Description
IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16 FP1 (6.0.16.1), and before 5.0 SR16 FP7 (5.0.16.7) allows attackers to obtain the private key from a Certificate Management System (CMS) keystore via a brute force attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.1.1-1jpp.1.el7_0 | RHSA-2014:1042 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.7-1jpp.1.el6_5 | RHSA-2014:1036 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.16.1-1jpp.1.el6_5 | RHSA-2014:1033 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.7.1-1jpp.1.el6_5 | RHSA-2014:1041 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.7-1jpp.1.el5_10 | RHSA-2014:1036 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.16.1-1jpp.1.el5_10 | RHSA-2014:1033 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.7.1-1jpp.1.el5_10 | RHSA-2014:1041 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.16.3-1jpp.1.el5 | RHSA-2015:0264 |
Advisories 5
- RHSA-2015:0264 Red Hat Security Advisory: Red Hat Satellite IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1042 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1041 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1033 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1036 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- ibm-ikeyman-cve20143068-info-disc(93756) vdb-entry
- IV66876 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21691089
- https://bugzilla.redhat.com/show_bug.cgi?id=1164201
- RHSA-2015:0264 vendor-advisory
- IV66894 vendor-advisory