====================================================================                   Red Hat Security Advisory

Synopsis:          Low: eclipse security, bug fix, and enhancement update
Advisory ID:       RHSA-2011:0568-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2011:0568.html
Issue date:        2011-05-19
CVE Names:         CVE-2010-4647 
====================================================================
1. Summary:

Updated eclipse packages that fix one security issue, several bugs, and add
various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64

3. Description:

The Eclipse software development environment provides a set of tools for
C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents
web application. An attacker could use this flaw to perform a cross-site
scripting attack against victims by tricking them into visiting a
specially-crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in
the official upstream Eclipse Helios SR1 release, providing a number of
bug fixes and enhancements over the previous versions:

* eclipse to 3.6.1. (BZ#656329)
* eclipse-cdt to 7.0.1. (BZ#656333)
* eclipse-birt to 2.6.0. (BZ#656391)
* eclipse-emf to 2.6.0. (BZ#656344)
* eclipse-gef to 3.6.1. (BZ#656347)
* eclipse-mylyn to 3.4.2. (BZ#656337)
* eclipse-rse to 3.2. (BZ#656338)
* eclipse-dtp to 1.8.1. (BZ#656397)
* eclipse-changelog to 2.7.0. (BZ#669499)
* eclipse-valgrind to 0.6.1. (BZ#669460)
* eclipse-callgraph to 0.6.1. (BZ#669462)
* eclipse-oprofile to 0.6.1. (BZ#670228)
* eclipse-linuxprofilingframework to 0.6.1. (BZ#669461)

In addition, the following updates were made to the dependencies of the
Eclipse packages above:

* icu4j to 4.2.1. (BZ#656342)
* sat4j to 2.2.0. (BZ#661842)
* objectweb-asm to 3.2. (BZ#664019)
* jetty-eclipse to 6.1.24. (BZ#661845)

This update includes numerous upstream bug fixes and enhancements, such as:

* The Eclipse IDE and Java Development Tools (JDT):

- - projects and folders can filter out resources in the workspace.
- - new virtual folder and linked files support.
- - the full set of UNIX file permissions is now supported.
- - addition of the stop button to cancel long-running wizard tasks.
- - Java editor now shows multiple quick-fixes via problem hover.
- - new support for running JUnit version 4 tests.
- - over 200 upstream bug fixes.

* The Eclipse C/C++ Development Tooling (CDT):

- - new Codan framework has been added for static code analysis.
- - refactoring improvements such as stored refactoring history.
- - compile and build errors now highlighted in the build console.
- - switch to the new DSF debugger framework.
- - new template view support.
- - over 600 upstream bug fixes.

This update also fixes the following bugs:

* Incorrect URIs for GNU Tools in the "Help Contents" window have been
fixed. (BZ#622713)

* The profiling of binaries did not work if an Eclipse project was not in
an Eclipse workspace. This update adds an automated test for external
project profiling, which corrects this issue. (BZ#622867)

* Running a C/C++ application in Eclipse successfully terminated, but
returned an I/O exception not related to the application itself in the
Error Log window. With this update, the exception is no longer returned.
(BZ#668890)

* The eclipse-mylyn package showed a "20100916-0100-e3x" qualifier. The
qualifier has been modified to "v20100902-0100-e3x" to match the upstream
version of eclipse-mylyn. (BZ#669819)

* Installing the eclipse-mylyn package failed and returned a "Resource
temporarily unavailable" error message due to a bug in the packaging. This
update fixes this bug and installation now works as expected. (BZ#673174)

* Building the eclipse-cdt package could fail due to an incorrect
interaction with the local file system. Interaction with the local file
system is now prevented and the build no longer fails. (BZ#678364)

* The libhover plug-in, provided by the eclipse-cdt package, used binary
data to search for hover topics. The data location was specified externally
as a URL which could cause an exception to occur on a system with no
Internet access. This update modifies the plug-in so that it pulls the
needed data from a local location. (BZ#679543)

Users of eclipse should upgrade to these updated packages, which correct
these issues and add these enhancements.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

622713 - Help Contents: Wrong URIs to GNU Tools
622867 - Profiling of binaries does not work if Eclipse project is NOT in Eclipse workspace
656329 - [eclipse] Re-base to Helios SR1
656333 - [eclipse-cdt] Re-base to Helios SR1(7.0.1)
656337 - [eclipse-mylyn] Re-base to Helios SR1(3.4.0)
656338 - [eclipse-rse] Re-base to Helios SR1(3.2.0)
656342 - Re-base icu4j to 4.2.1
656344 - [eclipse-emf] Re-base to Helios SR1(2.6.0)
656347 - [eclipse-gef] Re-base to Helios SR1(3.6.0)
656391 - Re-base eclipse-birt to Helios SR1(2.6.0)
656397 - [eclipse-dtp] Re-base to Helios SR1(1.8.0)
661842 - Re-base to sat4j 2.2.0
661845 - Re-base to jetty-eclipse 6.1.24
661901 - CVE-2010-4647 eclipse: Help Content web application vulnerable to multiple XSS
664019 - Re-base to objectweb-asm 3.2
668890 - Debug core logs spawner IO exception when running C/C++ executable
669460 - [eclipse-valgrind] Update to work with updated eclipse-birt
669461 - [eclipse-linuxprofilingframework] new version to allow updated eclipse-valgrind
669462 - [eclipse-callgraph] Updates to callgraph to work with newer GEF
669499 - [eclipse-changelog] Update eclipse-changelog plug-in
669819 - Update eclipse-mylyn qualifier to 20100916-0100-e3x
670228 - [eclipse-oprofile] Re-base to upstream 0.6.1 release
673174 - error: unpacking of archive failed: cpio: lstat failed - Resource temporarily unavailable
678364 - eclipse-cdt build touching local filesystem

6. Package List:

Red Hat Enterprise Linux Server (v. 6):

Source:

i386:
eclipse-birt-2.6.0-1.1.el6.i686.rpm
eclipse-callgraph-0.6.1-1.el6.i686.rpm
eclipse-cdt-7.0.1-4.el6.i686.rpm
eclipse-changelog-2.7.0-1.el6.i686.rpm
eclipse-debuginfo-3.6.1-6.13.el6.i686.rpm
eclipse-dtp-1.8.1-1.1.el6.i686.rpm
eclipse-emf-2.6.0-1.el6.i686.rpm
eclipse-gef-3.6.1-3.el6.i686.rpm
eclipse-jdt-3.6.1-6.13.el6.i686.rpm
eclipse-linuxprofilingframework-0.6.1-1.el6.i686.rpm
eclipse-mylyn-3.4.2-9.el6.i686.rpm
eclipse-mylyn-cdt-3.4.2-9.el6.i686.rpm
eclipse-mylyn-java-3.4.2-9.el6.i686.rpm
eclipse-mylyn-pde-3.4.2-9.el6.i686.rpm
eclipse-mylyn-trac-3.4.2-9.el6.i686.rpm
eclipse-mylyn-webtasks-3.4.2-9.el6.i686.rpm
eclipse-mylyn-wikitext-3.4.2-9.el6.i686.rpm
eclipse-oprofile-0.6.1-1.el6.i686.rpm
eclipse-oprofile-debuginfo-0.6.1-1.el6.i686.rpm
eclipse-pde-3.6.1-6.13.el6.i686.rpm
eclipse-platform-3.6.1-6.13.el6.i686.rpm
eclipse-rcp-3.6.1-6.13.el6.i686.rpm
eclipse-rse-3.2-1.el6.i686.rpm
eclipse-swt-3.6.1-6.13.el6.i686.rpm
eclipse-valgrind-0.6.1-1.el6.i686.rpm
icu4j-eclipse-4.2.1-5.el6.i686.rpm

noarch:
jetty-eclipse-6.1.24-2.el6.noarch.rpm
objectweb-asm-3.2-2.1.el6.noarch.rpm
sat4j-2.2.0-4.0.el6.noarch.rpm

x86_64:
eclipse-birt-2.6.0-1.1.el6.x86_64.rpm
eclipse-callgraph-0.6.1-1.el6.x86_64.rpm
eclipse-cdt-7.0.1-4.el6.x86_64.rpm
eclipse-changelog-2.7.0-1.el6.x86_64.rpm
eclipse-debuginfo-3.6.1-6.13.el6.x86_64.rpm
eclipse-dtp-1.8.1-1.1.el6.x86_64.rpm
eclipse-emf-2.6.0-1.el6.x86_64.rpm
eclipse-gef-3.6.1-3.el6.x86_64.rpm
eclipse-jdt-3.6.1-6.13.el6.x86_64.rpm
eclipse-linuxprofilingframework-0.6.1-1.el6.x86_64.rpm
eclipse-mylyn-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-cdt-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-java-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-pde-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-trac-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-webtasks-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-wikitext-3.4.2-9.el6.x86_64.rpm
eclipse-oprofile-0.6.1-1.el6.x86_64.rpm
eclipse-oprofile-debuginfo-0.6.1-1.el6.x86_64.rpm
eclipse-pde-3.6.1-6.13.el6.x86_64.rpm
eclipse-platform-3.6.1-6.13.el6.x86_64.rpm
eclipse-rcp-3.6.1-6.13.el6.x86_64.rpm
eclipse-rse-3.2-1.el6.x86_64.rpm
eclipse-swt-3.6.1-6.13.el6.x86_64.rpm
eclipse-valgrind-0.6.1-1.el6.x86_64.rpm
icu4j-eclipse-4.2.1-5.el6.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:

i386:
eclipse-cdt-parsers-7.0.1-4.el6.i686.rpm
eclipse-cdt-sdk-7.0.1-4.el6.i686.rpm
eclipse-emf-examples-2.6.0-1.el6.i686.rpm
eclipse-emf-sdk-2.6.0-1.el6.i686.rpm
eclipse-emf-xsd-2.6.0-1.el6.i686.rpm
eclipse-emf-xsd-sdk-2.6.0-1.el6.i686.rpm
eclipse-gef-examples-3.6.1-3.el6.i686.rpm
eclipse-gef-sdk-3.6.1-3.el6.i686.rpm
icu4j-4.2.1-5.el6.i686.rpm
icu4j-javadoc-4.2.1-5.el6.i686.rpm

noarch:
objectweb-asm-javadoc-3.2-2.1.el6.noarch.rpm

x86_64:
eclipse-cdt-parsers-7.0.1-4.el6.x86_64.rpm
eclipse-cdt-sdk-7.0.1-4.el6.x86_64.rpm
eclipse-emf-examples-2.6.0-1.el6.x86_64.rpm
eclipse-emf-sdk-2.6.0-1.el6.x86_64.rpm
eclipse-emf-xsd-2.6.0-1.el6.x86_64.rpm
eclipse-emf-xsd-sdk-2.6.0-1.el6.x86_64.rpm
eclipse-gef-examples-3.6.1-3.el6.x86_64.rpm
eclipse-gef-sdk-3.6.1-3.el6.x86_64.rpm
icu4j-4.2.1-5.el6.x86_64.rpm
icu4j-javadoc-4.2.1-5.el6.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:

i386:
eclipse-birt-2.6.0-1.1.el6.i686.rpm
eclipse-callgraph-0.6.1-1.el6.i686.rpm
eclipse-cdt-7.0.1-4.el6.i686.rpm
eclipse-changelog-2.7.0-1.el6.i686.rpm
eclipse-debuginfo-3.6.1-6.13.el6.i686.rpm
eclipse-dtp-1.8.1-1.1.el6.i686.rpm
eclipse-emf-2.6.0-1.el6.i686.rpm
eclipse-gef-3.6.1-3.el6.i686.rpm
eclipse-jdt-3.6.1-6.13.el6.i686.rpm
eclipse-linuxprofilingframework-0.6.1-1.el6.i686.rpm
eclipse-mylyn-3.4.2-9.el6.i686.rpm
eclipse-mylyn-cdt-3.4.2-9.el6.i686.rpm
eclipse-mylyn-java-3.4.2-9.el6.i686.rpm
eclipse-mylyn-pde-3.4.2-9.el6.i686.rpm
eclipse-mylyn-trac-3.4.2-9.el6.i686.rpm
eclipse-mylyn-webtasks-3.4.2-9.el6.i686.rpm
eclipse-mylyn-wikitext-3.4.2-9.el6.i686.rpm
eclipse-oprofile-0.6.1-1.el6.i686.rpm
eclipse-oprofile-debuginfo-0.6.1-1.el6.i686.rpm
eclipse-pde-3.6.1-6.13.el6.i686.rpm
eclipse-platform-3.6.1-6.13.el6.i686.rpm
eclipse-rcp-3.6.1-6.13.el6.i686.rpm
eclipse-rse-3.2-1.el6.i686.rpm
eclipse-swt-3.6.1-6.13.el6.i686.rpm
eclipse-valgrind-0.6.1-1.el6.i686.rpm
icu4j-eclipse-4.2.1-5.el6.i686.rpm

noarch:
jetty-eclipse-6.1.24-2.el6.noarch.rpm
objectweb-asm-3.2-2.1.el6.noarch.rpm
sat4j-2.2.0-4.0.el6.noarch.rpm

x86_64:
eclipse-birt-2.6.0-1.1.el6.x86_64.rpm
eclipse-callgraph-0.6.1-1.el6.x86_64.rpm
eclipse-cdt-7.0.1-4.el6.x86_64.rpm
eclipse-changelog-2.7.0-1.el6.x86_64.rpm
eclipse-debuginfo-3.6.1-6.13.el6.x86_64.rpm
eclipse-dtp-1.8.1-1.1.el6.x86_64.rpm
eclipse-emf-2.6.0-1.el6.x86_64.rpm
eclipse-gef-3.6.1-3.el6.x86_64.rpm
eclipse-jdt-3.6.1-6.13.el6.x86_64.rpm
eclipse-linuxprofilingframework-0.6.1-1.el6.x86_64.rpm
eclipse-mylyn-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-cdt-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-java-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-pde-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-trac-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-webtasks-3.4.2-9.el6.x86_64.rpm
eclipse-mylyn-wikitext-3.4.2-9.el6.x86_64.rpm
eclipse-oprofile-0.6.1-1.el6.x86_64.rpm
eclipse-oprofile-debuginfo-0.6.1-1.el6.x86_64.rpm
eclipse-pde-3.6.1-6.13.el6.x86_64.rpm
eclipse-platform-3.6.1-6.13.el6.x86_64.rpm
eclipse-rcp-3.6.1-6.13.el6.x86_64.rpm
eclipse-rse-3.2-1.el6.x86_64.rpm
eclipse-swt-3.6.1-6.13.el6.x86_64.rpm
eclipse-valgrind-0.6.1-1.el6.x86_64.rpm
icu4j-eclipse-4.2.1-5.el6.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:

i386:
eclipse-cdt-parsers-7.0.1-4.el6.i686.rpm
eclipse-cdt-sdk-7.0.1-4.el6.i686.rpm
eclipse-emf-examples-2.6.0-1.el6.i686.rpm
eclipse-emf-sdk-2.6.0-1.el6.i686.rpm
eclipse-emf-xsd-2.6.0-1.el6.i686.rpm
eclipse-emf-xsd-sdk-2.6.0-1.el6.i686.rpm
eclipse-gef-examples-3.6.1-3.el6.i686.rpm
eclipse-gef-sdk-3.6.1-3.el6.i686.rpm
icu4j-4.2.1-5.el6.i686.rpm
icu4j-javadoc-4.2.1-5.el6.i686.rpm

noarch:
objectweb-asm-javadoc-3.2-2.1.el6.noarch.rpm

x86_64:
eclipse-cdt-parsers-7.0.1-4.el6.x86_64.rpm
eclipse-cdt-sdk-7.0.1-4.el6.x86_64.rpm
eclipse-emf-examples-2.6.0-1.el6.x86_64.rpm
eclipse-emf-sdk-2.6.0-1.el6.x86_64.rpm
eclipse-emf-xsd-2.6.0-1.el6.x86_64.rpm
eclipse-emf-xsd-sdk-2.6.0-1.el6.x86_64.rpm
eclipse-gef-examples-3.6.1-3.el6.x86_64.rpm
eclipse-gef-sdk-3.6.1-3.el6.x86_64.rpm
icu4j-4.2.1-5.el6.x86_64.rpm
icu4j-javadoc-4.2.1-5.el6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2010-4647.html
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.