Red Hat ENTERPRISE LINUX 5.5 - S 2010, Руководство пользователя

Страница: 96 / 470

Chapter 1. Package Updates
86
1.85. java-1.6.0-openjdk
1.85.1. RHSA-2009:1584: Important security update
Important
This update has already been released (prior to the GA of this release) as the security
errata
RHSA-2009:1584
544
Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat
Enterprise Linux 5.
This update has been rated as having important security impact by the Red Hat Security Response
Team.
These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software
Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users
need to run applications written using the Java programming language.
An integer overflow flaw and buffer overflow flaws were found in the way the JRE processed image
files. An untrusted applet or application could use these flaws to extend its privileges, allowing it
to read and write local files, as well as to execute local applications with the privileges of the user
running the applet or application. (
CVE-2009-3869
545
,
CVE-2009-3871
546
,
CVE-2009-3873
547
,
CVE-2009-3874
548
)
An information leak was found in the JRE. An untrusted applet or application could use this flaw to
extend its privileges, allowing it to read and write local files, as well as to execute local applications
with the privileges of the user running the applet or application. (
CVE-2009-3881
549
)
It was discovered that the JRE still accepts certificates with MD2 hash signatures, even though MD2
is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker
to create a malicious certificate that would be treated as trusted by the JRE. With this update, the JRE
disables the use of the MD2 algorithm inside signatures by default. (
CVE-2009-2409
550
)
A timing attack flaw was found in the way the JRE processed HMAC digests. This flaw could aid an
attacker using forged digital signatures to bypass authentication checks. (
CVE-2009-3875
551
)
Two denial of service flaws were found in the JRE. These could be exploited in server-side application
scenarios that process DER-encoded (Distinguished Encoding Rules) data. (
CVE-2009-3876
552
,
CVE-2009-3877
553
)
An information leak was found in the way the JRE handled color profiles. An attacker could use this
flaw to discover the existence of files outside of the color profiles directory. (
CVE-2009-3728
554
)
545
https://www.redhat.com/security/data/cve/CVE-2009-3869.html
546
https://www.redhat.com/security/data/cve/CVE-2009-3871.html
547
https://www.redhat.com/security/data/cve/CVE-2009-3873.html
548
https://www.redhat.com/security/data/cve/CVE-2009-3874.html
549
https://www.redhat.com/security/data/cve/CVE-2009-3881.html
550
https://www.redhat.com/security/data/cve/CVE-2009-2409.html
551
https://www.redhat.com/security/data/cve/CVE-2009-3875.html
552
https://www.redhat.com/security/data/cve/CVE-2009-3876.html
553
https://www.redhat.com/security/data/cve/CVE-2009-3877.html
554
https://www.redhat.com/security/data/cve/CVE-2009-3728.html