Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2014-283

Related Vulnerabilities: CVE-2013-5878   CVE-2013-5884   CVE-2013-5896   CVE-2013-5907   CVE-2013-5910   CVE-2014-0368   CVE-2014-0373   CVE-2014-0376   CVE-2014-0411   CVE-2014-0416   CVE-2014-0422   CVE-2014-0423   CVE-2014-0428  

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907) Multiple improper permission check issues were discovered in the CORBA and JNDI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428, CVE-2014-0422) Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368) It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423) It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to a disclosure of information about the used encryption keys. (CVE-2014-0411)

Source

ALAS-2014-283

Amazon Linux AMI Security Advisory: ALAS-2014-283
Advisory Release Date: 2014-02-03 15:27 Pacific
Advisory Updated Date: 2014-09-16 22:21 Pacific
Severity: Important
Issue Overview:

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA and JNDI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428, CVE-2014-0422)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to a disclosure of information about the used encryption keys. (CVE-2014-0411)


Affected Packages:

java-1.6.0-openjdk


Issue Correction:
Run yum update java-1.6.0-openjdk to update your system.

New Packages:
i686:
    java-1.6.0-openjdk-src-1.6.0.0-66.1.13.1.62.amzn1.i686
    java-1.6.0-openjdk-devel-1.6.0.0-66.1.13.1.62.amzn1.i686
    java-1.6.0-openjdk-1.6.0.0-66.1.13.1.62.amzn1.i686
    java-1.6.0-openjdk-debuginfo-1.6.0.0-66.1.13.1.62.amzn1.i686
    java-1.6.0-openjdk-javadoc-1.6.0.0-66.1.13.1.62.amzn1.i686
    java-1.6.0-openjdk-demo-1.6.0.0-66.1.13.1.62.amzn1.i686

src:
    java-1.6.0-openjdk-1.6.0.0-66.1.13.1.62.amzn1.src

x86_64:
    java-1.6.0-openjdk-debuginfo-1.6.0.0-66.1.13.1.62.amzn1.x86_64
    java-1.6.0-openjdk-demo-1.6.0.0-66.1.13.1.62.amzn1.x86_64
    java-1.6.0-openjdk-src-1.6.0.0-66.1.13.1.62.amzn1.x86_64
    java-1.6.0-openjdk-1.6.0.0-66.1.13.1.62.amzn1.x86_64
    java-1.6.0-openjdk-devel-1.6.0.0-66.1.13.1.62.amzn1.x86_64
    java-1.6.0-openjdk-javadoc-1.6.0.0-66.1.13.1.62.amzn1.x86_64

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started