Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenJDK 7 updates fix multiple security weaknesses
published 4 years ago
Summary
Several versions of the OpenJDK 7 Java runtime and development packages have been updated to address a range of security issues. These fixes improve how the software handles code compilation, method calls, XML processing, and other core functions, reducing the chance of attackers exploiting them. Apply the provided package updates to keep your Java environment protected.
What to do
- Update oracle java-1.7.0-openjdk to version 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1.
- Update oracle java-1.7.0-openjdk-demo to version 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1.
- Update oracle java-1.7.0-openjdk-devel to version 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1.
- Update oracle java-1.7.0-openjdk-javadoc to version 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1.
- Update oracle java-1.7.0-openjdk-src to version 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:6 | oracle | java-1.7.0-openjdk |
< 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1 Fix: upgrade to 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
|
| TuxCare:OracleLinux:6 | oracle | java-1.7.0-openjdk-demo |
< 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1 Fix: upgrade to 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
|
| TuxCare:OracleLinux:6 | oracle | java-1.7.0-openjdk-devel |
< 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1 Fix: upgrade to 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
|
| TuxCare:OracleLinux:6 | oracle | java-1.7.0-openjdk-javadoc |
< 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1 Fix: upgrade to 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
|
| TuxCare:OracleLinux:6 | oracle | java-1.7.0-openjdk-src |
< 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1 Fix: upgrade to 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
|
Original advisory text
Fixed 50 CVEs in java-1.7.0-openjdk
- Bump to 2.6.28 and OpenJDK 7u351-b01.
- Security fixes in 7u351:
- CVE-2022-21540: Improve class compilation (JDK-8281859)
- CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
- CVE-2022-34169: Improve Xalan supports (JDK-8285407)
- Security fixes in 7u341:
- CVE-2022-21426: Better XPath expression handling (JDK-8270504)
- CVE-2022-21434: Better invocation handler handling (JDK-8277672)
- CVE-2022-21443: Improved Object Identification (JDK-8275151)
- CVE-2022-21476: Improve Santuario processing (JDK-8278008)
- CVE-2022-21496: Improve URL supports (JDK-8278972)
- Security fixes in 7u331:
- CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
- CVE-2022-21282: Better resolution of URIs (JDK-8270492)
- CVE-2022-21283: Better String matching (JDK-8268813)
- CVE-2022-21293: Improve String constructions (JDK-8270392)
- CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
- CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
- CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
- CVE-2022-21305: Better array indexing (JDK-8272014)
- CVE-2022-21340: Verify Jar Verification (JDK-8272026)
- CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
- CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
- CVE-2022-21360: Enhance BMP image support (JDK-8273756)
- CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
- Security fixes in 7u321:
- CVE-2021-35550: Update the default enabled cipher suites preference
(JDK-8163326)
- CVE-2021-35556: Richer Text Editors (JDK-8265167)
- CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
- CVE-2021-35561: Better hashing support (JDK-8266097)
- CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
- CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close
(JDK-8254967)
- CVE-2021-35586: Better BMP support (JDK-8267735)
- CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if
InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
- CVE-2021-35603: Better session identification (JDK-8269618)
- Security fixes in 7u311:
- CVE-2021-2341: Improve file transfers (JDK-8258432)
- CVE-2021-2369: Better jar file validation (JDK-8260967)
- CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
- Security fixes in 7u301:
- CVE-2021-2161: Less ambiguous processing (JDK-8250568)
- CVE-2021-2163: Enhance opening JARs (JDK-8249906)
- Security fixes in 7u281:
- CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
- CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
- CVE-2020-14782: Enhance certificate processing (JDK-8237995)
- CVE-2020-14792: Better range handling (JDK-8241114)
- CVE-2020-14796: Improved URI Support (JDK-8242680)
- CVE-2020-14797: Better Path Validation (JDK-8242685)
- CVE-2020-14798: Enhanced buffer support (JDK-8242695)
- CVE-2020-14803: Improved Buffer supports (JDK-8244136)
- Security fixes in 7u271:
- CVE-2020-14577: Enhance certificate verification (JDK-8237592)
- CVE-2020-14578: NegativeArraySizeException in
sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
- CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
(JDK-8028431)
- CVE-2020-14581: Better matrix operations (JDK-8238002)
- CVE-2020-14583: Better Buffer support (JDK-8238920)
- CVE-2020-14593: Less Affine Transformations (JDK-8240119)
- CVE-2020-14621: Better XML namespace handling (JDK-8242136)
- Update tzdata requirement to 2022a to match JDK-8283350
- Update NEWS from IcedTea
- Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after
bump OpenJDK version
- Security fixes in 7u351:
- CVE-2022-21540: Improve class compilation (JDK-8281859)
- CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
- CVE-2022-34169: Improve Xalan supports (JDK-8285407)
- Security fixes in 7u341:
- CVE-2022-21426: Better XPath expression handling (JDK-8270504)
- CVE-2022-21434: Better invocation handler handling (JDK-8277672)
- CVE-2022-21443: Improved Object Identification (JDK-8275151)
- CVE-2022-21476: Improve Santuario processing (JDK-8278008)
- CVE-2022-21496: Improve URL supports (JDK-8278972)
- Security fixes in 7u331:
- CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
- CVE-2022-21282: Better resolution of URIs (JDK-8270492)
- CVE-2022-21283: Better String matching (JDK-8268813)
- CVE-2022-21293: Improve String constructions (JDK-8270392)
- CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
- CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
- CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
- CVE-2022-21305: Better array indexing (JDK-8272014)
- CVE-2022-21340: Verify Jar Verification (JDK-8272026)
- CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
- CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
- CVE-2022-21360: Enhance BMP image support (JDK-8273756)
- CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
- Security fixes in 7u321:
- CVE-2021-35550: Update the default enabled cipher suites preference
(JDK-8163326)
- CVE-2021-35556: Richer Text Editors (JDK-8265167)
- CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
- CVE-2021-35561: Better hashing support (JDK-8266097)
- CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
- CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close
(JDK-8254967)
- CVE-2021-35586: Better BMP support (JDK-8267735)
- CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if
InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
- CVE-2021-35603: Better session identification (JDK-8269618)
- Security fixes in 7u311:
- CVE-2021-2341: Improve file transfers (JDK-8258432)
- CVE-2021-2369: Better jar file validation (JDK-8260967)
- CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
- Security fixes in 7u301:
- CVE-2021-2161: Less ambiguous processing (JDK-8250568)
- CVE-2021-2163: Enhance opening JARs (JDK-8249906)
- Security fixes in 7u281:
- CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
- CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
- CVE-2020-14782: Enhance certificate processing (JDK-8237995)
- CVE-2020-14792: Better range handling (JDK-8241114)
- CVE-2020-14796: Improved URI Support (JDK-8242680)
- CVE-2020-14797: Better Path Validation (JDK-8242685)
- CVE-2020-14798: Enhanced buffer support (JDK-8242695)
- CVE-2020-14803: Improved Buffer supports (JDK-8244136)
- Security fixes in 7u271:
- CVE-2020-14577: Enhance certificate verification (JDK-8237592)
- CVE-2020-14578: NegativeArraySizeException in
sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
- CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
(JDK-8028431)
- CVE-2020-14581: Better matrix operations (JDK-8238002)
- CVE-2020-14583: Better Buffer support (JDK-8238920)
- CVE-2020-14593: Less Affine Transformations (JDK-8240119)
- CVE-2020-14621: Better XML namespace handling (JDK-8242136)
- Update tzdata requirement to 2022a to match JDK-8283350
- Update NEWS from IcedTea
- Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after
bump OpenJDK version
References
- https://errata.cloudlinux.com/ol6/CLSA-2022-1661173656.html Vendor Advisory
Timeline
Published22 Aug 2022
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2022-1661173656 · OSV
Track software like this
Free during beta