java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8.AXS4
エラータID: AXSA:2013-99:01
以下項目について対処しました。
[Security Fix]
- Oracle の Java Runtime Environment (JRE) コンポーネントには，RMI に関連する要因によって，リモートの攻撃者が整合性に影響を与える脆弱性があります。(CVE-2013-0424)
- Oracle の Java Runtime Environment (JRE) コンポーネントには，ライブラリに関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。
なおこの脆弱性は CVE-2013-0428，CVE-2013-0426 とは異なる脆弱性です。(CVE-2013-0425)
-Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，ライブラリに関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。
なおこの脆弱性は CVE-2013-0425，CVE-2013-0428 とは異なる脆弱性です。(CVE-2013-0426)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，ライブラリに関連する要因によって，リモートの攻撃者が整合性に影響を与える脆弱性があります。(CVE-2013-0427)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，ライブラリに関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。
なおこの脆弱性は CVE-2013-0425，CVE-2013-0426 とは異なる脆弱性です。(CVE-2013-0428)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，CORBA に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-0429)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，AWT に関連する要因によって，リモートの攻撃者が機密性と整合性に影響を与える脆弱性があります。(CVE-2013-0432)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，ネットワーキングに関連する要因によって，リモートの攻撃者が整合性に影響を与える脆弱性があります。(CVE-2013-0433)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，JAXP に関連する要因によって，リモートの攻撃者が機密性に影響を与える脆弱性があります。(CVE-2013-0434)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，JAX-WS に関連する要因によって，リモートの攻撃者が機密性に影響を与える脆弱性があります。(CVE-2013-0435)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，JSSE に関連する要因によって，リモートの攻撃者が可用性に影響を与える脆弱性があります。(CVE-2013-0440)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，CORBA に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。
なおこの脆弱性は CVE-2013-1476，CVE-2013-1475 とは異なる脆弱性です。(CVE-2013-0441)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し， AWT に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-0442)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，JSSE に関連する要因によって，リモートの攻撃者が機密性，整合性に影響を与える脆弱性があります。(CVE-2013-0443)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，Beans に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-0444)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，JMX に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-0450)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，CORBA に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-1475)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，CORBA に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。
なおこの脆弱性は CVE-2013-0441，CVE-2013-1475 とは異なる脆弱性となります。
(CVE-2013-1476)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，2D に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。
(CVE-2013-1478)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，AWT に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-1480)
- OpenSSL, OpenJDK, PolarSSL や他の製品で使用されている TLS プロトコル，DTLS プロトコルは不正な CBC パディングの処理の間，MAC チェック要求でのサイドチャネル攻撃のタイミングを適切に考慮しておらず，巧妙に細工されたパケットのタイミングデータの統計的分析によって，リモートの攻撃者が distinguishing 攻撃と平文回復攻撃 (plaintext-recovery attack) を行う脆弱性があります。
(CVE-2013-0169)
- Oracle の Java Runtime Environment (JRE) コンポーネントには詳細不明の脆弱性が存在し，JMX に関連する要因によって，リモートの攻撃者が機密性，整合性，可用性に影響を与える脆弱性があります。(CVE-2013-1486)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
パッケージをアップデートしてください。
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.
SRPMS
- java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8.AXS4.src.rpm
MD5: 04e4d41f67befb0e7c62aa1ede69b260
SHA-256: 823caa73d148608d04553d5686550db761f872f74e025d01e9de8c86c4cdd4a8
Size: 59.69 MB
Asianux Server 4 for x86
- java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8.AXS4.i686.rpm
MD5: c9dc40f4ab656982a7f2404e23e5dee8
SHA-256: 083033928b1515ecace87294f034f015b90854f15ce04b3ac6287cf297c0e447
Size: 26.07 MB - java-1.6.0-openjdk-devel-1.6.0.0-1.56.1.11.8.AXS4.i686.rpm
MD5: c58408bb3a428518a4e3f4bd6bbb4a75
SHA-256: 56e1d2d1e975cd0a225b0ba43949fa3b08e705672470fb22ffb5c4fe13d21ced
Size: 8.54 MB - java-1.6.0-openjdk-javadoc-1.6.0.0-1.56.1.11.8.AXS4.i686.rpm
MD5: c555435dd5e075d89e85fb0739df54a2
SHA-256: 22f790a553ad13f6eae57f78ef1d10048f182c764601316e65eb2ba618d7ee70
Size: 14.37 MB
Asianux Server 4 for x86_64
- java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8.AXS4.x86_64.rpm
MD5: 4d66f98af7f5a64abff45fcf4c2ef9ef
SHA-256: 620a90f645a624924dfc028397ddb9315658c19151ebf04071eae02ae9f3515e
Size: 25.10 MB - java-1.6.0-openjdk-devel-1.6.0.0-1.56.1.11.8.AXS4.x86_64.rpm
MD5: a6a4e48fa86245c3962de02724822c4f
SHA-256: ca18311c77b429feb6ca82d6b724820783e35e28cd40483582dfc7e29918aa40
Size: 8.53 MB - java-1.6.0-openjdk-javadoc-1.6.0.0-1.56.1.11.8.AXS4.x86_64.rpm
MD5: ccb48d189d085919c2d20ed8e81c11e1
SHA-256: f2d9dcd7993b8997cb3ae35a09bb4ed066b53d0b71522da83b79f754627f88dc
Size: 14.38 MB