Description
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.5-1jpp.1.el6_5 | RHSA-2014:0136 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.15.1-1jpp.1.el6_5 | RHSA-2014:0135 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el6_5 | RHSA-2014:0097 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el6_5 | RHSA-2014:0134 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el6_5 | RHSA-2014:0026 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el6_5 | RHSA-2014:0030 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.5-1jpp.1.el5_10 | RHSA-2014:0136 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.15.1-1jpp.1.el5_10 | RHSA-2014:0135 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-3.1.13.1.el5_10 | RHSA-2014:0097 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.6.1-1jpp.1.el5_10 | RHSA-2014:0134 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.51-2.4.4.1.el5_10 | RHSA-2014:0027 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.51-1jpp.1.el5_10 | RHSA-2014:0030 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
Advisories 8
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0136 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0135 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0097 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0134 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0030 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0026 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0027 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2014:0414 vendor-advisory
- [oss-security] 20150208 CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars mailing-list
- [oss-security] 20150209 Re: CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars mailing-list
- http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927e
- https://bugzilla.redhat.com/show_bug.cgi?id=1031471