Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.3320
Important: java-1.8.0-ibm security updates
3 September 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: java-1.8.0-ibm
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Red Hat Enterprise Linux WS/Desktop 8
Red Hat Enterprise Linux Server 8
Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-11775 CVE-2019-11772 CVE-2019-7317
CVE-2019-2816 CVE-2019-2786 CVE-2019-2769
CVE-2019-2762
Reference: ASB-2019.0212
ESB-2019.3314
ESB-2019.3313
ESB-2019.3239
ESB-2019.3238
ESB-2019.3237
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:2592
https://access.redhat.com/errata/RHSA-2019:2590
https://access.redhat.com/errata/RHSA-2019:2585
Comment: This bulletin contains three (3) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2019:2592-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2592
Issue date: 2019-09-02
CVE Names: CVE-2019-2762 CVE-2019-2769 CVE-2019-2786
CVE-2019-2816 CVE-2019-7317 CVE-2019-11772
CVE-2019-11775
=====================================================================
1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP40.
Security Fix(es):
* IBM JDK: Out-of-bounds access in the String.getBytes method
(CVE-2019-11772)
* IBM JDK: Failure to privatize a value pulled out of the loop by
versioning (CVE-2019-11775)
* OpenJDK: Insufficient checks of suppressed exceptions in deserialization
(Utilities, 8212328) (CVE-2019-2762)
* OpenJDK: Unbounded memory allocation during deserialization in
Collections (Utilities, 8213432) (CVE-2019-2769)
* OpenJDK: Missing URL format validation (Networking, 8221518)
(CVE-2019-2816)
* OpenJDK: Insufficient restriction of privileges in AccessController
(Security, 8216381) (CVE-2019-2786)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take
effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c
1730056 - CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)
1730099 - CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518)
1730255 - CVE-2019-2786 OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)
1730415 - CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)
1738547 - CVE-2019-11772 IBM JDK: Out-of-bounds access in the String.getBytes method
1738549 - CVE-2019-11775 IBM JDK: Failure to privatize a value pulled out of the loop by versioning
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
ppc64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.ppc64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.ppc64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.ppc64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.ppc64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.ppc64.rpm
s390x:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.s390x.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.s390x.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.s390x.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.s390x.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.s390x.rpm
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.i686.rpm
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-2762
https://access.redhat.com/security/cve/CVE-2019-2769
https://access.redhat.com/security/cve/CVE-2019-2786
https://access.redhat.com/security/cve/CVE-2019-2816
https://access.redhat.com/security/cve/CVE-2019-7317
https://access.redhat.com/security/cve/CVE-2019-11772
https://access.redhat.com/security/cve/CVE-2019-11775
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXWzwXNzjgjWX9erEAQhVKg/+NL0N/NQZo2l8xHF12g5OvkMbcmsHYxDD
fgnpy7cbb5guK2hb+MmGLKm3+wI25UACMeAvrLmZjll3pEJMXCwiqL3MGUUff6rY
+32t4tdHxV8WT95105KEyZax2tMl/2qHsAti/P9rPcDSs+O+5J2/wcRPclCW1dnv
Rsi2lLY5hGBvbRbfkyGcDmWVQg8G9RI821uH6iz1h+CPjqE9cTk0oqFiS7Icu3MI
3GmSMPqy3eTNitk3saGAjuJ4dWNu3i+6TG9odByfZCLvI6YZv7vid13QX4qRauwW
xDien7vvKajjnZT4DPJ4RL66hDMcKiF6ne//aAo1qlfJWxC90LjmjkioeJ17WeX2
BuVzfJT5a5X0ZbJhNKcc+Da67AL/ngzjwm76ja0CfhAk7TYt4pmx4ZgHLgK8LuDg
4qSULSNs3hhU9lZqif+Xog8WxDDfIbKrR3bAlq4NzxpO16sqZBdCHTAEHfcmxqIO
oJbW0fUmHe5MI8+ExsJZS9aYGrtp0ItFw7oKMjTEMsXOYMePVhK8nsEJeAnS3UoV
XJ0WVt1vCACLE6E4Omk0Eb7vZFqlPYsz7wEoteP+Xz98xKUMQpaiOpG91EQHjvXd
koU480bXYbn8daIAmRzfF4YkYOM38rNPjfbFRSiRIV6rZf3U2Zs+gllj/kQQQfVo
5xeWfsjWpas=
=ECNs
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2019:2590-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2590
Issue date: 2019-09-02
CVE Names: CVE-2019-2762 CVE-2019-2769 CVE-2019-2786
CVE-2019-2816 CVE-2019-7317 CVE-2019-11772
CVE-2019-11775
=====================================================================
1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux 8 Supplementary - ppc64le, s390x, x86_64
3. Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP40.
Security Fix(es):
* IBM JDK: Out-of-bounds access in the String.getBytes method
(CVE-2019-11772)
* IBM JDK: Failure to privatize a value pulled out of the loop by
versioning (CVE-2019-11775)
* OpenJDK: Insufficient checks of suppressed exceptions in deserialization
(Utilities, 8212328) (CVE-2019-2762)
* OpenJDK: Unbounded memory allocation during deserialization in
Collections (Utilities, 8213432) (CVE-2019-2769)
* OpenJDK: Missing URL format validation (Networking, 8221518)
(CVE-2019-2816)
* OpenJDK: Insufficient restriction of privileges in AccessController
(Security, 8216381) (CVE-2019-2786)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take
effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c
1730056 - CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)
1730099 - CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518)
1730255 - CVE-2019-2786 OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)
1730415 - CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)
1738547 - CVE-2019-11772 IBM JDK: Out-of-bounds access in the String.getBytes method
1738549 - CVE-2019-11775 IBM JDK: Failure to privatize a value pulled out of the loop by versioning
6. Package List:
Red Hat Enterprise Linux 8 Supplementary:
ppc64le:
java-1.8.0-ibm-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-headless-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-src-1.8.0.5.40-3.el8_0.ppc64le.rpm
java-1.8.0-ibm-webstart-1.8.0.5.40-3.el8_0.ppc64le.rpm
s390x:
java-1.8.0-ibm-1.8.0.5.40-3.el8_0.s390x.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-3.el8_0.s390x.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-3.el8_0.s390x.rpm
java-1.8.0-ibm-headless-1.8.0.5.40-3.el8_0.s390x.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-3.el8_0.s390x.rpm
java-1.8.0-ibm-src-1.8.0.5.40-3.el8_0.s390x.rpm
x86_64:
java-1.8.0-ibm-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-headless-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-3.el8_0.x86_64.rpm
java-1.8.0-ibm-webstart-1.8.0.5.40-3.el8_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-2762
https://access.redhat.com/security/cve/CVE-2019-2769
https://access.redhat.com/security/cve/CVE-2019-2786
https://access.redhat.com/security/cve/CVE-2019-2816
https://access.redhat.com/security/cve/CVE-2019-7317
https://access.redhat.com/security/cve/CVE-2019-11772
https://access.redhat.com/security/cve/CVE-2019-11775
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXWzIwNzjgjWX9erEAQjc0g/9HWqP2sFQRp/rA/7u8kQUu9Oge+4kwGcl
h+Cd2DDNXplL3qnaZFZFuyaxMkLXqMrxd0+0tRZUN4Zs2vuxHe6x2xo89bolFuyQ
slu/ZvfaQe88oXYYSbWoBPkXujq4v9UshgH9gNXxtnCO8Nfr3hN279lIFpMTh4Ar
yYQMcZJ9AA1DqvG8Wcc2OxqUSaSjQxr2NGZSQIrhayj8BqMsLiu4Ldm1W39R/rul
rTL8UFgw4USYC+3reb790iAdqC5KTaN7IZEdatQ8CFuNkkUCA0auua5qYIGEzOgC
tC+mUZn+snprIMyr7wSjWKJr8xVdwn7ulTtBHtO2651nuD09MFxAwcMGzRwjmRpk
8CDBssqSia4+40EmgTgL2vZ5+SL6NS0DioIAGhf9ttDmbFVXIC9nMeNKX7NhRPkK
72ysgk8ZrPwLLWCy6uzI8cEI6Bmng5OpePzo5jegGSanVU13L2c3O7gQDCwqH/80
3cDxo7iJ+gqHTX06bgqqTpqGysjjotyw3JpToU8k2rOddeAEZ19cq2syLQqSMbBb
XREQzjrY+lgIu479iKD4zXFEGH6W/0pG2O7rX02dHT0Bczo2UEu3FKvA94JoE4Cv
BaZA2Ll93tLETGUcQllLF7OnYPmfu0ZuovQ/EoYbh9nr+NZqOBlLxV8YNziWUOR3
bPUJa5S1F5c=
=TdDS
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2019:2585-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2585
Issue date: 2019-09-02
CVE Names: CVE-2019-2762 CVE-2019-2769 CVE-2019-2786
CVE-2019-2816 CVE-2019-7317 CVE-2019-11772
CVE-2019-11775
=====================================================================
1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
7 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64
3. Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP40.
Security Fix(es):
* IBM JDK: Out-of-bounds access in the String.getBytes method
(CVE-2019-11772)
* IBM JDK: Failure to privatize a value pulled out of the loop by
versioning (CVE-2019-11775)
* OpenJDK: Insufficient checks of suppressed exceptions in deserialization
(Utilities, 8212328) (CVE-2019-2762)
* OpenJDK: Unbounded memory allocation during deserialization in
Collections (Utilities, 8213432) (CVE-2019-2769)
* OpenJDK: Missing URL format validation (Networking, 8221518)
(CVE-2019-2816)
* OpenJDK: Insufficient restriction of privileges in AccessController
(Security, 8216381) (CVE-2019-2786)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take
effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c
1730056 - CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)
1730099 - CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518)
1730255 - CVE-2019-2786 OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)
1730415 - CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)
1738547 - CVE-2019-11772 IBM JDK: Out-of-bounds access in the String.getBytes method
1738549 - CVE-2019-11775 IBM JDK: Failure to privatize a value pulled out of the loop by versioning
6. Package List:
Red Hat Enterprise Linux Client Supplementary (v. 7):
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 7):
ppc64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.ppc64.rpm
ppc64le:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.ppc64le.rpm
s390x:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.s390x.rpm
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 7):
x86_64:
java-1.8.0-ibm-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.40-1jpp.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-2762
https://access.redhat.com/security/cve/CVE-2019-2769
https://access.redhat.com/security/cve/CVE-2019-2786
https://access.redhat.com/security/cve/CVE-2019-2816
https://access.redhat.com/security/cve/CVE-2019-7317
https://access.redhat.com/security/cve/CVE-2019-11772
https://access.redhat.com/security/cve/CVE-2019-11775
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXWzCatzjgjWX9erEAQhWeg//ZCTrCA7fbx+YSJVvctfb9B5e6AsT5Yi7
CdxehlyJ0hVzcQWgtGInf563LX+wZ7aMWHDfoSEzVXXP+9N81B2j0OMY4ZwZi5/f
nlIBGITyMv0dX0o60/MVG7b6dWIgNIlkAA5mZKzkmrKeQu3socv7Jno2RkTtV9Ce
vCy9pr0Q+wShPOTHZYXo98PMpyuGAsB9XBsL3W27rJY3rYWlU8o/py5DalMk5bJG
UiQWhuyb23wr4+1CAhLufRigmShJn6emNyyByLqdIHEBPr7/qd+piAxa1T6gMC2m
mQyqf9R7zuBeraa7IsKm3dDS74EtHvX2NCOIwwpT+41UnTMqEBaYKeZyXGNHbg/x
uQiAW4d57HaWQDBDCbvEEC0LRfSExD/lQHn/xXlIiCJlXnM8bKUO77RwItK/crhC
nxJ4X1WuJpYH7Z661OEPAEayXSOidoUwCxp3eGB361BtriVeCzCnEUVzr/jteZTw
fTW8vmgvPHc7/AieR+EZk2+pqYXFgM45GMbwMWwiTiBz0t4SxO/pwcDyndVPZn1M
AkL0FkXiMw8wolqr4j6UIZyUY78frZ5Tp/ogEfgTe54TSwOAJ12UX4AYTfjQWks1
KRhGsuWdq0tOP+iYACJXBoznEvv7new1ahwMO28+a1l1mwP/eJ55f/haUWzY2k0R
5rCqxFR25EU=
=GVdR
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXW2wG2aOgq3Tt24GAQgR/g/8Cv7HWVyDvwshTHW4ecpQFnmhe5k4KH8T
GJhJKIl1IZJWi4z1WFia+4jyj6UkraNv8p1hGHr3j+AyGE6XWmDtv0KNGgBJ79oG
LX5R+X6o5q3SookP/ss2+Vz30UavPIEyCMK9G9dYrhahTNT9JkanmDkTg1J4XRmT
b8jAI1z/Zgn05aDKzmggLDoZZf98IV6EQihoCJr0iSW6LJI7n94hpXVFU+WMxAuo
HU7Pe2uenyglflgyPVk3cbweH9VCqGHCXbLZgJOCSzjTd0ugEzKkQb6D0gF91sTg
y8w6e2a4io3qvUgqkIVLemsA7I26mhzFcxav/5Q+lZRAGbg4BntwxapnTxYqwlBQ
ILH6TNb6f8dGLaruB5Th2p0ySo2qDcp/8DGNEj6Y50SAmfwyOnfk+6NqReMbfqvn
39XS2XYMw4ldovEILbQ4z4YzZMtKoQ8qc/JFNfHIaLAmoheWGFqG95I7EGTNzvpj
MSJjNCP5q6ZCFAqR2A2HAklgpF/lllSOephey3RpySuQ/q711abi7LjEZc6E0NI0
ECwt25rG+V5gEpE6dQ2aRj/6+zqcEhOSaCddVuzrszuT+IkvXaOuYn/8xk5akgXu
Vg7uK/sQpIlEH6Vos1x/9UicsUv1rCuwdKIcnUZwiSzQ9mjQQBiUrTvjg3kYiuzT
TzJ498pEdac=
=vkXi
-----END PGP SIGNATURE-----