Available Exploits 

• Java Secure Socket Extension (JSSE) SKIP-TLS MITM Proxy

Description

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environmentand the IBM Java Software Development Kit.This update fixes several vulnerabilities in the IBM Java RuntimeEnvironment and the IBM Java Software Development Kit. Detailedvulnerability descriptions are linked from the IBM Security alertspage, listed in the References section. (CVE-2014-6549, CVE-2014-6585,CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892,CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410,CVE-2015-0412)All users of java-1.7.1-ibm are advised to upgrade to these updatedpackages, containing the IBM Java SE 7R1 SR2-FP10 release. All runninginstances of IBM Java must be restarted for the update to take effect.

References

• BID-72137
• BID-72168
• BID-72169
• BID-72173
• BID-72175
• CVE-2014-6549
• CVE-2014-6585
• CVE-2014-6587
• CVE-2014-6591
• CVE-2014-6593
• CVE-2014-8891
• CVE-2014-8892
• CVE-2015-0403
• CVE-2015-0406
• CVE-2015-0407
• CVE-2015-0408
• CVE-2015-0410
• CVE-2015-0412
• DEBIAN-DSA-3144
• DEBIAN-DSA-3147
• REDHAT-RHSA-2015:0068
• REDHAT-RHSA-2015:0079
• REDHAT-RHSA-2015:0080
• REDHAT-RHSA-2015:0085
• REDHAT-RHSA-2015:0086
• REDHAT-RHSA-2015:0133
• REDHAT-RHSA-2015:0136
• REDHAT-RHSA-2015:0264
• XF-100140
• XF-100142
• XF-100145
• XF-100147
• XF-100150
• XF-100151

Solution

Related Vulnerabilities

• Gentoo Linux: CVE-2015-0412: IcedTea: Multiple vulnerabilities
• HP-UX: CVE-2015-0408: JRE and JDK Vulnerability on HPUX
• Gentoo Linux: CVE-2015-0403: Oracle JRE/JDK: Multiple vulnerabilities
• Cent OS: CVE-2014-6587: CESA-2015:0085 (java-1.6.0-openjdk)
• HP-UX: CVE-2014-6593: Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
• RHSA-2015:0067: java-1.7.0-openjdk security update
• Java CPU January 2015 Java SE RMI vulnerability (CVE-2015-0408)
• SUSE: CVE-2014-6585: SUSE Linux Security Advisory
• IBM AIX: java_feb2015_advisory (CVE-2014-6587): Vulnerability in IBM Java SDK affects AIX
• SUSE: CVE-2014-6549: SUSE Linux Security Advisory
• Gentoo Linux: CVE-2014-6591: IcedTea: Multiple vulnerabilities
• Amazon Linux AMI: Security patch for java-1.6.0-openjdk (ALAS-2015-480) (multiple CVEs)
• Java CPU January 2015 Java SE, Java SE Embedded, JRockit Security vulnerability (CVE-2015-0410)
• ELSA-2015-0067 Critical: Oracle Linux java-1.7.0-openjdk security update
• Gentoo Linux: CVE-2014-6585: IcedTea: Multiple vulnerabilities
• USN-2486-1: OpenJDK 6 vulnerabilities
• IBM AIX: java_feb2015_advisory (CVE-2014-6591): Vulnerability in IBM Java SDK affects AIX
• Gentoo Linux: CVE-2014-6587: IcedTea: Multiple vulnerabilities
• Vulnerabilities deemed not relevant on Red Hat Enterprise Linux 5
• IBM WebSphere Application Server: CVE-2014-6593: IBM Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU
• RHSA-2015:0080: java-1.8.0-oracle security update
• ELSA-2015-0069 Important: Oracle Linux java-1.8.0-openjdk security update
• DSA-3147-1 openjdk-6 -- security update
• Oracle Solaris 11: CVE-2014-6591: Vulnerability in Localization (L10N)
• Vulnerabilities deemed not relevant on Red Hat Enterprise Linux 7
• IBM AIX: java_feb2015_advisory (CVE-2015-0407): Vulnerability in IBM Java SDK affects AIX
• Java CPU January 2015 Java SE Swing vulnerability (CVE-2015-0407)
• Gentoo Linux: CVE-2015-0408: IcedTea: Multiple vulnerabilities
• RHSA-2015:0086: java-1.6.0-sun security update
• Amazon Linux AMI: Security patch for java-1.8.0-openjdk (ALAS-2015-472) (multiple CVEs)
• Gentoo Linux: CVE-2015-0407: IcedTea: Multiple vulnerabilities
• IBM AIX: java_feb2015_advisory (CVE-2014-6585): Vulnerability in IBM Java SDK affects AIX
• HP-UX: CVE-2015-0406: Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
• RHSA-2015:0263: Red Hat Satellite IBM Java Runtime security update
• DSA-3323-1 icu -- security update
• ELSA-2015-0085 Important: Oracle Linux java-1.6.0-openjdk security update
• Java CPU January 2015 Java SE, Java SE Embedded, JRockit JSSE vulnerability (CVE-2014-6593)
• RHSA-2015:0079: java-1.7.0-oracle security update
• Gentoo Linux: CVE-2014-6593: IcedTea: Multiple vulnerabilities
• HP-UX: CVE-2015-0410: Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
• IBM AIX: java_feb2015_advisory (CVE-2014-6549): Vulnerability in IBM Java SDK affects AIX
• DSA-3144-1 openjdk-7 -- security update
• RHSA-2015:0068: java-1.7.0-openjdk security update
• IBM WebSphere Application Server: CVE-2015-0410: IBM Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU
• SUSE: CVE-2014-6593: SUSE Linux Security Advisory
• USN-2522-3: ICU vulnerabilities
• HP-UX: CVE-2015-0412: Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
• ELSA-2015-0068 Important: Oracle Linux java-1.7.0-openjdk security update
• Java CPU January 2015 Java SE JAX-WS vulnerability (CVE-2015-0412)
• RHSA-2015:0085: java-1.6.0-openjdk security update
• IBM AIX: java_feb2015_advisory (CVE-2015-0406): Vulnerability in IBM Java SDK affects AIX
• Cent OS: CVE-2014-6549: CESA-2015:0069 (java-1.8.0-openjdk)
• IBM AIX: java_feb2015_advisory (CVE-2015-0410): Vulnerability in IBM Java SDK affects AIX
• Java CPU January 2015 Java SE Libraries vulnerability (CVE-2014-6587)
• Cent OS: CVE-2014-6585: CESA-2015:0085 (java-1.6.0-openjdk)
• HP-UX: CVE-2014-6549: JRE and JDK Vulnerability on HPUX
• Java CPU January 2015 Java SE Deployment vulnerability (CVE-2015-0403)
• HP-UX: CVE-2015-0407: JRE and JDK Vulnerability on HPUX
• SUSE: CVE-2014-6587: SUSE Linux Security Advisory
• Gentoo Linux: CVE-2015-0410: Oracle JRE/JDK: Multiple vulnerabilities
• Java CPU January 2015 Java SE Libraries vulnerability (CVE-2014-6549)
• USN-2522-1: ICU vulnerabilities
• Java CPU January 2015 Java SE 2D vulnerability (CVE-2014-6585)
• Amazon Linux AMI: Security patch for java-1.7.0-openjdk (ALAS-2015-471) (multiple CVEs)
• RHSA-2015:0134: java-1.7.0-ibm security update
• Java CPU January 2015 Java SE Deployment vulnerability (CVE-2015-0406)
• Cent OS: CVE-2014-6591: CESA-2015:0085 (java-1.6.0-openjdk)
• RHSA-2015:0264: Red Hat Satellite IBM Java Runtime security update
• IBM AIX: java_feb2015_advisory (CVE-2015-0403): Vulnerability in IBM Java SDK affects AIX
• RHSA-2015:0136: java-1.5.0-ibm security update
• Java CPU January 2015 Java SE 2D vulnerability (CVE-2014-6591)
• IBM AIX: java_feb2015_advisory (CVE-2015-0412): Vulnerability in IBM Java SDK affects AIX
• SUSE: CVE-2014-6591: SUSE Linux Security Advisory
• RHSA-2015:0069: java-1.8.0-openjdk security update
• Vulnerabilities deemed not relevant on Red Hat Enterprise Linux 6
• HP-UX: CVE-2015-0403: JRE and JDK Vulnerability on HPUX
• HP-UX: CVE-2014-6585: Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
• IBM AIX: java_feb2015_advisory (CVE-2014-6593): Vulnerability in IBM Java SDK affects AIX
• Oracle Solaris 11: CVE-2014-6585: Vulnerability in Localization (L10N)
• Gentoo Linux: CVE-2015-0406: Oracle JRE/JDK: Multiple vulnerabilities
• HP-UX: CVE-2014-6591: Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities.
• Gentoo Linux: CVE-2014-6549: Oracle JRE/JDK: Multiple vulnerabilities
• Cent OS: CVE-2014-6593: CESA-2015:0085 (java-1.6.0-openjdk)
• USN-2487-1: OpenJDK 7 vulnerabilities
• RHSA-2015:0135: java-1.6.0-ibm security update
• DSA-3187-1 icu -- security update
• IBM AIX: java_feb2015_advisory (CVE-2014-8891): Vulnerability in IBM Java SDK affects AIX
• HP-UX: CVE-2014-6587: JRE and JDK Vulnerability on HPUX
• IBM AIX: java_feb2015_advisory (CVE-2015-0408): Vulnerability in IBM Java SDK affects AIX