java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4
エラータID: AXSA:2015-409:03
Release date:
Thursday, August 13, 2015 - 18:33
Subject:
java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4
Affected Channels:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
High
Description:
The OpenJDK runtime environment.
Security issues fixed with this release:
CVE-2015-2590
CVE-2015-2601
CVE-2015-2621
CVE-2015-2625
CVE-2015-2628
CVE-2015-2632
CVE-2015-2808
CVE-2015-4000
CVE-2015-4731
CVE-2015-4732
CVE-2015-4733
CVE-2015-4748
CVE-2015-4749
CVE-2015-4760
Solution:
Update packages.
CVEs:
CVE-2015-2590
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
CVE-2015-2601
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.
CVE-2015-2621
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.
CVE-2015-2625
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.
CVE-2015-2628
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.
CVE-2015-2632
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
CVE-2015-2808
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
CVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
CVE-2015-4731
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2015-4732
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.
CVE-2015-4733
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
CVE-2015-4748
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
CVE-2015-4749
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
CVE-2015-4760
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Additional Info:
N/A
Download:
SRPMS
- java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4.src.rpm
MD5: d698606070f93e58688005beeb0e58e5
SHA-256: dbb65ac7386a329319ceaae65421e3ebba56fc741fafb12ca38255ffb56f7a69
Size: 36.12 MB
Asianux Server 4 for x86
- java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4.i686.rpm
MD5: 14a30e9635431471dd1529d84fcbc6a0
SHA-256: b11e31b19cc1db8135c3826b99353ebb2c6a44ae38a50d5344d5d150ccd4f411
Size: 42.04 MB - java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.AXS4.i686.rpm
MD5: b1daf6111b320ba8abbd440063a49ecb
SHA-256: 659f81506287f8ab80d302227e8f43e6d49877d51d2315ad5749882e16abcdf8
Size: 14.58 MB - java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.AXS4.i686.rpm
MD5: 7c9b604a6fbc99c13f9b51f376b4ea09
SHA-256: 64c2e3d4368aa1af90298cc25e5cc70f69233611e335998e10754ab3f137b538
Size: 14.63 MB
Asianux Server 4 for x86_64
- java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4.x86_64.rpm
MD5: 5da0622774da2725773bb7380e167f43
SHA-256: da2bf04682add7eb13a7a2e1baea08c4fd6bd24461ea7fd679ac17313f81c82b
Size: 41.21 MB - java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.AXS4.x86_64.rpm
MD5: eb395866849303ec8dbeb9fb7a89835c
SHA-256: 222f8b6d46e7e4aaad18b394618f58b80c0aa84d7ee4fe7c1ec7498c401cbcdd
Size: 14.57 MB - java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.AXS4.x86_64.rpm
MD5: 23ab035574bdeea35c384928157466d1
SHA-256: a35044eada97443d2a6164ce4980423cdf594e8b384ebd3ec78a3b8b48eae4a2
Size: 14.62 MB
日本語