RHSA-2015:1229 — Red Hat Security Advisory: java-1.7.0-openjdk security update

Fixed packages 56

Release	Package	Fixed in
Red Hat · RHEL 6 enterprise_linux:6::client	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::client	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::client	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::client	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::client	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::client	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::computenode	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::computenode	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::computenode	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::computenode	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::computenode	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::computenode	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::server	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::server	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::server	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::server	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::server	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::server	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::workstation	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::workstation	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::workstation	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::workstation	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::workstation	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 6 enterprise_linux:6::workstation	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.3.el6_6
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-accessibility	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-headless	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::client	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-accessibility	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-headless	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::computenode	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-accessibility	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-headless	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::server	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.2.ael7b_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-accessibility	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-debuginfo	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-demo	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-devel	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-headless	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-javadoc	1:1.7.0.85-2.6.1.2.el7_1
Red Hat · RHEL 7 enterprise_linux:7::workstation	java-1.7.0-openjdk-src	1:1.7.0.85-2.6.1.2.el7_1

Vulnerabilities 14

Critical 9.8

CVE-2015-2590 Exploited EPSS 25%

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
KEV Mar 3, 2022
Low 3.7

CVE-2015-2808 EPSS 74%

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data dur…

openjdk-7 openjdk-6 Ubuntu

Apr 1, 2015
Low 3.7

CVE-2015-4000 Public exploit EPSS 100%

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…

thunderbird firefox openssl openssl Debian Ubuntu

May 21, 2015
Unscored —

CVE-2015-2601

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 a…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-2621

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote att…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-2625

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 a…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-2628

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-2632

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via …

openjdk-7 openjdk-6 icu icu Debian Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-4731

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allo…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-4732

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-4733

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-4748 EPSS 45%

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedd…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-4749

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 a…

openjdk-7 openjdk-6 Ubuntu

Jul 16, 2015
Unscored —

CVE-2015-4760

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, int…

openjdk-7 openjdk-6 icu icu Debian Ubuntu

Jul 16, 2015

References

article
https://access.redhat.com/security/updates/classification/#critical
report
https://bugzilla.redhat.com/show_bug.cgi?id=1207101#c11
report
https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c33
report
https://bugzilla.redhat.com/show_bug.cgi?id=1207101
report
https://bugzilla.redhat.com/show_bug.cgi?id=1223211
report
https://bugzilla.redhat.com/show_bug.cgi?id=1241965
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242019
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242232
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242234
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242240
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242275
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242281
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242372
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242379
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242394
report
https://bugzilla.redhat.com/show_bug.cgi?id=1242447
report
https://bugzilla.redhat.com/show_bug.cgi?id=1243139
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1229.json
report
https://access.redhat.com/security/cve/CVE-2015-2590
advisory
https://www.cve.org/CVERecord?id=CVE-2015-2590
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-2590
article
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA
article
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
report
https://access.redhat.com/security/cve/CVE-2015-2601
advisory
https://www.cve.org/CVERecord?id=CVE-2015-2601
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-2601
report
https://access.redhat.com/security/cve/CVE-2015-2621
advisory
https://www.cve.org/CVERecord?id=CVE-2015-2621
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-2621
report
https://access.redhat.com/security/cve/CVE-2015-2625
advisory
https://www.cve.org/CVERecord?id=CVE-2015-2625
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-2625
report
https://access.redhat.com/security/cve/CVE-2015-2628
advisory
https://www.cve.org/CVERecord?id=CVE-2015-2628
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-2628
report
https://access.redhat.com/security/cve/CVE-2015-2632
advisory
https://www.cve.org/CVERecord?id=CVE-2015-2632
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-2632
report
https://access.redhat.com/security/cve/CVE-2015-2808

Red Hat Security Advisory: java-1.7.0-openjdk security update

Fixed packages 56

Vulnerabilities 14

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data dur…

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 a…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote att…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 a…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via …

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allo…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote atta…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedd…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 a…

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, int…

References