Bug 1242240 – CVE-2015-4732 OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1242240 - (CVE-2015-4732) CVE-2015-4732 OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405)

Summary:	CVE-2015-4732 OpenJDK: insufficient context checks during object deserializat...

Status:	CLOSED ERRATA

Aliases:	CVE-2015-4732

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	urgent Severity urgent
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=critical,public=20150714,repor...
Keywords:	Security

Depends On:
Blocks:	1235167
	Show dependency tree / graph

Reported:	2015-07-12 09:25 EDT by Tomas Hoger
Modified:	2015-08-13 08:18 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-08-13 08:18:16 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:1228	normal	SHIPPED_LIVE	Important: java-1.8.0-openjdk security update	2015-07-15 12:37:01 EDT
Red Hat Product Errata	RHSA-2015:1229	normal	SHIPPED_LIVE	Critical: java-1.7.0-openjdk security update	2015-07-15 12:35:48 EDT
Red Hat Product Errata	RHSA-2015:1230	normal	SHIPPED_LIVE	Important: java-1.7.0-openjdk security update	2015-07-15 12:01:10 EDT
Red Hat Product Errata	RHSA-2015:1241	normal	SHIPPED_LIVE	Critical: java-1.8.0-oracle security update	2017-12-15 10:34:28 EST
Red Hat Product Errata	RHSA-2015:1242	normal	SHIPPED_LIVE	Critical: java-1.7.0-oracle security update	2017-12-15 10:31:57 EST
Red Hat Product Errata	RHSA-2015:1243	normal	SHIPPED_LIVE	Important: java-1.6.0-sun security update	2017-12-15 10:34:18 EST
Red Hat Product Errata	RHSA-2015:1485	normal	SHIPPED_LIVE	Critical: java-1.7.1-ibm security update	2015-07-22 19:56:33 EDT
Red Hat Product Errata	RHSA-2015:1486	normal	SHIPPED_LIVE	Critical: java-1.6.0-ibm security update	2015-07-22 19:33:04 EDT
Red Hat Product Errata	RHSA-2015:1488	normal	SHIPPED_LIVE	Critical: java-1.7.0-ibm security update	2015-07-23 19:20:39 EDT
Red Hat Product Errata	RHSA-2015:1526	normal	SHIPPED_LIVE	Important: java-1.6.0-openjdk security update	2015-07-30 17:14:52 EDT
Red Hat Product Errata	RHSA-2015:1544	normal	SHIPPED_LIVE	Important: java-1.5.0-ibm security update	2015-08-04 17:13:08 EDT
Red Hat Product Errata	RHSA-2015:1604	normal	SHIPPED_LIVE	Moderate: Red Hat Satellite IBM Java Runtime security update	2015-08-12 16:38:58 EDT

Groups: None (edit)

Description Tomas Hoger 2015-07-12 09:25:10 EDT

It was discovered that the Libraries component of OpenJDK failed to check current context / thread while performing object deserialization, possibly leading to incorrect input deserialization.  An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2015-07-14 16:34:02 EDT

Public now via Oracle Critical Patch Update - July 2015.  Fixed in Oracle Java SE 6u101, 7u85, and 8u51.

External References:

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA

Comment 2 errata-xmlrpc 2015-07-15 08:01:45 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:1230 https://rhn.redhat.com/errata/RHSA-2015-1230.html

Comment 3 errata-xmlrpc 2015-07-15 08:36:41 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1229 https://rhn.redhat.com/errata/RHSA-2015-1229.html

Comment 4 errata-xmlrpc 2015-07-15 08:37:51 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:1228 https://rhn.redhat.com/errata/RHSA-2015-1228.html

Comment 5 Tomas Hoger 2015-07-16 11:00:22 EDT

OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/e0bf010f895b

Comment 6 errata-xmlrpc 2015-07-17 04:04:11 EDT

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2015:1243 https://rhn.redhat.com/errata/RHSA-2015-1243.html

Comment 7 errata-xmlrpc 2015-07-17 04:05:22 EDT

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2015:1242 https://rhn.redhat.com/errata/RHSA-2015-1242.html

Comment 8 errata-xmlrpc 2015-07-17 04:08:21 EDT

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2015:1241 https://rhn.redhat.com/errata/RHSA-2015-1241.html

Comment 9 errata-xmlrpc 2015-07-22 15:33:55 EDT

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2015:1486 https://rhn.redhat.com/errata/RHSA-2015-1486.html

Comment 10 errata-xmlrpc 2015-07-22 15:57:00 EDT

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 7
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2015:1485 https://rhn.redhat.com/errata/RHSA-2015-1485.html

Comment 11 errata-xmlrpc 2015-07-23 15:21:31 EDT

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2015:1488 https://rhn.redhat.com/errata/RHSA-2015-1488.html

Comment 12 errata-xmlrpc 2015-07-30 13:15:44 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:1526 https://rhn.redhat.com/errata/RHSA-2015-1526.html

Comment 13 errata-xmlrpc 2015-08-04 13:14:05 EDT

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2015:1544 https://rhn.redhat.com/errata/RHSA-2015-1544.html

Comment 14 errata-xmlrpc 2015-08-12 12:40:12 EDT

This issue has been addressed in the following products:

  Red Hat Satellite Server v 5.7
  Red Hat Satellite Server v 5.6

Via RHSA-2015:1604 https://rhn.redhat.com/errata/RHSA-2015-1604.html

Note You need to log in before you can comment on or make changes to this bug.