ID

VAR-201206-0055

CVE

CVE-2012-1719

TITLE

Oracle Java SE JRE Component CORBA Subcomponent unidentified security vulnerability

DESCRIPTION

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect integrity, related to CORBA. The vulnerability can be exploited over multiple protocols. This issue affects the 'CORBA' sub-component. This vulnerability affects the following supported versions: 7 Update 4, 6 Update 32, 5 Update 35, 1.4.2_37. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-06-12-1 Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 is now available and addresses the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.4, OS X Lion Server v10.7.4 Impact: Multiple vulnerabilities in Java Description: Multiple vulnerabilities exist in Java, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_33. Further information is available via the Java website at http://www.o racle.com/technetwork/java/javase/releasenotes-136954.html CVE-ID CVE-2012-0551 CVE-2012-1711 CVE-2012-1713 CVE-2012-1716 CVE-2012-1718 CVE-2012-1719 CVE-2012-1721 CVE-2012-1722 CVE-2012-1723 CVE-2012-1724 CVE-2012-1725 Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: The Java browser plugin and Java Web Start are deactivated if they remain unused for 35 days Description: As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they are unused for 35 days. Users may re-enable Java if they encounter Java applets on a web page or Java Web Start applications by clicking the region labeled "Inactive plug-in" on a web page. This security measure is also available for OS Lion systems if the prior update "Java for OS X 2012-003" was not installed. Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.4, OS X Lion Server v10.7.4 Impact: The Java browser plugin and Java Web Start are deactivated if they do not meet the criteria for minimum safe version Description: As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they do not meet the criteria for minimum safe version. The minimum safe version of Java is updated daily, as needed. Note: These updates include the security content from Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8. Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 systems The download file is named: JavaForMacOSX10.6.dmg Its SHA-1 digest is: c2fcc844b7073d8243588f3407eb3ce1d497043d For OS X Lion systems The download file is named: JavaForOSX.dmg Its SHA-1 digest is: f176546327bc62d8cd397d54d1dc22b72aee1d2b Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJP15giAAoJEPefwLHPlZEw0JUQAI8bP4nvp9BgEyc8K2Z1GrKW sH0nTQtVCei8yF/ORZh7bnxTgANx/kbcwyy/+rfRuU0cKCryvIH5I6Odjt4qE17q Kqa/L8Xsl3pBdEwRVbo2rvy5IAVB32L8fUMfcQ4mweYeimTilR/+O9qQnFChZiEU KZgLCGDmBbGqhP/P/g9CM9G+g2rC+nG/07U8MN9nk0Mfio2mHxMSxFy96b4DK3TX g5R6nYOth+GEQPCC0+O7zKoVViL/6xLxvrnuGQL9uYizDgYLpfIHAyDUTJy27yVb t6ggjZIfMMKEL2uQAKh/1WlLN7oMfyYyIJkdKmjb9ZYRIia3brlmlDsEzoIH7DSr fdOJ/zUDHn6qvrRktdNhNJWI6z6XY6EzDWe+HnCbZvifqK7oiAtRJo7BcFeMFQS8 wDFLGebzr2YRFV+5Oa3hxDmGzXvl2B0FQ/T2PSOUraUuj14LSA1H/ekD7MrSo+09 tNDK2C3VpVY5eK7gjxFX8+hWT1w/x3jyIPWA7fCOzG6BM27FnQBuroFTTLlEmsev yV1Mcnd+KBgS194yu29gzbApOAQBHLT5epps1n/omIfQoKAfjfN66KM+dgl9e7uB 6s3s4sRCzQX8XtYlnC0PRG050R2lkO16k9UddZ/0CqE4pegIiIcvWtt4MB3jxMxr lTEVodir4Ubn3QZQ0SK7 =J235 -----END PGP SIGNATURE----- . CVE-2012-1711 CVE-2012-1719 Multiple errors in the CORBA implementation could lead to breakouts of the Java sandbox CVE-2012-1713 Missing input sanitising in the font manager could lead to the execution of arbitrary code. CVE-2012-1716 The SynthLookAndFeel Swing class could be abused to break out of the Java sandbox. CVE-2012-1717 Several temporary files were created insecurely, resulting in local information disclosure. CVE-2012-1723 CVE-2012-1725 Validation errors in the bytecode verifier of the Hotspot VM could lead to breakouts of the Java sandbox. CVE-2012-1724 Missing input sanitising in the XML parser could lead to denial of service through an infinite loop. We recommend that you upgrade your openjdk-6 packages. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03441075 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03441075 Version: 3 HPSBUX02805 SSRT100919 rev.3 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2012-08-13 Last Updated: 2012-08-28 ---------------------------------------------------------------------------- Potential Security Impact: Remote unauthorized access, disclosure of information, and other vulnerabilities Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in Java Runtime Environment (JRE) and Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other exploits. HP-UX B.11.11, B.11.23, and B.11.31 running HP JDK and JRE v7.0.01, v6.0.14 and v5.0.25 and earlier BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2012-0551 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 5.8 CVE-2012-1711 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-1713 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1716 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1717 (AV:L/AC:L/Au:N/C:P/I:N/A:N) 2.1 CVE-2012-1718 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-1719 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 CVE-2012-1720 (AV:L/AC:H/Au:N/C:P/I:P/A:P) 3.7 CVE-2012-1721 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1722 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1723 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1724 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-1725 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-1726 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 NOTE: The following apply to v7.0.01 and earlier: CVE-2012-0551, CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1720, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725, CVE-2012-1726 NOTE: The following apply to v6.0.14 and earlier: CVE-2012-0551, CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1720, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725 NOTE: The following apply to v5.0.25 and earlier: CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1720, CVE-2012-1723, CVE-2012-1725 RESOLUTION HP has provided the following Java version upgrade to resolve these vulnerabilities. The upgrade is available from the following location http://www.hp.com/go/java HP-UX B.11.23, B.11.31 JDK and JRE v7.0.02 or subsequent HP-UX B.11.11, B.11.23, B.11.31 JDK and JRE v6.0.15 or subsequent HP-UX B.11.11, B.11.23, B.11.31 JDK and JRE v5.0.26 or subsequent MANUAL ACTIONS: Yes - Update For Java v7.0 update to Java v7.0.02 or subsequent For Java v6.0 update to Java v6.0.15 or subsequent For Java v5.0 update to Java v5.0.26 or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.23 HP-UX B.11.31 =========== Jdk70.JDK70-COM Jdk70.JDK70-DEMO Jdk70.JDK70-IPF32 Jdk70.JDK70-IPF64 Jre70.JRE70-COM Jre70.JRE70-IPF32 Jre70.JRE70-IPF32-HS Jre70.JRE70-IPF64 Jre70.JRE70-IPF64-HS action: install revision 1.7.0.02.00 or subsequent HP-UX B.11.23 HP-UX B.11.31 =========== Jdk60.JDK60-COM Jdk60.JDK60-DEMO Jdk60.JDK60-IPF32 Jdk60.JDK60-IPF64 Jre60.JRE60-COM Jre60.JRE60-IPF32 Jre60.JRE60-IPF32-HS Jre60.JRE60-IPF64 Jre60.JRE60-IPF64-HS action: install revision 1.6.0.15.00 or subsequent HP-UX B.11.23 HP-UX B.11.31 =========== Jdk15.JDK15-COM Jdk15.JDK15-DEMO Jdk15.JDK15-IPF32 Jdk15.JDK15-IPF64 Jre15.JRE15-COM Jre15.JRE15-COM-DOC Jre15.JRE15-IPF32 Jre15.JRE15-IPF32-HS Jre15.JRE15-IPF64 Jre15.JRE15-IPF64-HS action: install revision 1.5.0.26.00 or subsequent HP-UX B.11.11 HP-UX B.11.23 =========== Jdk60.JDK60-COM Jdk60.JDK60-DEMO Jdk60.JDK60-PA20 Jdk60.JDK60-PA20W Jre60.JRE60-COM Jre60.JRE60-COM-DOC Jre60.JRE60-PA20 Jre60.JRE60-PA20-HS Jre60.JRE60-PA20W Jre60.JRE60-PA20W-HS action: install revision 1.6.0.15.00 or subsequent HP-UX B.11.11 HP-UX B.11.23 =========== Jdk15.JDK15-COM Jdk15.JDK15-DEMO Jdk15.JDK15-PA20 Jdk15.JDK15-PA20W Jre15.JRE15-COM Jre15.JRE15-COM-DOC Jre15.JRE15-PA20 Jre15.JRE15-PA20-HS Jre15.JRE15-PA20W Jre15.JRE15-PA20W-HS action: install revision 1.5.0.26.00 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 13 August 2012 Initial release Version:2 (rev.2) - 27 August 2012 Added v5.0.26 information Version:3 (rev.3) - 28 August 2012 Corrected CVE applicability Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c02964430 Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: uCosminexus Products Multiple Vulnerabilities SECUNIA ADVISORY ID: SA49578 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49578/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49578 RELEASE DATE: 2012-06-15 DISCUSS ADVISORY: http://secunia.com/advisories/49578/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49578/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49578 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Hitachi has acknowledged multiple vulnerabilities in uCosminexus products, which can be exploited by malicious, local users to disclose potentially sensitive information, manipulate certain data, and cause a DoS (Denial of Service) and by malicious people to conduct cross-site scripting attacks, disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system. The vulnerabilities are caused due to vulnerabilities in the bundled version of Cosminexus Developer's Kit for Java. For more information: SA49472 Please see the vendor's advisory for a list of affected products. ORIGINAL ADVISORY: HS12-015: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-015/index.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . 6) - x86_64 3. Content-Disposition: inline ============================================================================ Ubuntu Security Notice USN-1505-1 July 13, 2012 icedtea-web, openjdk-6 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS Summary: Several security issues were fixed in OpenJDK 6. Software Description: - openjdk-6: Open Source Java implementation - icedtea-web: A web browser plugin to execute Java applets Details: It was discovered that multiple flaws existed in the CORBA (Common Object Request Broker Architecture) implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711, CVE-2012-1719) It was discovered that multiple flaws existed in the OpenJDK font manager's layout lookup implementation. A attacker could specially craft a font file that could cause a denial of service through crashing the JVM (Java Virtual Machine) or possibly execute arbitrary code. (CVE-2012-1713) It was discovered that the SynthLookAndFeel class from Swing in OpenJDK did not properly prevent access to certain UI elements =66rom outside the current application context. An attacker could create a Java application or applet that used this flaw to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1716) It was discovered that OpenJDK runtime library classes could create temporary files with insecure permissions. (CVE-2012-1717) It was discovered that OpenJDK did not handle CRLs (Certificate Revocation Lists) properly. (CVE-2012-1718) It was discovered that the OpenJDK HotSpot Virtual Machine did not properly verify the bytecode of the class to be executed. A remote attacker could create a Java application or applet that used this to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1723, CVE-2012-1725) It was discovered that the OpenJDK XML (Extensible Markup Language) parser did not properly handle some XML documents. An attacker could create an XML document that caused a denial of service in a Java application or applet parsing the document. (CVE-2012-1724) As part of this update, the IcedTea web browser applet plugin was updated for Ubuntu 10.04 LTS, Ubuntu 11.04, and Ubuntu 11.10. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: openjdk-6-jre 6b24-1.11.3-1ubuntu0.12.04.1 Ubuntu 11.10: icedtea-6-plugin 1.2-2ubuntu0.11.10.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.11.10.1 Ubuntu 11.04: icedtea-6-plugin 1.2-2ubuntu0.11.04.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.11.04.1 Ubuntu 10.04 LTS: icedtea-6-plugin 1.2-2ubuntu0.10.04.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.10.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.5.0-ibm security update Advisory ID: RHSA-2012:1245-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1245.html Issue date: 2012-09-07 CVE Names: CVE-2012-1713 CVE-2012-1716 CVE-2012-1717 CVE-2012-1718 CVE-2012-1719 CVE-2012-1725 ===================================================================== 1. Summary: Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, ppc, s390x, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1725) All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR14 release. All running instances of IBM Java must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 829358 - CVE-2012-1717 OpenJDK: insecure temporary file permissions (JRE, 7143606) 829360 - CVE-2012-1716 OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) 829361 - CVE-2012-1713 OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) 829371 - CVE-2012-1719 OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) 829372 - CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) 829376 - CVE-2012-1725 OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.i386.rpm ppc: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.ppc64.rpm java-1.5.0-ibm-accessibility-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.ppc64.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.ppc.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.s390.rpm java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.s390x.rpm java-1.5.0-ibm-accessibility-1.5.0.14.0-1jpp.1.el5_8.s390x.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.s390.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.s390x.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.s390.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.s390x.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el5_8.s390.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.s390.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.i386.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el5_8.x86_64.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.i686.rpm x86_64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.i686.rpm ppc64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.ppc64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.ppc.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.ppc64.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el6_3.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el6_3.ppc.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.s390x.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.s390x.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.s390.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.s390x.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el6_3.s390.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-plugin-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.i686.rpm x86_64: java-1.5.0-ibm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.i686.rpm java-1.5.0-ibm-devel-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm java-1.5.0-ibm-src-1.5.0.14.0-1jpp.1.el6_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-1713.html https://www.redhat.com/security/data/cve/CVE-2012-1716.html https://www.redhat.com/security/data/cve/CVE-2012-1717.html https://www.redhat.com/security/data/cve/CVE-2012-1718.html https://www.redhat.com/security/data/cve/CVE-2012-1719.html https://www.redhat.com/security/data/cve/CVE-2012-1725.html https://access.redhat.com/security/updates/classification/#critical https://www.ibm.com/developerworks/java/jdk/alerts/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFQSfQjXlSAg2UNWIIRAqCLAJsFsqey2tKW03coQV1/xOdj+M2zcgCbBDDQ Cx0jKMCYCCxvJtpWsrBs0tM= =SpyC -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS