RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update
OpenJDK: Insecure shared memory permissions (2D, 8001034) OpenJDK: Frame injection in generated HTML (Javadoc, 8012375) OpenJDK: Integrate Apache Santuario, rework class loader (Libraries, 6741606, 8008744) OpenJDK: JConsole SSL support (Serviceability, 8003703) JDK: unspecified vulnerability fixed in 7u25 (Deployment) JDK: unspecified vulnerability fixed in 7u25 (Deployment) OpenJDK: AccessControlContext check order issue (Libraries, 8001330) OpenJDK: Resource denial of service (AWT, 8001038) OpenJDK: Better handling of memory allocation errors (Hotspot, 7158805) OpenJDK: output stream access restrictions (CORBA, 8000642) OpenJDK: Prevent revealing the local address (Networking, 8001318) OpenJDK: Better access restrictions (Sound, 8006328) OpenJDK: ObjectStreamClass circular reference denial of service (Serialization, 8000638) OpenJDK: exclusive port binding (Networking, 7170730) OpenJDK: Unique VMIDs (Libraries, 8001033) OpenJDK: MBeanServer Introspector package access (JMX, 8008124) OpenJDK: SerialJavaObject package restriction (JDBC, 8009554) OpenJDK: getEnclosing* checks (Libraries, 8007812) OpenJDK: ObjectOutputStream access checks (Serialization, 8008132) OpenJDK: Proper class checking (JMX, 8008120) OpenJDK: Various AWT integer overflow checks (AWT, 8009071) OpenJDK: Missing check for valid DOMCanonicalizationMethod canonicalization algorithm (Libraries, 8014281) OpenJDK: Incorrect image attribute verification (2D, 8012438) JDK: unspecified vulnerability fixed in 7u25 (2D) OpenJDK: Incorrect image channel verification (2D, 8012597) JDK: unspecified vulnerability fixed in 7u25 (Deployment) JDK: unspecified vulnerability fixed in 7u25 (Deployment) OpenJDK: Incorrect image layout verification (2D, 8012601) OpenJDK: ImagingLib byte lookup processing (2D, 8011243) OpenJDK: Incorrect IntegerComponentRaster size checks (2D, 8011248) OpenJDK: Incorrect ShortBandedRaster size checks (2D, 8011253) OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257) JDK: unspecified vulnerability fixed in 6u51 and 5u51 (AWT) OpenJDK: java.util.TimeZone does not restrict setting of default time zone (Libraries, 8001029) OpenJDK: XML parsing Denial of Service (JAXP, 8017298) OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars OpenJDK: insufficient html escaping in jhat (jhat, 8011081) OpenJDK: Inet6Address class IPv6 address processing errors (Libraries, 8015743) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: image conversion out of bounds read (2D, 8014102) OpenJDK: key data leak via toString() methods (Libraries, 8011071) OpenJDK: Incorrect awt_getPixelByte/awt_getPixelShort/awt_setPixelByte/awt_setPixelShort image raster checks (2D, 8014093) OpenJDK: JTable not properly performing certain access checks (Swing, 8013744) OpenJDK: insufficient InterfaceImplementor security checks (Scripting, 8017299) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient security checks (Beans, 8012071) OpenJDK: insufficient escaping of window title string (Javadoc, 8016675) JDK: unspecified vulnerability fixed in 7u45 (2D) OpenJDK: javax.xml.transform.TransformerFactory does not properly honor XMLConstants.FEATURE_SECURE_PROCESSING (JAXP, 8012425) OpenJDK: insufficient checks of KDC replies (JGSS, 8014341) OpenJDK: javac does not ignore certain ignorable characters (Javadoc, 8016653) OpenJDK: JPEGImageReader and JPEGImageWriter missing band size checks (2D, 8013510) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: RMIConnection stub missing permission check (CORBA, 8011157) OpenJDK: VersionHelper12 does not honor modifyThreadGroup restriction (JNDI, 8013739) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient security checks (JAXWS, 8017505) OpenJDK: com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream Denial of Service (Security, 8021290) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: XML parsing Denial of Service (JAXP, 8014530) OpenJDK: Java2d Disposer security bypass (2D, 8017287) OpenJDK: checkPackageAccess missing security check (Libraries, 8017291) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: getDeclaringClass() information leak (Libraries, 8014349) OpenJDK: ObjectInputStream/ObjectOutputStream missing checks (Libraries, 8014987) JDK: unspecified vulnerability fixed in 7u45 (2D) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient DataFlavor security checks (AWT, 8012277) OpenJDK: Missing CORBA security checks (Libraries, 8017196) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: null xmlns handling issue (Security, 8025026) OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install) JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install) ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034) OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417) libjpeg: information leak (read of uninitialized memory) libpng: unhandled zero-length PLTE chunk or NULL palette OpenJDK: insufficient Socket checkListen checks (Networking, 8011786) OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: insecure subject principals set handling (JAAS, 8024306) JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (2D) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758) OpenJDK: XXE issue in decoder (Beans, 8023245) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767) OpenJDK: Incorrect mlib/raster image validation (2D, 8027841) OpenJDK: Protect logger handlers (Libraries, 8029740) JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment) OpenJDK: AWT incorrect FlavorMap seperation (AWT, 8026797) OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026801) OpenJDK: RSA unpadding timing issues (Security, 8027766) OpenJDK: System.arraycopy() element race condition (Hotspot, 8029858) OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394) OpenJDK: Activation framework default command map caching (JAX-WS, 8025152) OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731) OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794) OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618) OpenJDK: insufficient escaping of window title string (Javadoc, 8026736) JDK: unspecified vulnerability fixed in 5.0u75, 6u75, 7u55 and 8u5 (2D) OpenJDK: JAXP CharInfo file access restriction (JAXP, 8029282) JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment) OpenJDK: AWT thread context handling (AWT, 8025010) OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030) JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment) OpenJDK: JPEG decoder input stream handling (2D, 8029854) OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026188) OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163) JDK: unspecified vulnerability fixed in 6u75, 7u55 and 8u5 (Deployment)