Amazon Linux 1 Security Advisory: ALAS-2016-700
Advisory Release Date: 2016-05-11 11:00 Pacific
Advisory Updated Date: 2016-05-11 11:00 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-0686, CVE-2016-0687)
It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427)
It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425)
It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695)
Affected Packages:
java-1.6.0-openjdk
Issue Correction:
Run yum update java-1.6.0-openjdk to update your system.
i686:
java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.1.74.amzn1.i686
java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.1.74.amzn1.i686
java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.1.74.amzn1.i686
java-1.6.0-openjdk-src-1.6.0.39-1.13.11.1.74.amzn1.i686
java-1.6.0-openjdk-1.6.0.39-1.13.11.1.74.amzn1.i686
java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.1.74.amzn1.i686
src:
java-1.6.0-openjdk-1.6.0.39-1.13.11.1.74.amzn1.src
x86_64:
java-1.6.0-openjdk-src-1.6.0.39-1.13.11.1.74.amzn1.x86_64
java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.1.74.amzn1.x86_64
java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.1.74.amzn1.x86_64
java-1.6.0-openjdk-debuginfo-1.6.0.39-1.13.11.1.74.amzn1.x86_64
java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.1.74.amzn1.x86_64
java-1.6.0-openjdk-1.6.0.39-1.13.11.1.74.amzn1.x86_64