Bug 1087444 (CVE-2014-0459) - CVE-2014-0459 lcms: insufficient ICC profile version validation (OpenJDK 2D, 8031335)
Summary: CVE-2014-0459 lcms: insufficient ICC profile version validation (OpenJDK 2D, ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-0459
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1082776 1129263
TreeView+ depends on / blocked
 
Reported: 2014-04-14 10:35 UTC by Stefan Cornelius
Modified: 2021-02-17 06:40 UTC (History)
14 users (show)

Fixed In Version: icedtea 2.4.7
Clone Of:
Environment:
Last Closed: 2015-02-20 00:33:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0406 0 normal SHIPPED_LIVE Critical: java-1.7.0-openjdk security update 2014-04-16 15:24:01 UTC
Red Hat Product Errata RHSA-2014:0407 0 normal SHIPPED_LIVE Important: java-1.7.0-openjdk security update 2014-04-16 15:23:49 UTC
Red Hat Product Errata RHSA-2014:0412 0 normal SHIPPED_LIVE Critical: java-1.7.0-oracle security update 2014-04-17 13:28:34 UTC
Red Hat Product Errata RHSA-2014:0413 0 normal SHIPPED_LIVE Critical: java-1.7.0-oracle security update 2017-12-15 19:38:34 UTC
Red Hat Product Errata RHSA-2014:0486 0 normal SHIPPED_LIVE Critical: java-1.7.0-ibm security update 2014-05-13 23:47:47 UTC
Red Hat Product Errata RHSA-2014:0675 0 normal SHIPPED_LIVE Critical: java-1.7.0-openjdk security update 2014-06-10 16:13:04 UTC
Red Hat Product Errata RHSA-2014:0705 0 normal SHIPPED_LIVE Critical: java-1.7.1-ibm security update 2014-06-10 17:07:11 UTC

Description Stefan Cornelius 2014-04-14 10:35:15 UTC 
It was discovered that ICC profiles were not parsed correctly. An
untrusted Java application or applet could possibly use this flaw to
cause a denial of service.
Comment 1 Tomas Hoger 2014-04-15 19:47:20 UTC 
This issue affects lcms embedded in OpenJDK.  Red Hat Enterprise Linux OpenJDK packages build and use embedded lcms version:

- java-1.6.0-openjdk on Red Hat Enterprise Linux 5 and 6 use embedded lcms (1.x)
- java-1.7.0-openjdk on Red Hat Enterprise Linux 5 and 6 use embedded lcms (2.x)
Comment 3 Tomas Hoger 2014-04-16 07:13:17 UTC 
Fixed now in Oracle Java SE 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.

Fixed in IcedTea7 2.4.7:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html

External References:

http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
Comment 4 Tomas Hoger 2014-04-16 07:23:56 UTC 
Patch as applied in upstream OpenJDK8 repositories:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/d6739b8326a4
Comment 5 errata-xmlrpc 2014-04-16 11:29:52 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:0407 https://rhn.redhat.com/errata/RHSA-2014-0407.html
Comment 6 errata-xmlrpc 2014-04-16 11:31:34 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:0406 https://rhn.redhat.com/errata/RHSA-2014-0406.html
Comment 7 Tomas Hoger 2014-04-16 12:40:24 UTC 
Created Little-CMS upstream bug to make sure upstream is aware of this fix:

https://github.com/mm2/Little-CMS/issues/29
Comment 8 errata-xmlrpc 2014-04-17 09:32:50 UTC 
This issue has been addressed in following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:0413 https://rhn.redhat.com/errata/RHSA-2014-0413.html
Comment 9 errata-xmlrpc 2014-04-17 09:37:57 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2014:0412 https://rhn.redhat.com/errata/RHSA-2014-0412.html
Comment 10 errata-xmlrpc 2014-05-13 19:50:13 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0486 https://rhn.redhat.com/errata/RHSA-2014-0486.html
Comment 11 errata-xmlrpc 2014-06-10 12:17:45 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0675 https://rhn.redhat.com/errata/RHSA-2014-0675.html
Comment 12 errata-xmlrpc 2014-06-10 13:15:38 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2014:0705 https://rhn.redhat.com/errata/RHSA-2014-0705.html
Comment 13 Kurt Seifried 2015-02-24 07:02:15 UTC 
Statement:

This issue affects the versions of lcms as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Note You need to log in before you can comment on or make changes to this bug.