Updated java-1.7.0-openjdk packages that fix multiple security issues arenow available for Red Hat Enterprise Linux 5.Red Hat Product Security has rated this update as having Important securityimpact. Common Vulnerability Scoring System (CVSS) base scores, which givedetailed severity ratings, are available for each vulnerability from theCVE links in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java RuntimeEnvironment and the OpenJDK 7 Java Software Development Kit.An off-by-one flaw, leading to a buffer overflow, was found in the fontparsing code in the 2D component in OpenJDK. A specially crafted font filecould possibly cause the Java Virtual Machine to execute arbitrary code,allowing an untrusted Java application or applet to bypass Java sandboxrestrictions. (CVE-2015-0469)A flaw was found in the way the Hotspot component in OpenJDK handledphantom references. An untrusted Java application or applet could use thisflaw to corrupt the Java Virtual Machine memory and, possibly, executearbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0460)A flaw was found in the way the JSSE component in OpenJDK parsed X.509certificate options. A specially crafted certificate could cause JSSE toraise an exception, possibly causing an application using JSSE to exitunexpectedly. (CVE-2015-0488)A flaw was discovered in the Beans component in OpenJDK. An untrusted Javaapplication or applet could use this flaw to bypass certain Java sandboxrestrictions. (CVE-2015-0477)A directory traversal flaw was found in the way the jar tool extracted JARarchive files. A specially crafted JAR archive could cause jar to overwritearbitrary files writable by the user running jar when the archive wasextracted. (CVE-2005-1080, CVE-2015-0480)It was found that the RSA implementation in the JCE component in OpenJDKdid not follow recommended practices for implementing RSA signatures.(CVE-2015-0478)The CVE-2015-0478 issue was discovered by Florian Weimer of Red HatProduct Security.All users of java-1.7.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.
Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258Red Hat Enterprise Linux (v. 5 server)

SRPMS:
java-1.7.0-openjdk-1.7.0.79-2.5.5.2.el5_11.src.rpm
    MD5: c42c00c0a91246728ae8964d6d8579f3SHA-256: 9fd8a4717f40d57d4822b25c6f83339581c334f4c27ef005d31ec199d02e9193
 
IA-32:
java-1.7.0-openjdk-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 594f1b1b98c4429b85dd731c32e49397SHA-256: fe31dc8fc5c1b10e8960332c3ba83cd01d38162b48a1cb3007bfe49f4017a2de
java-1.7.0-openjdk-debuginfo-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: adcad03207b713c73c494826fa3d47e0SHA-256: 981fd0fc0a238472531671665d497e1e0a00fa3bf6ef57746f817610723100b4
java-1.7.0-openjdk-demo-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 46e061f0ebbbd658067729e5e762bdbdSHA-256: a2be6923e72e63fdbb1d0f1095dc3001f526399974bb760214db0ade49ca9791
java-1.7.0-openjdk-devel-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 957478f5be4adadcc8e5510c705e66d3SHA-256: 9e707408600a14e0747e6450f736712d5091008f5a0405b486eaf4385847957a
java-1.7.0-openjdk-javadoc-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 0b2e6fdec0d24c3f48d9606dc8fbf914SHA-256: a9f48f77c89028bbc46db7d1e01ce9501b27cd24fc16608e228e215af058a3d6
java-1.7.0-openjdk-src-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 0ca11634992b3e43f76e3c1014868e80SHA-256: 19585ffa07263637cc81dca22ea9f0d9b354fa2758762d20b9ab186ed54a1fc4
 
x86_64:
java-1.7.0-openjdk-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 507071062029351633a7e7e87f3bd75cSHA-256: 74cbca1aee2357a70cad939a9c84de3a28ad6c8e3a7d2ed804ae881c965641c5
java-1.7.0-openjdk-debuginfo-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: a905f629b99f2fb76a35ce1b699f7f28SHA-256: 170b936807773d043513aeadec7844ebbb82fc5373f790ca5df84a64eb3f838a
java-1.7.0-openjdk-demo-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 08d117f038062305d01bba6eceb5eef2SHA-256: 4439123bff422a79480df5fe3f90fde25d398c0522b9c47946a4a40b122f9341
java-1.7.0-openjdk-devel-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 003682a35683351476a84a77d0e422cbSHA-256: 73ac48ed80d9196721533d870939536b345701a58c19043734cd225746166d36
java-1.7.0-openjdk-javadoc-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 530870ccc1e489303c753e4c18ee72fdSHA-256: 66fa3f7fab0ef6a514dba01b0d90b243cf8c5681dfd79975482cf4d3f615dbd4
java-1.7.0-openjdk-src-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: afe692022101c80b399e0dbcd7805889SHA-256: 362d795eb1e54b4e36f64309825d5642ad0d312961cbcc8876a164fc14294b3d
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
java-1.7.0-openjdk-1.7.0.79-2.5.5.2.el5_11.src.rpm
    MD5: c42c00c0a91246728ae8964d6d8579f3SHA-256: 9fd8a4717f40d57d4822b25c6f83339581c334f4c27ef005d31ec199d02e9193
 
IA-32:
java-1.7.0-openjdk-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 594f1b1b98c4429b85dd731c32e49397SHA-256: fe31dc8fc5c1b10e8960332c3ba83cd01d38162b48a1cb3007bfe49f4017a2de
java-1.7.0-openjdk-debuginfo-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: adcad03207b713c73c494826fa3d47e0SHA-256: 981fd0fc0a238472531671665d497e1e0a00fa3bf6ef57746f817610723100b4
java-1.7.0-openjdk-demo-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 46e061f0ebbbd658067729e5e762bdbdSHA-256: a2be6923e72e63fdbb1d0f1095dc3001f526399974bb760214db0ade49ca9791
java-1.7.0-openjdk-devel-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 957478f5be4adadcc8e5510c705e66d3SHA-256: 9e707408600a14e0747e6450f736712d5091008f5a0405b486eaf4385847957a
java-1.7.0-openjdk-javadoc-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 0b2e6fdec0d24c3f48d9606dc8fbf914SHA-256: a9f48f77c89028bbc46db7d1e01ce9501b27cd24fc16608e228e215af058a3d6
java-1.7.0-openjdk-src-1.7.0.79-2.5.5.2.el5_11.i386.rpm
    MD5: 0ca11634992b3e43f76e3c1014868e80SHA-256: 19585ffa07263637cc81dca22ea9f0d9b354fa2758762d20b9ab186ed54a1fc4
 
x86_64:
java-1.7.0-openjdk-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 507071062029351633a7e7e87f3bd75cSHA-256: 74cbca1aee2357a70cad939a9c84de3a28ad6c8e3a7d2ed804ae881c965641c5
java-1.7.0-openjdk-debuginfo-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: a905f629b99f2fb76a35ce1b699f7f28SHA-256: 170b936807773d043513aeadec7844ebbb82fc5373f790ca5df84a64eb3f838a
java-1.7.0-openjdk-demo-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 08d117f038062305d01bba6eceb5eef2SHA-256: 4439123bff422a79480df5fe3f90fde25d398c0522b9c47946a4a40b122f9341
java-1.7.0-openjdk-devel-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 003682a35683351476a84a77d0e422cbSHA-256: 73ac48ed80d9196721533d870939536b345701a58c19043734cd225746166d36
java-1.7.0-openjdk-javadoc-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: 530870ccc1e489303c753e4c18ee72fdSHA-256: 66fa3f7fab0ef6a514dba01b0d90b243cf8c5681dfd79975482cf4d3f615dbd4
java-1.7.0-openjdk-src-1.7.0.79-2.5.5.2.el5_11.x86_64.rpm
    MD5: afe692022101c80b399e0dbcd7805889SHA-256: 362d795eb1e54b4e36f64309825d5642ad0d312961cbcc8876a164fc14294b3d
 
(The unlinked packages above are only available from the Red Hat Network)
1210355 – CVE-2015-0478 OpenJDK: RSA implementation hardening (JCE, 8071726)1210829 – CVE-2015-0469 ICU: layout engine glyphStorage off-by-one (OpenJDK 2D, 8067699)1211285 – CVE-2015-0460 OpenJDK: incorrect handling of phantom references (Hotspot, 8071931)1211299 – CVE-2015-0477 OpenJDK: incorrect permissions check in resource loading (Beans, 8068320)1211504 – CVE-2015-0480 OpenJDK: jar directory traversal issues (Tools, 8064601)1211543 – CVE-2015-0488 OpenJDK: certificate options parsing uncaught exception (JSSE, 8068720)606442 – CVE-2005-1080 jar: directory traversal vulnerability

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from:

Leave a Reply