Issued:
2019-05-16
Updated:
2019-05-16

RHSA-2019:1238 - Security Advisory

Synopsis

Critical: java-1.8.0-ibm security update

Type/Severity

Security Advisory: Critical

Topic

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP35.

Security Fix(es):

  • IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)
  • IBM JDK: missing null check when accelerating Unsafe calls (CVE-2018-12549)
  • Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)
  • OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)
  • OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)
  • OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)
  • OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)
  • IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)
  • libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)
  • Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment) (CVE-2019-2449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le

Fixes

  • BZ - 1579973 - CVE-2018-11212 libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c
  • BZ - 1665945 - CVE-2019-2422 OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290)
  • BZ - 1685601 - CVE-2019-2449 Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment)
  • BZ - 1685611 - CVE-2018-12547 IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()
  • BZ - 1685717 - CVE-2018-12549 IBM JDK: missing null check when accelerating Unsafe calls
  • BZ - 1700440 - CVE-2019-2602 OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936)
  • BZ - 1700447 - CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
  • BZ - 1700564 - CVE-2019-2684 OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)
  • BZ - 1704480 - CVE-2019-2697 Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D)
  • BZ - 1704799 - CVE-2019-10245 IBM JDK: Read beyond the end of bytecode array causing JVM crash

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
x86_64
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 477d42a8ebe0fb441e99c98672305a90bfdaa8e1170d12a78284202cd9633b49
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b9ff108a04cdc7d91ad472c0484a4e34a502bf022159f50639f6ea57005e4e79
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 254423804cc82af03fd5e76b6bde0b646d9cb67375fad1398af88fb702c5e4d7
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 765d22de418ba69c729ddbd312c318690e15645e0459cc26aedf759f385647ec
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b38e2cfeca8dae57c811e1625c402765df0d2ce719553678c0b20ab4af901b85
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 3458f1be6e38c5b4e46a5dd5c81391485e85bca4fbeae39802d6bf576c577dc7
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 0acd32dbf1816319a167e18f9029bedd3d8969e4ae2b5d5e0fbb57231997f46d
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: c85ee51e1213aa19b57bb3e104297b56a34ee16486ea55e90f2afc82732aa511

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
s390x
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 68d9956c892e4a4ace2267b0330ee05789b7aa8afa574283b83349444e1e1055
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 264af6b161981ef2bc4d94cce1c2b74bebe48a7a0147bbf6627548a1576fa58b
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 37bfb85af407b0ba2c75d897034ede37b2397357f3a4659455f8d814d7f3df13
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 2e456daa8ea7c18315fe77fc884976848b1fe5f02970a709e46538e2f62a516c
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: bd8fbd36e03c055dc2cafb6599b2a9a4d93566e90ecb6aa32dd974ec3142e3d4
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 485034e9eeee2d5d116255b0d55fac487257dfad43b503040a8a1eb6b596b289

Red Hat Enterprise Linux for Power, little endian 8

SRPM
ppc64le
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 21d85741a0911e934a3f2808487b006ef9b412553c9241e0a2b65996331e8d48
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: baf0ab9170944dfeaeaf069a8eaa1aa06f13e0066bfba64df040a8079633bb15
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: e4e92fae703404be740df3fa986e4898f2c01b8b95570a5c6bec2281e5278f2a
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 8fffe19bbfe5cc7ec3dbdf5ac4ff37fae9aa4d7c80e971276e5a56f0d641ede3
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: ecf04416d4aa03c8b7752108214edb4f5553713aa75f9846b75a860d3d954fd4
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: eaf6fd6bd1ce0336fb2a88faf676898163b05f03f89857a98029ade46d1f835f
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: f16e1f59711ec9552a6680a7ada9a22d9c16d9fc4286c79d0d3be86b19168da6
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: bdaf2ca03b340c6157bfa5ad3c59b534b403be27d48dc48469ddbc7efb261156

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.