Synopsis:          Critical: java-1.6.0-openjdk security update

Advisory ID:       SLSA-2016:0723-1

Issue Date:        2016-05-09

CVE Numbers:       CVE-2016-0686

                   CVE-2016-0687

                   CVE-2016-0695

                   CVE-2016-3425

                   CVE-2016-3427

--



Security Fix(es):



* Multiple flaws were discovered in the Serialization and Hotspot

components in OpenJDK. An untrusted Java application or applet could use

these flaws to completely bypass Java sandbox restrictions.

(CVE-2016-0686, CVE-2016-0687)



* It was discovered that the RMI server implementation in the JMX

component in OpenJDK did not restrict which classes can be deserialized

when deserializing authentication credentials. A remote, unauthenticated

attacker able to connect to a JMX port could possibly use this flaw to

trigger deserialization flaws. (CVE-2016-3427)



* It was discovered that the JAXP component in OpenJDK failed to properly

handle Unicode surrogate pairs used as part of the XML attribute values.

Specially crafted XML input could cause a Java application to use an

excessive amount of memory when parsed. (CVE-2016-3425)



* It was discovered that the Security component in OpenJDK failed to check

the digest algorithm strength when generating DSA signatures. The use of a

digest weaker than the key strength could lead to the generation of

signatures that were weaker than expected. (CVE-2016-0695)

--



SL5

  x86_64

    java-1.6.0-openjdk-1.6.0.39-1.13.11.0.el5_11.x86_64.rpm

    java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.0.el5_11.x86_64.rpm

    java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.0.el5_11.x86_64.rpm

    java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.0.el5_11.x86_64.rpm

    java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.0.el5_11.x86_64.rpm

    java-1.6.0-openjdk-src-1.6.0.39-1.13.11.0.el5_11.x86_64.rpm

  i386

    java-1.6.0-openjdk-1.6.0.39-1.13.11.0.el5_11.i386.rpm

    java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.0.el5_11.i386.rpm

    java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.0.el5_11.i386.rpm

    java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.0.el5_11.i386.rpm

    java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.0.el5_11.i386.rpm

    java-1.6.0-openjdk-src-1.6.0.39-1.13.11.0.el5_11.i386.rpm

SL6

  x86_64

    java-1.6.0-openjdk-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm

    java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm

    java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm

    java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm

    java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm

    java-1.6.0-openjdk-src-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm

  i386

    java-1.6.0-openjdk-1.6.0.39-1.13.11.0.el6_7.i686.rpm

    java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.0.el6_7.i686.rpm

    java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.0.el6_7.i686.rpm

    java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.0.el6_7.i686.rpm

    java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.0.el6_7.i686.rpm

    java-1.6.0-openjdk-src-1.6.0.39-1.13.11.0.el6_7.i686.rpm

SL7

  x86_64

    java-1.6.0-openjdk-1.6.0.39-1.13.11.0.el7_2.x86_64.rpm

    java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.0.el7_2.x86_64.rpm

    java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.0.el7_2.x86_64.rpm

    java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.0.el7_2.x86_64.rpm

    java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.0.el7_2.x86_64.rpm

    java-1.6.0-openjdk-src-1.6.0.39-1.13.11.0.el7_2.x86_64.rpm



- Scientific Linux Development Team