Bug 1299441 (CVE-2016-0483) - CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017)
Summary: CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-0483
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1295699
TreeView+ depends on / blocked
 
Reported: 2016-01-18 11:49 UTC by Tomas Hoger
Modified: 2021-02-17 04:30 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Clone Of:
Environment:
Last Closed: 2016-02-02 15:20:47 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0049 0 normal SHIPPED_LIVE Critical: java-1.8.0-openjdk security update 2016-01-21 00:30:34 UTC
Red Hat Product Errata RHSA-2016:0050 0 normal SHIPPED_LIVE Important: java-1.8.0-openjdk security update 2016-01-21 00:14:13 UTC
Red Hat Product Errata RHSA-2016:0053 0 normal SHIPPED_LIVE Critical: java-1.7.0-openjdk security update 2016-01-21 16:39:02 UTC
Red Hat Product Errata RHSA-2016:0054 0 normal SHIPPED_LIVE Important: java-1.7.0-openjdk security update 2016-01-21 16:54:56 UTC
Red Hat Product Errata RHSA-2016:0055 0 normal SHIPPED_LIVE Critical: java-1.8.0-oracle security update 2017-12-15 03:12:59 UTC
Red Hat Product Errata RHSA-2016:0056 0 normal SHIPPED_LIVE Critical: java-1.7.0-oracle security update 2017-12-15 15:31:39 UTC
Red Hat Product Errata RHSA-2016:0057 0 normal SHIPPED_LIVE Important: java-1.6.0-sun security update 2017-12-15 03:12:03 UTC
Red Hat Product Errata RHSA-2016:0067 0 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security update 2016-01-26 18:10:31 UTC
Red Hat Product Errata RHSA-2016:0098 0 normal SHIPPED_LIVE Critical: java-1.8.0-ibm security update 2016-02-02 18:39:03 UTC
Red Hat Product Errata RHSA-2016:0099 0 normal SHIPPED_LIVE Critical: java-1.7.1-ibm security update 2016-02-02 18:52:52 UTC
Red Hat Product Errata RHSA-2016:0100 0 normal SHIPPED_LIVE Critical: java-1.7.0-ibm security update 2016-02-02 15:04:39 UTC
Red Hat Product Errata RHSA-2016:0101 0 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2016-02-02 15:00:49 UTC
Red Hat Product Errata RHSA-2016:1430 0 normal SHIPPED_LIVE Moderate: java-1.7.0-ibm and java-1.7.1-ibm security update 2016-07-18 17:51:35 UTC

Description Tomas Hoger 2016-01-18 11:49:48 UTC 
It was discovered that the JPEG decoder in the AWT component of OpenJDK did not use correct buffer boundary in certain cases when decoding JPEG files.  A specially crafted JPEG file could cause a Java application to corrupt its memory and possibly execute arbitrary code when opened.  An untrusted Java application or applet could also use this flaw to bypass Java sandbox restrictions.
Comment 1 Tomas Hoger 2016-01-19 21:51:45 UTC 
Public now via Oracle Critical Patch Update - January 2016.  Fixed in Oracle Java SE 6u111, 7u95, and 8u71.

External References:

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixJAVA
Comment 2 Tomas Hoger 2016-01-20 13:55:42 UTC 
OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/43325651ebb8
Comment 3 errata-xmlrpc 2016-01-20 19:15:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0050 https://rhn.redhat.com/errata/RHSA-2016-0050.html
Comment 4 errata-xmlrpc 2016-01-20 19:34:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:0049 https://rhn.redhat.com/errata/RHSA-2016-0049.html
Comment 5 errata-xmlrpc 2016-01-21 11:23:37 UTC 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:0057 https://rhn.redhat.com/errata/RHSA-2016-0057.html
Comment 6 errata-xmlrpc 2016-01-21 11:40:20 UTC 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:0056 https://rhn.redhat.com/errata/RHSA-2016-0056.html
Comment 7 errata-xmlrpc 2016-01-21 11:41:47 UTC 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:0055 https://rhn.redhat.com/errata/RHSA-2016-0055.html
Comment 8 errata-xmlrpc 2016-01-21 11:43:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0053 https://rhn.redhat.com/errata/RHSA-2016-0053.html
Comment 9 errata-xmlrpc 2016-01-21 11:59:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5

Via RHSA-2016:0054 https://rhn.redhat.com/errata/RHSA-2016-0054.html
Comment 10 errata-xmlrpc 2016-01-26 13:12:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 7

Via RHSA-2016:0067 https://rhn.redhat.com/errata/RHSA-2016-0067.html
Comment 11 errata-xmlrpc 2016-02-02 10:06:01 UTC 
This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2016:0101 https://rhn.redhat.com/errata/RHSA-2016-0101.html
Comment 12 errata-xmlrpc 2016-02-02 10:07:33 UTC 
This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2016:0100 https://rhn.redhat.com/errata/RHSA-2016-0100.html
Comment 13 errata-xmlrpc 2016-02-02 13:40:17 UTC 
This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2016:0098 https://rhn.redhat.com/errata/RHSA-2016-0098.html
Comment 14 errata-xmlrpc 2016-02-02 13:54:12 UTC 
This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 7
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2016:0099 https://rhn.redhat.com/errata/RHSA-2016-0099.html
Comment 16 errata-xmlrpc 2016-07-18 13:56:52 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 5.6
  Red Hat Satellite 5.7

Via RHSA-2016:1430 https://access.redhat.com/errata/RHSA-2016:1430
Note You need to log in before you can comment on or make changes to this bug.