java-1.5.0-ibm packages that correct several security issues are available
for Red Hat Enterprise Linux 4 Extras.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and
the IBM Java 2 Software Development Kit.
Vulnerabilities were discovered in the Java Runtime Environment. An
untrusted applet could use these vulnerabilities to access data from other
applets. (CVE-2006-6736, CVE-2006-6737)
Serialization flaws were discovered in the Java Runtime Environment. An
untrusted applet or application could use these flaws to elevate its
Buffer overflow vulnerabilities were discovered in the Java Runtime
Environment. An untrusted applet could use these flaws to elevate its
privileges, possibly reading and writing local files or executing local
Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures.
Where an RSA key with exponent 3 is used it may be possible for an attacker
to forge a PKCS #1 v1.5 signature that would be incorrectly verified by
implementations that do not check for excess data in the RSA exponentiation
result of the signature. (CVE-2006-4339)
All users of java-ibm-1.5.0 should upgrade to these packages, which contain
IBM's 1.5.0 SR3 Java release which resolves these issues.
Please note that the packages in this erratum are identical to those we
released on January 24th 2007 in advisory RHEA-2007:0027. We have issued
this security update because when we released RHEA-2007:0027 we were not
aware that it contained fixes for security issues. If you have already
updated to those packages you will not need to apply this update.