Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Integration
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
  • Red Hat JBoss Data Virtualization
  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager
All Products
Red Hat Product Errata RHSA-2015:1921 - Security Advisory
Issued:
2015-10-21
Updated:
2015-10-21

RHSA-2015:1921 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: java-1.7.0-openjdk security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated java-1.7.0-openjdk packages that fix multiple security issues are
now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime
Environment and the OpenJDK 7 Java Software Development Kit.

Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,
and 2D components in OpenJDK. An untrusted Java application or applet could
use these flaws to completely bypass Java sandbox restrictions.
(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,
CVE-2015-4805, CVE-2015-4844)

Multiple denial of service flaws were found in the JAXP component in
OpenJDK. A specially crafted XML file could cause a Java application using
JAXP to consume an excessive amount of CPU and memory when parsed.
(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)

It was discovered that the Security component in OpenJDK failed to properly
check if a certificate satisfied all defined constraints. In certain cases,
this could cause a Java application to accept an X.509 certificate which
does not meet requirements of the defined policy. (CVE-2015-4872)

Multiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI
components in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,
CVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)

Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the
CVE-2015-4806 issue.

All users of java-1.7.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 1233687 - CVE-2015-4806 OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193)
  • BZ - 1273022 - CVE-2015-4835 OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383)
  • BZ - 1273027 - CVE-2015-4881 OpenJDK: missing type checks in IIOPInputStream (CORBA, 8076392)
  • BZ - 1273053 - CVE-2015-4843 OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891)
  • BZ - 1273304 - CVE-2015-4883 OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413)
  • BZ - 1273308 - CVE-2015-4860 OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688)
  • BZ - 1273311 - CVE-2015-4805 OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671)
  • BZ - 1273318 - CVE-2015-4844 ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042)
  • BZ - 1273338 - CVE-2015-4840 OpenJDK: OOB access in CMS code (2D, 8086092)
  • BZ - 1273414 - CVE-2015-4882 OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387)
  • BZ - 1273425 - CVE-2015-4842 OpenJDK: leak of user.dir location (JAXP, 8078427)
  • BZ - 1273430 - CVE-2015-4734 OpenJDK: kerberos realm name leak (JGSS, 8048030)
  • BZ - 1273496 - CVE-2015-4903 OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339)
  • BZ - 1273637 - CVE-2015-4803 OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842)
  • BZ - 1273638 - CVE-2015-4893 OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733)
  • BZ - 1273645 - CVE-2015-4911 OpenJDK: incomplete supportDTD enforcement (JAXP, 8130078)
  • BZ - 1273734 - CVE-2015-4872 OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291)

CVEs

  • CVE-2015-4843
  • CVE-2015-4842
  • CVE-2015-4840
  • CVE-2015-4872
  • CVE-2015-4860
  • CVE-2015-4844
  • CVE-2015-4911
  • CVE-2015-4893
  • CVE-2015-4883
  • CVE-2015-4734
  • CVE-2015-4881
  • CVE-2015-4882
  • CVE-2015-4903
  • CVE-2015-4806
  • CVE-2015-4805
  • CVE-2015-4803
  • CVE-2015-4835

References

  • https://access.redhat.com/security/updates/classification/#important
Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server 5

SRPM
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.src.rpm SHA-256: 409f5025530d982c38fe050d17dc23afce1498b2b8c0981ea8f537823f3c2efe
x86_64
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 437ba9f4fa47fae5037c58f7f65a43f27083103c102109dfebb9b76817ee3ad2
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: b7d27b6b373b794320a6c46d8ef9986ec6cd05832f560d7bf9c0c6b0cf894853
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: a03685b3df0fd8acd5e90f36d9fbbb1cec5d4b63e2921ff0b21cbcab2c6718d5
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 0f0f97cab1002f97969e02aadf0cd7426a6ef7ed14de8d30b444928eadf7a616
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 1e1556aa8d8702cb22527f7c0c6f6acb1ff930b5ac2e50ca840f79f0792fae7a
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 49c68a4812755c7eaebf2756be08afebd16e04d337493dc61d31358e1f8c3016
i386
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 76d098e68ee42ace2dd8ec4dbb48c62c6155e7648b4c5937011b90ebe0185e7b
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 13753135b58e788e0c19caabc91f84ea529824c6c9c06b692ecd9d676b8ad158
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 20c472e343b6d943018eddf49e584f0134c6466f14f0a62f4c1594967ce77ed7
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: c8e5364c41c025561ac844088ab7cd9046a7722d5653f13af6dbba85821aa208
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 68416a3be85936b9403ee39bf6a6395306a178575deaab36424d18dbc534a54f
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 0c743971243576014dabe4aa6319d8d93788825f5b012fe6071494b6a5f4a3ca

Red Hat Enterprise Linux Workstation 5

SRPM
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.src.rpm SHA-256: 409f5025530d982c38fe050d17dc23afce1498b2b8c0981ea8f537823f3c2efe
x86_64
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 437ba9f4fa47fae5037c58f7f65a43f27083103c102109dfebb9b76817ee3ad2
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: b7d27b6b373b794320a6c46d8ef9986ec6cd05832f560d7bf9c0c6b0cf894853
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: a03685b3df0fd8acd5e90f36d9fbbb1cec5d4b63e2921ff0b21cbcab2c6718d5
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 0f0f97cab1002f97969e02aadf0cd7426a6ef7ed14de8d30b444928eadf7a616
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 1e1556aa8d8702cb22527f7c0c6f6acb1ff930b5ac2e50ca840f79f0792fae7a
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 49c68a4812755c7eaebf2756be08afebd16e04d337493dc61d31358e1f8c3016
i386
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 76d098e68ee42ace2dd8ec4dbb48c62c6155e7648b4c5937011b90ebe0185e7b
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 13753135b58e788e0c19caabc91f84ea529824c6c9c06b692ecd9d676b8ad158
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 20c472e343b6d943018eddf49e584f0134c6466f14f0a62f4c1594967ce77ed7
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: c8e5364c41c025561ac844088ab7cd9046a7722d5653f13af6dbba85821aa208
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 68416a3be85936b9403ee39bf6a6395306a178575deaab36424d18dbc534a54f
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 0c743971243576014dabe4aa6319d8d93788825f5b012fe6071494b6a5f4a3ca

Red Hat Enterprise Linux Desktop 5

SRPM
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.src.rpm SHA-256: 409f5025530d982c38fe050d17dc23afce1498b2b8c0981ea8f537823f3c2efe
x86_64
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 437ba9f4fa47fae5037c58f7f65a43f27083103c102109dfebb9b76817ee3ad2
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: b7d27b6b373b794320a6c46d8ef9986ec6cd05832f560d7bf9c0c6b0cf894853
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: a03685b3df0fd8acd5e90f36d9fbbb1cec5d4b63e2921ff0b21cbcab2c6718d5
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 0f0f97cab1002f97969e02aadf0cd7426a6ef7ed14de8d30b444928eadf7a616
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 1e1556aa8d8702cb22527f7c0c6f6acb1ff930b5ac2e50ca840f79f0792fae7a
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 49c68a4812755c7eaebf2756be08afebd16e04d337493dc61d31358e1f8c3016
i386
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 76d098e68ee42ace2dd8ec4dbb48c62c6155e7648b4c5937011b90ebe0185e7b
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 13753135b58e788e0c19caabc91f84ea529824c6c9c06b692ecd9d676b8ad158
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 20c472e343b6d943018eddf49e584f0134c6466f14f0a62f4c1594967ce77ed7
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: c8e5364c41c025561ac844088ab7cd9046a7722d5653f13af6dbba85821aa208
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 68416a3be85936b9403ee39bf6a6395306a178575deaab36424d18dbc534a54f
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 0c743971243576014dabe4aa6319d8d93788825f5b012fe6071494b6a5f4a3ca

Red Hat Enterprise Linux Server from RHUI 5

SRPM
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.src.rpm SHA-256: 409f5025530d982c38fe050d17dc23afce1498b2b8c0981ea8f537823f3c2efe
x86_64
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 437ba9f4fa47fae5037c58f7f65a43f27083103c102109dfebb9b76817ee3ad2
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: b7d27b6b373b794320a6c46d8ef9986ec6cd05832f560d7bf9c0c6b0cf894853
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: a03685b3df0fd8acd5e90f36d9fbbb1cec5d4b63e2921ff0b21cbcab2c6718d5
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 0f0f97cab1002f97969e02aadf0cd7426a6ef7ed14de8d30b444928eadf7a616
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 1e1556aa8d8702cb22527f7c0c6f6acb1ff930b5ac2e50ca840f79f0792fae7a
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.x86_64.rpm SHA-256: 49c68a4812755c7eaebf2756be08afebd16e04d337493dc61d31358e1f8c3016
i386
java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 76d098e68ee42ace2dd8ec4dbb48c62c6155e7648b4c5937011b90ebe0185e7b
java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 13753135b58e788e0c19caabc91f84ea529824c6c9c06b692ecd9d676b8ad158
java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 20c472e343b6d943018eddf49e584f0134c6466f14f0a62f4c1594967ce77ed7
java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: c8e5364c41c025561ac844088ab7cd9046a7722d5653f13af6dbba85821aa208
java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 68416a3be85936b9403ee39bf6a6395306a178575deaab36424d18dbc534a54f
java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11.i386.rpm SHA-256: 0c743971243576014dabe4aa6319d8d93788825f5b012fe6071494b6a5f4a3ca

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
Copyright © 2022 Red Hat, Inc.
  • Privacy Statement
  • Customer Portal Terms of Use
  • All Policies and Guidelines
Red Hat Summit
Twitter