Synopsis: Important: java-1.7.0-openjdk security update Advisory ID: SLSA-2018:1270-1 Issue Date: 2018-04-30 CVE Numbers: CVE-2018-2814 CVE-2018-2794 CVE-2018-2795 CVE-2018-2815 CVE-2018-2799 CVE-2018-2798 CVE-2018-2797 CVE-2018-2796 CVE-2018-2800 CVE-2018-2790 -- Security Fix(es): * OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025) (CVE-2018-2814) * OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997) (CVE-2018-2794) * OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977) (CVE-2018-2795) * OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981) (CVE-2018-2796) * OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985) (CVE-2018-2797) * OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989) (CVE-2018-2798) * OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993) (CVE-2018-2799) * OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833) (CVE-2018-2800) * OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757) (CVE-2018-2815) * OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969) (CVE-2018-2790) -- SL6 x86_64 java-1.7.0-openjdk-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm i386 java-1.7.0-openjdk-1.7.0.181-2.6.14.1.el6_9.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.181-2.6.14.1.el6_9.i686.rpm java-1.7.0-openjdk-devel-1.7.0.181-2.6.14.1.el6_9.i686.rpm java-1.7.0-openjdk-demo-1.7.0.181-2.6.14.1.el6_9.i686.rpm java-1.7.0-openjdk-src-1.7.0.181-2.6.14.1.el6_9.i686.rpm noarch java-1.7.0-openjdk-javadoc-1.7.0.181-2.6.14.1.el6_9.noarch.rpm - Scientific Linux Development Team