Red Hat update for java-1.8.0-openjdk



Risk High
Patch available YES
Number of vulnerabilities 12
CVE-ID CVE-2016-5546
CVE-2016-5547
CVE-2016-5548
CVE-2016-5552
CVE-2017-3231
CVE-2017-3241
CVE-2017-3252
CVE-2017-3253
CVE-2017-3261
CVE-2017-3272
CVE-2017-3289
CVE-2016-2183
CWE-ID CWE-20
CWE-200
CWE-264
CWE-327
Exploitation vector Network
Public exploit Public exploit code for vulnerability #6 is available.
Public exploit code for vulnerability #12 is available.
Vulnerable software
Subscribe 		Red Hat Enterprise Linux EUS Compute Node
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Scientific Computing
Operating systems & Components / Operating system

Red Hat Enterprise Linux for IBM z Systems
Operating systems & Components / Operating system

Red Hat Enterprise Linux Desktop
Operating systems & Components / Operating system

Red Hat Enterprise Linux Workstation
Operating systems & Components / Operating system

Red Hat Enterprise Linux Server
Operating systems & Components / Operating system

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 12 vulnerabilities.

1) Modification of information

EUVDB-ID: #VU7325

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5546

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to modify information.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the Libraries component. A remote attacker can modify arbitrary data on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Denial of service

EUVDB-ID: #VU7326

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5547

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the Libraries component. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU7327

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5548

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information.

The weakness exists due to unknown error in Oracle Java SE and Java SE Embedded related to the Libraries component. A remote attacker can trick the victim into visiting a specially crafted webpage and read important files on the target system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Modification of information

EUVDB-ID: #VU7329

Risk: Low

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5552

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to modify information.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the Networking component. A remote attacker can modify arbitrary data on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU7330

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3231

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information.

The weakness exists due to unknown error in Oracle Java SE and Java SE Embedded related to the Networking component. A remote attacker can trick the victim into visiting a specially crafted webpage read arbitrary files on the target system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Remote code execution

EUVDB-ID: #VU7331

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-3241

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the RMI component. A remote attacker can execute arbitrary code with privileges of the current user and compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Modification of information

EUVDB-ID: #VU7332

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3252

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to modify information.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the JAAS component. A remote attacker can trick the victim into visiting a specially crafted webpage and modify arbitrary data on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Denial of service

EUVDB-ID: #VU7333

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3253

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the 2D component. A remote attacker can cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU7335

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3261

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information.

The weakness exists due to unknown error in Oracle Java SE and Java SE Embedded related to the Networking component. A remote attacker can trick the victim into visiting a specially crafted webpage and read arbitrary files on the target system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Remote code execution

EUVDB-ID: #VU7336

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3272

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code.

The weakness exists due to unknown error in Oracle Java SE and Java SE Embedded related to the Libraries component. A remote attacker can trick the victim into visiting a specially crafted webpage, execute arbitrary code with privileges of the current user and compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Remote code execution

EUVDB-ID: #VU6712

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3289

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code.

The weakness exists due to unknown error in Oracle Java SE and Java SE Embedded related to the Hotspot component. A remote attacker can trick the victim into opening a specially crafted webpage, execute arbitrary code with privileges of the current user and compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Information disclosure

EUVDB-ID: #VU370

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2016-2183

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt transmitted data.

The vulnerability exists due to remote user's ability to control the network and capture long duration 3DES CBC mode encrypted session during which he can see a part of the text. In case of repeated sending the attacker can read the part and reconstruct the whole text.

Successful exploitation of this vulnerability may allow a remote attacker to decode transmitted data. This vulnerability is known as SWEET32.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux EUS Compute Node: 7.3

Red Hat Enterprise Linux for Scientific Computing: 6 - 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux Desktop: 6 - 7

Red Hat Enterprise Linux Workstation: 6 - 7

Red Hat Enterprise Linux Server: 6.0 - 7

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2017:0180


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###