Bug 907458 (CVE-2013-0441)
| Summary: | CVE-2013-0441 OpenJDK: missing serialization restriction (CORBA, 7201066) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Stefan Cornelius <scorneli> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | dbhole, jvanek |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | icedtea6 1.11.6, icedtea6 1.12.1, icedtea7 2.1.5, icedtea7 2.2.5, icedtea7 2.3.6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-03-12 09:05:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 906729 | ||
|
Description
Stefan Cornelius
2013-02-04 13:18:31 UTC
Upstream commit, as included in IcedTea7 repositories: http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/307ddc7799c7 This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:0237 https://rhn.redhat.com/errata/RHSA-2013-0237.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:0236 https://rhn.redhat.com/errata/RHSA-2013-0236.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:0246 https://rhn.redhat.com/errata/RHSA-2013-0246.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2013:0247 https://rhn.redhat.com/errata/RHSA-2013-0247.html This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:0245 https://rhn.redhat.com/errata/RHSA-2013-0245.html Fixed in upstream IcedTea versions IcedTea6 1.11.6, and 1.12.1, and IcedTea7 2.1.5, 2.2.5, and 2.3.6: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021708.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021728.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021905.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021876.html Note that version 2.3.5 was tagged in upstream mercurial including the security fixes, but was not released. Only 2.3.6 was released, correcting problem introduced by security patches as included in 2.3.5. This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:0626 https://rhn.redhat.com/errata/RHSA-2013-0626.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:0625 https://rhn.redhat.com/errata/RHSA-2013-0625.html This issue has been addressed in following products: Red Hat Network Satellite Server v 5.5 Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html This issue has been addressed in following products: Red Hat Network Satellite Server v 5.4 Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html |