Ubuntu 12.04 LTS: USN-1505-1 Critical: OpenJDK 6 Java Issues Advisory

ubuntu

July 13, 2012

Several security issues were fixed in OpenJDK 6.

Summary

Several security issues were fixed in OpenJDK 6.

Software Description:

- openjdk-6: Open Source Java implementation

- icedtea-web: A web browser plugin to execute Java applets

Details:

It was discovered that multiple flaws existed in the CORBA (Common

Object Request Broker Architecture) implementation in OpenJDK. An

attacker could create a Java application or applet that used these

flaws to bypass Java sandbox restrictions or modify immutable object

data. (CVE-2012-1711, CVE-2012-1719)

It was discovered that multiple flaws existed in the OpenJDK font

manager's layout lookup implementation. A attacker could specially

craft a font file that could cause a denial of service through

crashing the JVM (Java Virtual Machine) or possibly execute arbitrary

code. (CVE-2012-1713)

It was discovered that the SynthLookAndFeel class from Swing in

OpenJDK did not properly prevent access to certain UI elements

from outside the current application context. An attacker could

...

Read the Full Advisory

Topics Covered

security advisory denial of service critical ubuntu openjdk java issues icedtea-web

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  openjdk-6-jre                   6b24-1.11.3-1ubuntu0.12.04.1

Ubuntu 11.10:
  icedtea-6-plugin                1.2-2ubuntu0.11.10.1
  openjdk-6-jre                   6b24-1.11.3-1ubuntu0.11.10.1

Ubuntu 11.04:
  icedtea-6-plugin                1.2-2ubuntu0.11.04.1
  openjdk-6-jre                   6b24-1.11.3-1ubuntu0.11.04.1

Ubuntu 10.04 LTS:
  icedtea-6-plugin                1.2-2ubuntu0.10.04.1
  openjdk-6-jre                   6b24-1.11.3-1ubuntu0.10.04.1

This update uses a new upstream release, which includes additional
bug fixes. After a standard system update you need to restart any
Java applications or applets to make all the necessary changes.