Issued:
2018-10-24
Updated:
2018-10-24

RHSA-2018:3001 - Security Advisory

Synopsis

Critical: java-1.7.0-oracle security update

Type/Severity

Security Advisory: Critical

Topic

An update for java-1.7.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 7 to version 7 Update 201.

Security Fix(es):

  • OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)
  • OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)
  • OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)
  • OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)
  • OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)
  • OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)
  • libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service (CVE-2018-13785)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Oracle Java must be restarted for this update to take effect.

Affected Products

  • Oracle Java (Restricted Maintenance) (for RHEL Server) 7 x86_64
  • Oracle Java (Restricted Maintenance) (for RHEL Client) 7 x86_64
  • Oracle Java (Restricted Maintenance) (for RHEL Compute Node) 7 x86_64
  • Oracle Java (Restricted Maintenance) (for RHEL Workstation) 7 x86_64
  • Oracle Java (Restricted Maintenance) (for RHEL Compute Node) - Extended Update Support 7.5 x86_64
  • Oracle Java (Restricted Maintenance) (for RHEL Server) - Extended Update Support 7.5 x86_64

Fixes

  • BZ - 1599943 - CVE-2018-13785 libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service
  • BZ - 1639293 - CVE-2018-3169 OpenJDK: Improper field access checks (Hotspot, 8199226)
  • BZ - 1639301 - CVE-2018-3214 OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361)
  • BZ - 1639442 - CVE-2018-3139 OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902)
  • BZ - 1639484 - CVE-2018-3180 OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)
  • BZ - 1639755 - CVE-2018-3136 OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)
  • BZ - 1639834 - CVE-2018-3149 OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177)

CVEs

References

Oracle Java (Restricted Maintenance) (for RHEL Server) 7

SRPM
x86_64
java-1.7.0-oracle-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 5b37c97f81369bf040d887d0ecb95d7ed444f95cd7c182764df10c81eac25a46
java-1.7.0-oracle-devel-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: e9b55a5da3f7e4fc81685b655018774abf8e730cbff136d6dce17e528cc224f6
java-1.7.0-oracle-javafx-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 2a5cf5726c531b6c0c16f83a3e41557db1684ca06d573747db09af225414944b
java-1.7.0-oracle-jdbc-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 318d208f00af40f6e92c670ede6a334e0a9dcab647b93d6e6e77b2868d3933c6
java-1.7.0-oracle-plugin-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 8fcd57d232d9cf7e4872e6ac92cd280310e33828eb0642e6a8aa9ddc899f1c2c
java-1.7.0-oracle-src-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 327eba1173684a2ddd2e7b4bb0d64813a37dda8ecc16fa64ee5216beb714acaa

Oracle Java (Restricted Maintenance) (for RHEL Client) 7

SRPM
x86_64
java-1.7.0-oracle-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 5b37c97f81369bf040d887d0ecb95d7ed444f95cd7c182764df10c81eac25a46
java-1.7.0-oracle-devel-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: e9b55a5da3f7e4fc81685b655018774abf8e730cbff136d6dce17e528cc224f6
java-1.7.0-oracle-javafx-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 2a5cf5726c531b6c0c16f83a3e41557db1684ca06d573747db09af225414944b
java-1.7.0-oracle-jdbc-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 318d208f00af40f6e92c670ede6a334e0a9dcab647b93d6e6e77b2868d3933c6
java-1.7.0-oracle-plugin-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 8fcd57d232d9cf7e4872e6ac92cd280310e33828eb0642e6a8aa9ddc899f1c2c
java-1.7.0-oracle-src-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 327eba1173684a2ddd2e7b4bb0d64813a37dda8ecc16fa64ee5216beb714acaa

Oracle Java (Restricted Maintenance) (for RHEL Compute Node) 7

SRPM
x86_64
java-1.7.0-oracle-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 5b37c97f81369bf040d887d0ecb95d7ed444f95cd7c182764df10c81eac25a46
java-1.7.0-oracle-devel-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: e9b55a5da3f7e4fc81685b655018774abf8e730cbff136d6dce17e528cc224f6
java-1.7.0-oracle-javafx-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 2a5cf5726c531b6c0c16f83a3e41557db1684ca06d573747db09af225414944b
java-1.7.0-oracle-src-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 327eba1173684a2ddd2e7b4bb0d64813a37dda8ecc16fa64ee5216beb714acaa

Oracle Java (Restricted Maintenance) (for RHEL Workstation) 7

SRPM
x86_64
java-1.7.0-oracle-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 5b37c97f81369bf040d887d0ecb95d7ed444f95cd7c182764df10c81eac25a46
java-1.7.0-oracle-devel-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: e9b55a5da3f7e4fc81685b655018774abf8e730cbff136d6dce17e528cc224f6
java-1.7.0-oracle-javafx-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 2a5cf5726c531b6c0c16f83a3e41557db1684ca06d573747db09af225414944b
java-1.7.0-oracle-jdbc-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 318d208f00af40f6e92c670ede6a334e0a9dcab647b93d6e6e77b2868d3933c6
java-1.7.0-oracle-plugin-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 8fcd57d232d9cf7e4872e6ac92cd280310e33828eb0642e6a8aa9ddc899f1c2c
java-1.7.0-oracle-src-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 327eba1173684a2ddd2e7b4bb0d64813a37dda8ecc16fa64ee5216beb714acaa

Oracle Java (Restricted Maintenance) (for RHEL Compute Node) - Extended Update Support 7.5

SRPM
x86_64
java-1.7.0-oracle-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 5b37c97f81369bf040d887d0ecb95d7ed444f95cd7c182764df10c81eac25a46
java-1.7.0-oracle-devel-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: e9b55a5da3f7e4fc81685b655018774abf8e730cbff136d6dce17e528cc224f6
java-1.7.0-oracle-javafx-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 2a5cf5726c531b6c0c16f83a3e41557db1684ca06d573747db09af225414944b
java-1.7.0-oracle-src-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 327eba1173684a2ddd2e7b4bb0d64813a37dda8ecc16fa64ee5216beb714acaa

Oracle Java (Restricted Maintenance) (for RHEL Server) - Extended Update Support 7.5

SRPM
x86_64
java-1.7.0-oracle-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 5b37c97f81369bf040d887d0ecb95d7ed444f95cd7c182764df10c81eac25a46
java-1.7.0-oracle-devel-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: e9b55a5da3f7e4fc81685b655018774abf8e730cbff136d6dce17e528cc224f6
java-1.7.0-oracle-javafx-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 2a5cf5726c531b6c0c16f83a3e41557db1684ca06d573747db09af225414944b
java-1.7.0-oracle-jdbc-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 318d208f00af40f6e92c670ede6a334e0a9dcab647b93d6e6e77b2868d3933c6
java-1.7.0-oracle-plugin-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 8fcd57d232d9cf7e4872e6ac92cd280310e33828eb0642e6a8aa9ddc899f1c2c
java-1.7.0-oracle-src-1.7.0.201-1jpp.1.el7.x86_64.rpm SHA-256: 327eba1173684a2ddd2e7b4bb0d64813a37dda8ecc16fa64ee5216beb714acaa

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.