java security update

2012-09-0314:37:23

CentOS Project

lists.centos.org

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

100.0%

JSON

CentOS Errata and Security Advisory CESA-2012:1223

These packages provide the OpenJDK 7 Java Runtime Environment and the
OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans
component in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass Java sandbox restrictions. (CVE-2012-4681,
CVE-2012-1682, CVE-2012-3136)

A hardening fix was applied to the AWT component in OpenJDK, removing
functionality from the restricted SunToolkit class that was used in
combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)

All users of java-1.7.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2012-September/081004.html

Affected packages:
java-1.7.0-openjdk
java-1.7.0-openjdk-demo
java-1.7.0-openjdk-devel
java-1.7.0-openjdk-javadoc
java-1.7.0-openjdk-src

Upstream details at:
https://access.redhat.com/errata/RHSA-2012:1223

OSVersionArchitecturePackageVersionFilename
CentOS6i686java-1.7.0-openjdk< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS6i686java-1.7.0-openjdk-demo< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS6i686java-1.7.0-openjdk-devel< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS6noarchjava-1.7.0-openjdk-javadoc< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.3.noarch.rpm
CentOS6i686java-1.7.0-openjdk-src< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS6x86_64java-1.7.0-openjdk< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm
CentOS6x86_64java-1.7.0-openjdk-demo< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm
CentOS6x86_64java-1.7.0-openjdk-devel< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm
CentOS6noarchjava-1.7.0-openjdk-javadoc< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.3.noarch.rpm
CentOS6x86_64java-1.7.0-openjdk-src< 1.7.0.5-2.2.1.el6_3.3java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	6	i686	java-1.7.0-openjdk	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS	6	i686	java-1.7.0-openjdk-demo	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS	6	i686	java-1.7.0-openjdk-devel	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS	6	noarch	java-1.7.0-openjdk-javadoc	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.3.noarch.rpm
CentOS	6	i686	java-1.7.0-openjdk-src	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.3.i686.rpm
CentOS	6	x86_64	java-1.7.0-openjdk	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm
CentOS	6	x86_64	java-1.7.0-openjdk-demo	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm
CentOS	6	x86_64	java-1.7.0-openjdk-devel	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm
CentOS	6	noarch	java-1.7.0-openjdk-javadoc	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.3.noarch.rpm
CentOS	6	x86_64	java-1.7.0-openjdk-src	< 1.7.0.5-2.2.1.el6_3.3	java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.3.x86_64.rpm