title: Red Hat Security Advisory: java-1.7.0-ibm and java-1.7.1-ibm security update
description: OpenJDK: kerberos realm name leak (JGSS, 8048030) OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842) OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671) OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193) JDK: unspecified vulnerability fixed in 7u91 and 8u65 (Deployment) OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383) OpenJDK: OOB access in CMS code (2D, 8086092) OpenJDK: leak of user.dir location (JAXP, 8078427) OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891) ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042) OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688) OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries) OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291) OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387) OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413) OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733) JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment) OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339) JDK: local disclosure of kerberos credentials cache JDK: J9 JVM allows code to invoke non-public interface methods TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) libpng: Out-of-bounds read in png_convert_to_rfc1123 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions libpng: underflow read in png_check_keyword() JDK: buffer overflow vulnerability in the IBM JVM JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix OpenJDK: URL deserialization inconsistencies (Networking, 8059054) OpenJDK: logging of RMI connection secrets (JMX, 8130710) OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952) OpenJDK: insufficient byte type checks (Hotspot, 8132051) JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D) OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945) OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430) JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D) JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (Deployment)
cpes: cpe:/a:redhat:network_satellite:5.6::el5 cpe:/a:redhat:network_satellite:5.6::el6 cpe:/a:redhat:network_satellite:5.7::el6