The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openjdk | Oracle | 1.6.0 (including) | 1.6.0 (including) |
| Openjdk | Oracle | 1.7.0 (including) | 1.7.0 (including) |
| Openjdk | Oracle | 1.8.0 (including) | 1.8.0 (including) |
| Oracle Java for Red Hat Enterprise Linux 5 | RedHat | java-1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 | * |
| Oracle Java for Red Hat Enterprise Linux 5 | RedHat | java-1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10 | * |
| Oracle Java for Red Hat Enterprise Linux 6 | RedHat | java-1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 | * |
| Oracle Java for Red Hat Enterprise Linux 6 | RedHat | java-1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5 | * |
| Red Hat Enterprise Linux 5 | RedHat | java-1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el5_10 | * |
| Red Hat Enterprise Linux 5 | RedHat | java-1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el5_10 | * |
| Red Hat Enterprise Linux 6 | RedHat | java-1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el6_5 | * |
| Red Hat Enterprise Linux 6 | RedHat | java-1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el6_5 | * |
| Red Hat Enterprise Linux 7 | RedHat | java-1.7.0-openjdk-1:1.7.0.55-2.4.7.2.el7_0 | * |
| Red Hat Enterprise Linux 7 | RedHat | java-1.6.0-openjdk-1:1.6.0.0-6.1.13.3.el7_0 | * |
| Red Hat Network Satellite Server v 5.4 | RedHat | java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6 | * |
| Red Hat Network Satellite Server v 5.5 | RedHat | java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6 | * |
| Red Hat Satellite 5.6 | RedHat | java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el5_10 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5_10 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el5_10 | * |
| Supplementary for Red Hat Enterprise Linux 6 | RedHat | java-1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 | * |
| Supplementary for Red Hat Enterprise Linux 6 | RedHat | java-1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el6_5 | * |
| Supplementary for Red Hat Enterprise Linux 6 | RedHat | java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6_5 | * |
| Supplementary for Red Hat Enterprise Linux 6 | RedHat | java-1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el6_5 | * |
| Supplementary for Red Hat Enterprise Linux 7 | RedHat | java-1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0 | * |
| Openjdk-6 | Ubuntu | lucid | * |
| Openjdk-6 | Ubuntu | precise | * |
| Openjdk-6 | Ubuntu | quantal | * |
| Openjdk-6 | Ubuntu | saucy | * |
| Openjdk-7 | Ubuntu | devel | * |
| Openjdk-7 | Ubuntu | precise | * |
| Openjdk-7 | Ubuntu | quantal | * |
| Openjdk-7 | Ubuntu | saucy | * |
| Openjdk-7 | Ubuntu | trusty | * |