Description
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.1.0-1jpp.2.el7_0 | RHSA-2014:0705 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.6-1jpp.1.el6_5 | RHSA-2014:0509 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.16.0-1jpp.1.el6_5 | RHSA-2014:0508 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.7.0-1jpp.1.el6_5 | RHSA-2014:0486 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.6-1jpp.1.el5_10 | RHSA-2014:0509 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.16.0-1jpp.1.el5_10 | RHSA-2014:0508 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.7.0-1jpp.1.el5_10 | RHSA-2014:0486 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.16.0-1jpp.1.el5 | RHSA-2014:0982 |
Advisories 5
- RHSA-2014:0982 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0705 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0509 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0508 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0486 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 59022 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21680750
- http://www-01.ibm.com/support/docview.wss?uid=swg21679610
- http://www-01.ibm.com/support/docview.wss?uid=swg21676672
- 59058 third-party-advisory
- 61264 third-party-advisory
- ibm-java-cve20140878-weak-sec(91084) vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21689593
- http://www-01.ibm.com/support/docview.wss?uid=swg21681256
- http://www-01.ibm.com/support/docview.wss?uid=swg21674539
- http://www-01.ibm.com/support/docview.wss?uid=swg21686717
- http://www-01.ibm.com/support/docview.wss?uid=swg21683484
- http://www-01.ibm.com/support/docview.wss?uid=swg21673836
- http://www.ibm.com/support/docview.wss?uid=swg21677387
- 59023 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21676746
- http://www-01.ibm.com/support/docview.wss?uid=swg21672043
- 67601 vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21679713
- http://www.ibm.com/support/docview.wss?uid=swg21675343
- http://www-01.ibm.com/support/docview.wss?uid=swg21676703
- http://www.ibm.com/support/docview.wss?uid=swg21675588