Bug 1087409 - (CVE-2014-0429) CVE-2014-0429 OpenJDK: Incorrect mlib/raster image validation (2D, 8027841)
CVE-2014-0429 OpenJDK: Incorrect mlib/raster image validation (2D, 8027841)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Red Hat Product Security
impact=critical,public=20140415,repor...
: Security
Depends On:
Blocks: 1082776
  Show dependency treegraph
 
Reported: 2014-04-14 06:13 EDT by Stefan Cornelius
Modified: 2014-07-29 11:42 EDT (History)
6 users (show)

See Also:
Fixed In Version: icedtea 1.13.3, icedtea 2.4.7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-10 10:09:32 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Stefan Cornelius 2014-04-14 06:13:46 EDT
It was discovered that certain medialib operations do not properly
validate that mlib and raster images correspond to each other. A remote attacker could possibly use this flaw to trigger a Java Virtual Machine memory corruption.
Comment 1 Tomas Hoger 2014-04-16 02:41:05 EDT
Fixed now in Oracle Java SE 5.0u75, 6u75, 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.

Fixed in IcedTea6 1.13.3 and IcedTea7 2.4.7:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027214.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html

External References:

http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
Comment 2 errata-xmlrpc 2014-04-16 07:28:27 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:0407 https://rhn.redhat.com/errata/RHSA-2014-0407.html
Comment 3 errata-xmlrpc 2014-04-16 07:32:14 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:0406 https://rhn.redhat.com/errata/RHSA-2014-0406.html
Comment 4 errata-xmlrpc 2014-04-16 07:35:53 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2014:0408 https://rhn.redhat.com/errata/RHSA-2014-0408.html
Comment 5 errata-xmlrpc 2014-04-17 05:31:11 EDT
This issue has been addressed in following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:0413 https://rhn.redhat.com/errata/RHSA-2014-0413.html
Comment 6 errata-xmlrpc 2014-04-17 05:34:11 EDT
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2014:0412 https://rhn.redhat.com/errata/RHSA-2014-0412.html
Comment 7 Stefan Cornelius 2014-04-17 06:09:06 EDT
OpenJDK upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/37c689024d92
Comment 8 errata-xmlrpc 2014-04-17 07:45:59 EDT
This issue has been addressed in following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:0414 https://rhn.redhat.com/errata/RHSA-2014-0414.html
Comment 9 errata-xmlrpc 2014-05-13 15:48:44 EDT
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0486 https://rhn.redhat.com/errata/RHSA-2014-0486.html
Comment 10 errata-xmlrpc 2014-05-15 13:29:58 EDT
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0508 https://rhn.redhat.com/errata/RHSA-2014-0508.html
Comment 11 errata-xmlrpc 2014-05-15 14:22:55 EDT
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0509 https://rhn.redhat.com/errata/RHSA-2014-0509.html
Comment 12 errata-xmlrpc 2014-06-10 08:18:09 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0675 https://rhn.redhat.com/errata/RHSA-2014-0675.html
Comment 13 errata-xmlrpc 2014-06-10 08:39:13 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0685 https://rhn.redhat.com/errata/RHSA-2014-0685.html
Comment 14 errata-xmlrpc 2014-06-10 09:14:27 EDT
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2014:0705 https://rhn.redhat.com/errata/RHSA-2014-0705.html
Comment 15 errata-xmlrpc 2014-07-29 11:42:31 EDT
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4
  Red Hat Network Satellite Server v 5.5
  Red Hat Satellite Server v 5.6

Via RHSA-2014:0982 https://rhn.redhat.com/errata/RHSA-2014-0982.html

Note You need to log in before you can comment on or make changes to this bug.