Description
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.8.0-openjdk +6 | 1:1.8.0.51-1.b16.ael7b_1 | RHSA-2015:1228 |
| RHEL 6 | java-1.8.0-openjdk +5 | 1:1.8.0.51-0.b16.el6_6 | RHSA-2015:1228 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | java-1.8.0-openjdk +6 | 1:1.8.0.51-1.b16.el7_1 | ELSA-2015-1228 |
Advisories 2
- RHSA-2015:1228 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- ELSA-2015-1228 Important: java-1.8.0-openjdk security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 15, 2015
References
- 75933 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1213365
- RHSA-2015:1228 vendor-advisory