Issued:
2019-05-13
Updated:
2019-05-13

RHSA-2019:1165 - Security Advisory

Synopsis

Important: java-1.7.1-ibm security update

Type/Severity

Security Advisory: Important

Topic

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP45.

Security Fix(es):

  • Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)
  • OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)
  • OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)
  • OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)
  • IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux Server 6 x86_64
  • Red Hat Enterprise Linux Server 6 i386
  • Red Hat Enterprise Linux Workstation 6 x86_64
  • Red Hat Enterprise Linux Workstation 6 i386
  • Red Hat Enterprise Linux Desktop 6 x86_64
  • Red Hat Enterprise Linux Desktop 6 i386
  • Red Hat Enterprise Linux for IBM z Systems 6 s390x
  • Red Hat Enterprise Linux for Power, big endian 6 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

  • BZ - 1700440 - CVE-2019-2602 OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936)
  • BZ - 1700447 - CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
  • BZ - 1700564 - CVE-2019-2684 OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)
  • BZ - 1704480 - CVE-2019-2697 Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D)
  • BZ - 1704799 - CVE-2019-10245 IBM JDK: Read beyond the end of bytecode array causing JVM crash

CVEs

References

Red Hat Enterprise Linux Server 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 1444d0d139922f8ba2c22e0bbadfd7e1eca2d147295cb1505393699a3c3e2401
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: ea2c0346d54d22c4fded9abff0b7447749ec774317d85daf74f5136a1dfa9a3e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 3671272e061b4a834589f15fb96039df7b247cb8ee7b34c06c5216bb8c29ce33
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 45188a7e9fae385be412f1d6211424e4f7104199c744d8491743b89fae5b144f
java-1.7.1-ibm-plugin-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 744ff6005e7583b3f75d4ed0d0dca604db18b3b25b64f5905d21a62e5c92b63b
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 86ee791d67e22d8e58c0d9cae9fe74b6b0b2f43f516136ae6023bf57c84903bf
i386
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: f6df32995585d4c08023abf90103c28b4130575d57ca73cc60e0062d0f12878d
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: aa0f1f3ec3de63258040030a663e4d2c6347da704d33c4842899a7025302aa1e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: e28c97f17729579961ab8b6e363ee6f1f4d7b17ce47b17213d951adb7134f173
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 0e3cab263fd74d1b0e61aa3a49a90fd5a8bdf89ca8ec1fa58cb2ba19fceefcc8
java-1.7.1-ibm-plugin-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 57ca10142cf6b0963803c3df5c672eb7332db58ef08019d4f2c0332c92e3cd97
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 281d0209f5c6bda07be87bd7f3cf0c5c541c2e46001b7119be393b47ee712458

Red Hat Enterprise Linux Workstation 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 1444d0d139922f8ba2c22e0bbadfd7e1eca2d147295cb1505393699a3c3e2401
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: ea2c0346d54d22c4fded9abff0b7447749ec774317d85daf74f5136a1dfa9a3e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 3671272e061b4a834589f15fb96039df7b247cb8ee7b34c06c5216bb8c29ce33
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 45188a7e9fae385be412f1d6211424e4f7104199c744d8491743b89fae5b144f
java-1.7.1-ibm-plugin-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 744ff6005e7583b3f75d4ed0d0dca604db18b3b25b64f5905d21a62e5c92b63b
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 86ee791d67e22d8e58c0d9cae9fe74b6b0b2f43f516136ae6023bf57c84903bf
i386
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: f6df32995585d4c08023abf90103c28b4130575d57ca73cc60e0062d0f12878d
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: aa0f1f3ec3de63258040030a663e4d2c6347da704d33c4842899a7025302aa1e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: e28c97f17729579961ab8b6e363ee6f1f4d7b17ce47b17213d951adb7134f173
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 0e3cab263fd74d1b0e61aa3a49a90fd5a8bdf89ca8ec1fa58cb2ba19fceefcc8
java-1.7.1-ibm-plugin-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 57ca10142cf6b0963803c3df5c672eb7332db58ef08019d4f2c0332c92e3cd97
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 281d0209f5c6bda07be87bd7f3cf0c5c541c2e46001b7119be393b47ee712458

Red Hat Enterprise Linux Desktop 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 1444d0d139922f8ba2c22e0bbadfd7e1eca2d147295cb1505393699a3c3e2401
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: ea2c0346d54d22c4fded9abff0b7447749ec774317d85daf74f5136a1dfa9a3e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 3671272e061b4a834589f15fb96039df7b247cb8ee7b34c06c5216bb8c29ce33
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 45188a7e9fae385be412f1d6211424e4f7104199c744d8491743b89fae5b144f
java-1.7.1-ibm-plugin-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 744ff6005e7583b3f75d4ed0d0dca604db18b3b25b64f5905d21a62e5c92b63b
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 86ee791d67e22d8e58c0d9cae9fe74b6b0b2f43f516136ae6023bf57c84903bf
i386
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: f6df32995585d4c08023abf90103c28b4130575d57ca73cc60e0062d0f12878d
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: aa0f1f3ec3de63258040030a663e4d2c6347da704d33c4842899a7025302aa1e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: e28c97f17729579961ab8b6e363ee6f1f4d7b17ce47b17213d951adb7134f173
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 0e3cab263fd74d1b0e61aa3a49a90fd5a8bdf89ca8ec1fa58cb2ba19fceefcc8
java-1.7.1-ibm-plugin-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 57ca10142cf6b0963803c3df5c672eb7332db58ef08019d4f2c0332c92e3cd97
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.i686.rpm SHA-256: 281d0209f5c6bda07be87bd7f3cf0c5c541c2e46001b7119be393b47ee712458

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
s390x
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.s390x.rpm SHA-256: df7d4accd81aba3cb6312717c36c38305565923dc996550e8f2d48316722c585
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.s390x.rpm SHA-256: 605f887e67f4709a0a69e5a946d26f24a378ba5d373c758363f6d7a93fbd259d
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.s390x.rpm SHA-256: 0ed43ef5a3269cdb33c78aaa647fd7397734000415e4f2d83b86b559daf9e658
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.s390x.rpm SHA-256: 93c594802a3985129bfa751097c1558ad0f029ee5319092d0b75d2cab14df416
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.s390x.rpm SHA-256: e7e48ce567be35dd9890a65e09aa89b2d9797b306d4e66cb2c952cb635d5660a

Red Hat Enterprise Linux for Power, big endian 6

SRPM
ppc64
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.ppc64.rpm SHA-256: 446d165c2e5587b1aed4a34a256c19a61e65d1d384be681aff036462c9e8bc90
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.ppc64.rpm SHA-256: f414059ff74c86e96f18e5efe5f6e494b0a2438822215b642f4608f293ef7717
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.ppc64.rpm SHA-256: d3727e6cf5868690e67d545d7fca15d3cef9b3e1a0b0f6c0dcc5533a7fe05bfa
java-1.7.1-ibm-jdbc-1.7.1.4.45-1jpp.1.el6_10.ppc64.rpm SHA-256: 7c66fa1bb2a0a250d290a3f4554c9a3968d21fd7fce48266ff3b84f44b7143c0
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.ppc64.rpm SHA-256: 2bdc544a6fa6ce560dbf53621fab87c4366bd832a01b55a2a356940d9c412abb

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 1444d0d139922f8ba2c22e0bbadfd7e1eca2d147295cb1505393699a3c3e2401
java-1.7.1-ibm-demo-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: ea2c0346d54d22c4fded9abff0b7447749ec774317d85daf74f5136a1dfa9a3e
java-1.7.1-ibm-devel-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 3671272e061b4a834589f15fb96039df7b247cb8ee7b34c06c5216bb8c29ce33
java-1.7.1-ibm-src-1.7.1.4.45-1jpp.1.el6_10.x86_64.rpm SHA-256: 86ee791d67e22d8e58c0d9cae9fe74b6b0b2f43f516136ae6023bf57c84903bf

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.