Red Hat Security Advisory: java-1.8.0-ibm security update

Fixed packages 6

Vulnerabilities 9

• High 7.4
  CVE-2018-1656

  The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 ,…

  IBM SDK, Java Technology Edition
  Aug 20, 2018
• Medium 5.9
  CVE-2018-1517

  A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflic…

  IBM SDK, Java Technology Edition
  Aug 20, 2018
• Unscored —
  CVE-2016-0705 EPSS 26%

  Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and …

  openssl openssl Debian Ubuntu
  Mar 3, 2016
• Unscored —
  CVE-2017-3732 EPSS 15%

  BN_mod_exp may produce incorrect results on x86_64

  There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very dif…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  May 4, 2017
• Unscored —
  CVE-2017-3736 EPSS 10%

  There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before …

  OpenSSL Software Foundation OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine
  Nov 2, 2017
• Unscored —
  CVE-2018-12539

  In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an E…

  The Eclipse Foundation Eclipse OpenJ9
  Aug 14, 2018
• Unscored —
  CVE-2018-2940

  Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported version…

  Oracle Java openjdk8 openjdk-9-jre Alpine Wolfi
  Jul 18, 2018
• Unscored —
  CVE-2018-2952

  Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Suppor…

  Oracle Java openjdk-8 openjdk-lts Ubuntu Alpine Wolfi
  Jul 18, 2018
• Unscored —
  CVE-2018-2973

  Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE). Supported versions tha…

  Oracle Java openjdk8 openjdk-9-jre Alpine Wolfi
  Jul 18, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1310596
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1509169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1600925
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1602145
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1602146
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1618767
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1618869
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1618871
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2575.json
• report
  https://access.redhat.com/security/cve/CVE-2016-0705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-0705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-0705
• report
  https://access.redhat.com/security/cve/CVE-2017-3732
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-3732
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-3732
• article
  https://www.openssl.org/news/secadv/20170126.txt
• report
  https://access.redhat.com/security/cve/CVE-2017-3736
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-3736
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-3736
• article
  https://www.openssl.org/news/secadv/20171102.txt
• report
  https://access.redhat.com/security/cve/CVE-2018-1517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1517
• report
  https://access.redhat.com/security/cve/CVE-2018-1656
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1656
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1656
• report
  https://access.redhat.com/security/cve/CVE-2018-2940
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-2940
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-2940
• article
  http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html#AppendixJAVA
• report
  https://access.redhat.com/security/cve/CVE-2018-2952
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-2952
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-2952
• report
  https://access.redhat.com/security/cve/CVE-2018-2973
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-2973
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-2973
• report
  https://access.redhat.com/security/cve/CVE-2018-12539