Synopsis:          Important: java-1.7.0-openjdk security and bug fix update
Advisory ID:       SLSA-2014:1633-1
Issue Date:        2014-10-15
CVE Numbers:       CVE-2014-6512
                   CVE-2014-6506
                   CVE-2014-6504
                   CVE-2014-6519
                   CVE-2014-6531
                   CVE-2014-6502
                   CVE-2014-6457
                   CVE-2014-6558
                   CVE-2014-6517
                   CVE-2014-6511
--

Multiple flaws were discovered in the Libraries, 2D, and Hotspot
components in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass certain Java sandbox restrictions. (CVE-2014-6506,
CVE-2014-6531, CVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519)

It was discovered that the StAX XML parser in the JAXP component in
OpenJDK performed expansion of external parameter entities even when
external entity substitution was disabled. A remote attacker could use
this flaw to perform XML eXternal Entity (XXE) attack against applications
using the StAX parser to parse untrusted XML documents. (CVE-2014-6517)

It was discovered that the DatagramSocket implementation in OpenJDK failed
to perform source address checks for packets received on a connected
socket. A remote attacker could use this flaw to have their packets
processed as if they were received from the expected source.
(CVE-2014-6512)

It was discovered that the TLS/SSL implementation in the JSSE component in
OpenJDK failed to properly verify the server identity during the
renegotiation following session resumption, making it possible for
malicious TLS/SSL servers to perform a Triple Handshake attack against
clients using JSSE and client certificate authentication. (CVE-2014-6457)

It was discovered that the CipherInputStream class implementation in
OpenJDK did not properly handle certain exceptions. This could possibly
allow an attacker to affect the integrity of an encrypted stream handled
by this class. (CVE-2014-6558)

This update also fixes the following bug:

* The TLS/SSL implementation in OpenJDK previously failed to handle
Diffie-Hellman (DH) keys with more than 1024 bits. This caused client
applications using JSSE to fail to establish TLS/SSL connections to
servers using larger DH keys during the connection handshake. This update
adds support for DH keys with size up to 2048 bits.

All running instances of OpenJDK Java must be restarted for the update to
take effect.
--

SL5
  x86_64
    java-1.7.0-openjdk-1.7.0.71-2.5.3.1.el5_11.x86_64.rpm
    java-1.7.0-openjdk-debuginfo-1.7.0.71-2.5.3.1.el5_11.x86_64.rpm
    java-1.7.0-openjdk-demo-1.7.0.71-2.5.3.1.el5_11.x86_64.rpm
    java-1.7.0-openjdk-devel-1.7.0.71-2.5.3.1.el5_11.x86_64.rpm
    java-1.7.0-openjdk-javadoc-1.7.0.71-2.5.3.1.el5_11.x86_64.rpm
    java-1.7.0-openjdk-src-1.7.0.71-2.5.3.1.el5_11.x86_64.rpm
  i386
    java-1.7.0-openjdk-1.7.0.71-2.5.3.1.el5_11.i386.rpm
    java-1.7.0-openjdk-debuginfo-1.7.0.71-2.5.3.1.el5_11.i386.rpm
    java-1.7.0-openjdk-demo-1.7.0.71-2.5.3.1.el5_11.i386.rpm
    java-1.7.0-openjdk-devel-1.7.0.71-2.5.3.1.el5_11.i386.rpm
    java-1.7.0-openjdk-javadoc-1.7.0.71-2.5.3.1.el5_11.i386.rpm
    java-1.7.0-openjdk-src-1.7.0.71-2.5.3.1.el5_11.i386.rpm

- Scientific Linux Development Team