VMware has released updates and patches for several of its products in order to resolve vulnerabilities affecting the Java SE Runtime Environment (JRE).
According to VMware, the updates address several Java vulnerabilities, including a critical information disclosure issue (CVE-2014-6593) impacting Java SE 5u75, 6u85, 7u72, and 8u25. The Java flaws were addressed by Oracle with the January 2015 Critical Patch Update, which contains nearly 170 new security fixes.
The list of VMware products that use vulnerable versions of Java includes Horizon View, Horizon Workspace Portal Server, vCenter Operations Manager, vCloud Automation Center, Sphere Replication, vRealize Automation, vRealize Code Stream, vRealize Hyperic, vSphere AppHA, vRealize Business Standard, NSX for Multi-Hypervisor, vRealize Configuration Manager, and vRealize Infrastructure.
vCenter Site Recovery Manager does not include Java directly, but it does include the vSphere Replication appliance which uses Java.
The security holes have been addressed in VMware products by updating Java to versions 7u75 and 6u91, VMware said in an advisory.
Patches are currently available for Horizon View, Horizon Workspace Portal Server, vCenter Operations Manager, vRealize Code Stream, vRealize Automation, vCloud Automation Center, vCloud Application Director 5.2, vSphere AppHA, vRealize Hyperic, vRealize Business Standard, vCloud Director, NSX for Multi-Hypervisor, vRealize Configuration Manager, and vCenter Infrastructure Navigator.
Patches for the other products are pending. However, VMware has pointed out that in the case of applications that are not exposed to the Internet the severity of the critical information disclosure vulnerability has been lowered to “important.”
Users are advised to apply available patches as soon as possible. VMware’s advisory will be updated when other patches become available.
This is the third series of security updates released by VMware this year. In January, the company addressed vulnerabilities in vSphere, vCenter Server, ESXi, Workstation, Player, and Fusion.