Bug 1150273 (CVE-2014-6519)

Summary:	CVE-2014-6519 OpenJDK: missing BootstrapMethods bounds check (Hotspot, 8041717)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dbhole, jvanek, omajid, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-17 09:27:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1148726

Description Tomas Hoger 2014-10-07 19:11:40 UTC

It was discovered that the Hotspot JVM in OpenJDK failed to properly perform boundary checks when reading BootstrapMethods attributes from the Java class files.  A specially crafted class file could trigger JVM memory corruption.

Comment 1 Tomas Hoger 2014-10-14 20:09:35 UTC

Public now via Oracle Critical Patch Update - October 2014.  Fixed in Oracle Java SE 7u71, and 8u25.

External References:

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA

Comment 2 errata-xmlrpc 2014-10-14 20:48:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1633 https://rhn.redhat.com/errata/RHSA-2014-1633.html

Comment 3 errata-xmlrpc 2014-10-15 01:27:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2014:1620 https://rhn.redhat.com/errata/RHSA-2014-1620.html

Comment 4 errata-xmlrpc 2014-10-15 02:09:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5

Via RHSA-2014:1634 https://rhn.redhat.com/errata/RHSA-2014-1634.html

Comment 5 errata-xmlrpc 2014-10-15 03:03:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1636 https://rhn.redhat.com/errata/RHSA-2014-1636.html

Comment 6 Tomas Hoger 2014-10-16 13:19:37 UTC

This issue was fixed in IcedTea6 1.13.5 and IcedTea7 2.5.3:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-October/029884.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-October/029889.html

Upstream OpenJDK commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/3b0fe4ec6ebe

Comment 7 errata-xmlrpc 2014-10-16 23:12:41 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:1657 https://rhn.redhat.com/errata/RHSA-2014-1657.html