions.
(CVE-2013-5907)
Multiple improper permission check issues were discovered in the CORBA,
JNDI, and Libraries components in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2014-0428, CVE-2014-0422, CVE-2013-5893)
Multiple improper permission check issues were discovered in the
Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in
OpenJDK. An untrusted Java application or applet could use these flaws to
bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878,
CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376,
CVE-2014-0368)
It was discovered that the Beans component did not restrict processing of
XML external entities. This flaw could cause a Java application using Beans
to leak sensitive information, or affect application availability.
(CVE-2014-0423)
It was discovered that the JSSE component could leak timing information
during the TLS/SSL handshake. This could possibly lead to disclosure of
information about the used encryption keys. (CVE-2014-0411)
All users of java-1.7.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated java-1.7.0-openjdk packages that fix various security issues are\nnow available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "These packages provide the OpenJDK 7 Java Runtime Environment and the\nOpenJDK 7 Software Development Kit.\n\nAn input validation flaw was discovered in the font layout engine in the 2D\ncomponent. A specially crafted font file could trigger Java Virtual Machine\nmemory corruption when processed. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2013-5907)\n\nMultiple improper permission check issues were discovered in the CORBA,\nJNDI, and Libraries components in OpenJDK. An untrusted Java application or\napplet could use these flaws to bypass Java sandbox restrictions.\n(CVE-2014-0428, CVE-2014-0422, CVE-2013-5893)\n\nMultiple improper permission check issues were discovered in the\nServiceability, Security, CORBA, JAAS, JAXP, and Networking components in\nOpenJDK. An untrusted Java application or applet could use these flaws to\nbypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878,\nCVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376,\nCVE-2014-0368)\n\nIt was discovered that the Beans component did not restrict processing of\nXML external entities. This flaw could cause a Java application using Beans\nto leak sensitive information, or affect application availability.\n(CVE-2014-0423)\n\nIt was discovered that the JSSE component could leak timing information\nduring the TLS/SSL handshake. This could possibly lead to disclosure of\ninformation about the used encryption keys. (CVE-2014-0411)\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0027",
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
},
{
"category": "external",
"summary": "1051519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051519"
},
{
"category": "external",
"summary": "1051528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051528"
},
{
"category": "external",
"summary": "1051549",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051549"
},
{
"category": "external",
"summary": "1051699",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051699"
},
{
"category": "external",
"summary": "1051823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051823"
},
{
"category": "external",
"summary": "1051911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051911"
},
{
"category": "external",
"summary": "1051912",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051912"
},
{
"category": "external",
"summary": "1051923",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051923"
},
{
"category": "external",
"summary": "1052915",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052915"
},
{
"category": "external",
"summary": "1052919",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052919"
},
{
"category": "external",
"summary": "1052942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052942"
},
{
"category": "external",
"summary": "1053010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053010"
},
{
"category": "external",
"summary": "1053066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053066"
},
{
"category": "external",
"summary": "1053266",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053266"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0027.json"
}
],
"title": "Red Hat Security Advisory: java-1.7.0-openjdk security update",
"tracking": {
"current_release_date": "2024-11-14T14:26:01+00:00",
"generator": {
"date": "2024-11-14T14:26:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2014:0027",
"initial_release_date": "2014-01-15T00:59:08+00:00",
"revision_history": [
{
"date": "2014-01-15T00:59:08+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-01-15T00:59:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T14:26:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_id": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-javadoc@1.7.0.51-2.4.4.1.el5_10?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_id": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-demo@1.7.0.51-2.4.4.1.el5_10?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_id": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk@1.7.0.51-2.4.4.1.el5_10?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_id": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-src@1.7.0.51-2.4.4.1.el5_10?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_id": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-debuginfo@1.7.0.51-2.4.4.1.el5_10?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_id": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-devel@1.7.0.51-2.4.4.1.el5_10?arch=i386\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_id": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-javadoc@1.7.0.51-2.4.4.1.el5_10?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_id": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-demo@1.7.0.51-2.4.4.1.el5_10?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_id": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk@1.7.0.51-2.4.4.1.el5_10?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_id": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-src@1.7.0.51-2.4.4.1.el5_10?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_id": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-debuginfo@1.7.0.51-2.4.4.1.el5_10?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_id": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-devel@1.7.0.51-2.4.4.1.el5_10?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"product": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"product_id": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk@1.7.0.51-2.4.4.1.el5_10?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Client-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"relates_to_product_reference": "5Server-5.10.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"relates_to_product_reference": "5Server-5.10.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Arun Babu Neelicattu"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-4578",
"discovery_date": "2013-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1031471"
}
],
"notes": [
{
"category": "description",
"text": "jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4578"
},
{
"category": "external",
"summary": "RHBZ#1031471",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1031471"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4578",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4578"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars"
},
{
"cve": "CVE-2013-5878",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051823"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the Security component does not properly handle null XML namespace (xmlns) attributes during XML document canonicalization, which allows attackers to escape the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: null xmlns handling issue (Security, 8025026)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5878"
},
{
"category": "external",
"summary": "RHBZ#1051823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5878",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5878"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5878",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5878"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenJDK: null xmlns handling issue (Security, 8025026)"
},
{
"cve": "CVE-2013-5884",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051911"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an incorrect check for code permissions by CORBA stub factories.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5884"
},
{
"category": "external",
"summary": "RHBZ#1051911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5884",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5884"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5884",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5884"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193)"
},
{
"cve": "CVE-2013-5893",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051549"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 7u45 and Java SE Embedded 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to improper handling of methods in MethodHandles in HotSpot JVM, which allows attackers to escape the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: JVM method processing issues (Libraries, 8029507)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5893"
},
{
"category": "external",
"summary": "RHBZ#1051549",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051549"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5893",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5893"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "OpenJDK: JVM method processing issues (Libraries, 8029507)"
},
{
"cve": "CVE-2013-5896",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1053266"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that com.sun.corba.se and its sub-packages are not included on the restricted package list.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5896"
},
{
"category": "external",
"summary": "RHBZ#1053266",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053266"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5896",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5896"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5896",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5896"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
},
{
"category": "workaround",
"details": "Applications running with a security manager that make direct use of classes\nin these JDK internal packages, need to adjust their security policy to\ngrant access. See Java Security Policy Files documentation.",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022)"
},
{
"cve": "CVE-2013-5907",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1052915"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5907"
},
{
"category": "external",
"summary": "RHBZ#1052915",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052915"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5907",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5907"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034)"
},
{
"cve": "CVE-2013-5910",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1052942"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that CanonicalizerBase.java in the XML canonicalizer allows untrusted code to access mutable byte arrays.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5910"
},
{
"category": "external",
"summary": "RHBZ#1052942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5910",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5910"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5910",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5910"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417)"
},
{
"cve": "CVE-2014-0368",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1052919"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insufficient Socket checkListen checks (Networking, 8011786)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0368"
},
{
"category": "external",
"summary": "RHBZ#1052919",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052919"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0368",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0368"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: insufficient Socket checkListen checks (Networking, 8011786)"
},
{
"cve": "CVE-2014-0373",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051699"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0373"
},
{
"category": "external",
"summary": "RHBZ#1051699",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051699"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0373",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0373"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0373",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0373"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126)"
},
{
"cve": "CVE-2014-0376",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051923"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for \"code permissions when creating document builder factories.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0376"
},
{
"category": "external",
"summary": "RHBZ#1051923",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051923"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0376",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0376"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0376",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0376"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018)"
},
{
"cve": "CVE-2014-0411",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1053010"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0411"
},
{
"category": "external",
"summary": "RHBZ#1053010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053010"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0411",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0411"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)"
},
{
"cve": "CVE-2014-0416",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051912"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insecure subject principals set handling (JAAS, 8024306)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0416"
},
{
"category": "external",
"summary": "RHBZ#1051912",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051912"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0416",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0416"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: insecure subject principals set handling (JAAS, 8024306)"
},
{
"cve": "CVE-2014-0422",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051528"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0422"
},
{
"category": "external",
"summary": "RHBZ#1051528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051528"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0422",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0422"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0422",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0422"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758)"
},
{
"cve": "CVE-2014-0423",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1053066"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XXE issue in decoder (Beans, 8023245)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0423"
},
{
"category": "external",
"summary": "RHBZ#1053066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053066"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0423",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0423"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0423",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0423"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XXE issue in decoder (Beans, 8023245)"
},
{
"cve": "CVE-2014-0428",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051519"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to \"insufficient security checks in IIOP streams,\" which allows attackers to escape the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0428"
},
{
"category": "external",
"summary": "RHBZ#1051519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0428",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0428"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
}
],
"release_date": "2014-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-15T00:59:08+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0027"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Client-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Client-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.src",
"5Server-5.10.Z:java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10.x86_64",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.i386",
"5Server-5.10.Z:java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767)"
}
]
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.