-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: java-1.7.1-ibm security update
Advisory ID:       RHSA-2019:2494-01
Product:           Red Hat Enterprise Linux Supplementary
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:2494
Issue date:        2019-08-15
CVE Names:         CVE-2019-2762 CVE-2019-2769 CVE-2019-2816 
                   CVE-2019-7317 CVE-2019-11775 
====================================================================
1. Summary:

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux
6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64

3. Description:

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment
and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP50.

Security Fix(es):

* IBM JDK: Failure to privatize a value pulled out of the loop by
versioning (CVE-2019-11775)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization
(Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in
Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518)
(CVE-2019-2816)

* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take
effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c
1730056 - CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)
1730099 - CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518)
1730415 - CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)
1738549 - CVE-2019-11775 IBM JDK: Failure to privatize a value pulled out of the loop by versioning

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.i686.rpm

x86_64:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

x86_64:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.i686.rpm

ppc64:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm

s390x:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm

x86_64:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.i686.rpm

x86_64:
java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-2762
https://access.redhat.com/security/cve/CVE-2019-2769
https://access.redhat.com/security/cve/CVE-2019-2816
https://access.redhat.com/security/cve/CVE-2019-7317
https://access.redhat.com/security/cve/CVE-2019-11775
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXVUgBtzjgjWX9erEAQg5bBAAjPXukMp83HTw0k3xseyBEklamYSAD5Hq
1Tidly9WGIiIjToZiswjUMGhuxjh9V0aUSXQaytgn7GLT/Hgh2ztFsLs039Nc2cw
AJnap7mpzuLwmWTASHHoLlYcciLHgkj/mdhOVOn4yrLNtMnRklv7NsBlNZgkrjBn
cYCz8ojE6Fc1BGzSYQBjHWRi0s6BCYfAY01ACgzAPIeRdp4JSzr6RUeuXP/wkAOM
KRKhhEF/RvrWutEIzJ9x4U0Sg7VpIDX3lyQohNRr7zn54GUxA8FfXSWb2JDs2Sjg
5YNq1YBAAB0oATXXNOkeykU7V29PRqe3LDHJZmK2oetXC2bke5HAZZ+VwuARYAjO
RxyWEjz2zWCNlpsfMLq1dMDHDxV3vedjJxStQMlGLfNiPg0NomNe2YZEM1larzt5
zeGip7CO8AhgUAVwVID/102Ep96hDP2n9O0Hp20JN1/GispwhOnUeOHAKt8NoIzX
/f4G/4qkNt9UmYjbaHjpM1dz6Wmqz5vxd4jzCJTKmfwZCJ29Xbsd4vPB5xV5412R
ltG/KuRrfWpz8oee1GkPY/DwmLErbr0dsayudJRc8R/jIAQRcG2UdsIR8kR298ek
FLsIZ6fzAE7Jjo883bG2chDsJ4xZ5lSuicehjke1PM4/a4dpMyxfVSu/esdSlx70
7VEaYReI+qw=LwYT
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2019-2494:01 Important: java-1.7.1-ibm security update

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary

Summary

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 7 to version 7R1 SR4-FP50.
Security Fix(es):
* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)
* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)
* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)
* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Summary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take effect.

References

https://access.redhat.com/security/cve/CVE-2019-2762 https://access.redhat.com/security/cve/CVE-2019-2769 https://access.redhat.com/security/cve/CVE-2019-2816 https://access.redhat.com/security/cve/CVE-2019-7317 https://access.redhat.com/security/cve/CVE-2019-11775 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
x86_64: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
ppc64: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.ppc64.rpm
s390x: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.s390x.rpm
x86_64: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.i686.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.i686.rpm
x86_64: java-1.7.1-ibm-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm java-1.7.1-ibm-src-1.7.1.4.50-1jpp.1.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity

Advisory ID: RHSA-2019:2494-01

Product: Red Hat Enterprise Linux Supplementary

Advisory URL: https://access.redhat.com/errata/RHSA-2019:2494

Issued Date: : 2019-08-15

CVE Names: CVE-2019-2762 CVE-2019-2769 CVE-2019-2816 CVE-2019-7317 CVE-2019-11775

Topic

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux6 Supplementary.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.