rhsa-2014_1633
Vulnerability from csaf_redhat
Published
2014-10-14 20:47
Modified
2024-09-13 09:19
Summary
Red Hat Security Advisory: java-1.7.0-openjdk security and bug fix update
Notes
Topic
Updated java-1.7.0-openjdk packages that fix multiple security issues and
one bug are now available for Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime
Environment and the OpenJDK 7 Java Software Development Kit.
Multiple flaws were discovered in the Libraries, 2D, and Hotspot components
in OpenJDK. An untrusted Java application or applet could use these flaws
to bypass certain Java sandbox restrictions. (CVE-2014-6506, CVE-2014-6531,
CVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519)
It was discovered that the StAX XML parser in the JAXP component in OpenJDK
performed expansion of external parameter entities even when external
entity substitution was disabled. A remote attacker could use this flaw to
perform XML eXternal Entity (XXE) attack against applications using the
StAX parser to parse untrusted XML documents. (CVE-2014-6517)
It was discovered that the DatagramSocket implementation in OpenJDK failed
to perform source address checks for packets received on a connected
socket. A remote attacker could use this flaw to have their packets
processed as if they were received from the expected source.
(CVE-2014-6512)
It was discovered that the TLS/SSL implementation in the JSSE component in
OpenJDK failed to properly verify the server identity during the
renegotiation following session resumption, making it possible for
malicious TLS/SSL servers to perform a Triple Handshake attack against
clients using JSSE and client certificate authentication. (CVE-2014-6457)
It was discovered that the CipherInputStream class implementation in
OpenJDK did not properly handle certain exceptions. This could possibly
allow an attacker to affect the integrity of an encrypted stream handled by
this class. (CVE-2014-6558)
The CVE-2014-6512 was discovered by Florian Weimer of Red Hat Product
Security.
This update also fixes the following bug:
* The TLS/SSL implementation in OpenJDK previously failed to handle
Diffie-Hellman (DH) keys with more than 1024 bits. This caused client
applications using JSSE to fail to establish TLS/SSL connections to servers
using larger DH keys during the connection handshake. This update adds
support for DH keys with size up to 2048 bits. (BZ#1148309)
All users of java-1.7.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated java-1.7.0-openjdk packages that fix multiple security issues and\none bug are now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the Libraries, 2D, and Hotspot components\nin OpenJDK. An untrusted Java application or applet could use these flaws\nto bypass certain Java sandbox restrictions. (CVE-2014-6506, CVE-2014-6531,\nCVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519)\n\nIt was discovered that the StAX XML parser in the JAXP component in OpenJDK\nperformed expansion of external parameter entities even when external\nentity substitution was disabled. A remote attacker could use this flaw to\nperform XML eXternal Entity (XXE) attack against applications using the\nStAX parser to parse untrusted XML documents. (CVE-2014-6517)\n\nIt was discovered that the DatagramSocket implementation in OpenJDK failed\nto perform source address checks for packets received on a connected\nsocket. A remote attacker could use this flaw to have their packets\nprocessed as if they were received from the expected source.\n(CVE-2014-6512)\n\nIt was discovered that the TLS/SSL implementation in the JSSE component in\nOpenJDK failed to properly verify the server identity during the\nrenegotiation following session resumption, making it possible for\nmalicious TLS/SSL servers to perform a Triple Handshake attack against\nclients using JSSE and client certificate authentication. (CVE-2014-6457)\n\nIt was discovered that the CipherInputStream class implementation in\nOpenJDK did not properly handle certain exceptions. This could possibly\nallow an attacker to affect the integrity of an encrypted stream handled by\nthis class. (CVE-2014-6558)\n\nThe CVE-2014-6512 was discovered by Florian Weimer of Red Hat Product\nSecurity.\n\nThis update also fixes the following bug:\n\n* The TLS/SSL implementation in OpenJDK previously failed to handle\nDiffie-Hellman (DH) keys with more than 1024 bits. This caused client\napplications using JSSE to fail to establish TLS/SSL connections to servers\nusing larger DH keys during the connection handshake. This update adds\nsupport for DH keys with size up to 2048 bits. (BZ#1148309)\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:1633",
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1071210",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071210"
},
{
"category": "external",
"summary": "1150155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150155"
},
{
"category": "external",
"summary": "1150182",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150182"
},
{
"category": "external",
"summary": "1150273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150273"
},
{
"category": "external",
"summary": "1150651",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150651"
},
{
"category": "external",
"summary": "1150669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150669"
},
{
"category": "external",
"summary": "1151046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151046"
},
{
"category": "external",
"summary": "1151063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151063"
},
{
"category": "external",
"summary": "1151364",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151364"
},
{
"category": "external",
"summary": "1151517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151517"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2014/rhsa-2014_1633.json"
}
],
"title": "Red Hat Security Advisory: java-1.7.0-openjdk security and bug fix update",
"tracking": {
"current_release_date": "2024-09-13T09:19:42+00:00",
"generator": {
"date": "2024-09-13T09:19:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2014:1633",
"initial_release_date": "2014-10-14T20:47:46+00:00",
"revision_history": [
{
"date": "2014-10-14T20:47:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-10-14T20:47:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T09:19:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_id": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-debuginfo@1.7.0.71-2.5.3.1.el5_11?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_id": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk@1.7.0.71-2.5.3.1.el5_11?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_id": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-javadoc@1.7.0.71-2.5.3.1.el5_11?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_id": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-demo@1.7.0.71-2.5.3.1.el5_11?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_id": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-src@1.7.0.71-2.5.3.1.el5_11?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_id": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-devel@1.7.0.71-2.5.3.1.el5_11?arch=i386\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_id": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-debuginfo@1.7.0.71-2.5.3.1.el5_11?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_id": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk@1.7.0.71-2.5.3.1.el5_11?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_id": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-javadoc@1.7.0.71-2.5.3.1.el5_11?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_id": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-demo@1.7.0.71-2.5.3.1.el5_11?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_id": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-src@1.7.0.71-2.5.3.1.el5_11?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_id": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk-devel@1.7.0.71-2.5.3.1.el5_11?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"product": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"product_id": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/java-1.7.0-openjdk@1.7.0.71-2.5.3.1.el5_11?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
},
"product_reference": "java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-6457",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1151046"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6457"
},
{
"category": "external",
"summary": "RHBZ#1151046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151046"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6457",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6457"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6457",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6457"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066)"
},
{
"cve": "CVE-2014-6502",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1150669"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6502"
},
{
"category": "external",
"summary": "RHBZ#1150669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6502",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6502"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)"
},
{
"cve": "CVE-2014-6504",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1150182"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: incorrect optimization of range checks in C2 compiler (Hotspot, 8022783)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6504"
},
{
"category": "external",
"summary": "RHBZ#1150182",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150182"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6504",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6504"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: incorrect optimization of range checks in C2 compiler (Hotspot, 8022783)"
},
{
"cve": "CVE-2014-6506",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1150155"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6506"
},
{
"category": "external",
"summary": "RHBZ#1150155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150155"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6506",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6506"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564)"
},
{
"cve": "CVE-2014-6511",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1151517"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6511"
},
{
"category": "external",
"summary": "RHBZ#1151517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151517"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6511",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6511"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6511",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6511"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)"
},
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-6512",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1071210"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the DatagramSocket implementation in OpenJDK failed to perform source address checks for packets received on a connected socket. A remote attacker could use this flaw to have their packets processed as if they were received from the expected source.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6512"
},
{
"category": "external",
"summary": "RHBZ#1071210",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071210"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6512",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6512"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509)"
},
{
"cve": "CVE-2014-6517",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1151364"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: StAX parser parameter entity XXE (JAXP, 8039533)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6517"
},
{
"category": "external",
"summary": "RHBZ#1151364",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151364"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6517",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6517"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6517",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6517"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: StAX parser parameter entity XXE (JAXP, 8039533)"
},
{
"cve": "CVE-2014-6519",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1150273"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 7u67 and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Hotspot.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: missing BootstrapMethods bounds check (Hotspot, 8041717)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6519"
},
{
"category": "external",
"summary": "RHBZ#1150273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150273"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6519",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6519"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6519",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6519"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: missing BootstrapMethods bounds check (Hotspot, 8041717)"
},
{
"cve": "CVE-2014-6531",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1150651"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6531"
},
{
"category": "external",
"summary": "RHBZ#1150651",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1150651"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6531",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6531"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6531",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6531"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274)"
},
{
"cve": "CVE-2014-6558",
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1151063"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the CipherInputStream class implementation in OpenJDK did not properly handle certain exceptions. This could possibly allow an attacker to affect the integrity of an encrypted stream handled by this class.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-6558"
},
{
"category": "external",
"summary": "RHBZ#1151063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151063"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-6558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6558"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA"
}
],
"release_date": "2014-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1633"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Client-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Client-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.src",
"5Server-5.11.Z:java-1.7.0-openjdk-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-debuginfo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-demo-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-devel-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-javadoc-1:1.7.0.71-2.5.3.1.el5_11.x86_64",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.i386",
"5Server-5.11.Z:java-1.7.0-openjdk-src-1:1.7.0.71-2.5.3.1.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846)"
}
]
}
Loading...