Ubuntu 12.04 LTS USN-1553-1 Critical: OpenJDK 6 Sandbox Bypass

ubuntu

September 3, 2012

Two security issues were fixed in OpenJDK 6.

Summary

Two security issues were fixed in OpenJDK 6.

Software Description:

- openjdk-6: Open Source Java implementation

Details:

It was discovered that the Beans component in OpenJDK 6 did not

properly prevent access to restricted classes. A remote attacker could

use this to create an untrusted Java applet or application that would

bypass Java sandbox restrictions. (CVE-2012-1682)

It was discovered that functionality in the AWT component in OpenJDK 6

made it easier for a remote attacker, in conjunction with other

vulnerabilities, to bypass Java sandbox restrictions. (CVE-2012-0547)

Topics Covered

security advisory security issue critical remote access Ubuntu OpenJDK Java sandbox

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  icedtea-6-jre-cacao             6b24-1.11.4-1ubuntu0.12.04.1
  icedtea-6-jre-jamvm             6b24-1.11.4-1ubuntu0.12.04.1
  openjdk-6-jre                   6b24-1.11.4-1ubuntu0.12.04.1
  openjdk-6-jre-headless          6b24-1.11.4-1ubuntu0.12.04.1
  openjdk-6-jre-lib               6b24-1.11.4-1ubuntu0.12.04.1
  openjdk-6-jre-zero              6b24-1.11.4-1ubuntu0.12.04.1

Ubuntu 11.10:
  icedtea-6-jre-cacao             6b24-1.11.4-1ubuntu0.11.10.1
  icedtea-6-jre-jamvm             6b24-1.11.4-1ubuntu0.11.10.1
  openjdk-6-jre                   6b24-1.11.4-1ubuntu0.11.10.1
  openjdk-6-jre-headless          6b24-1.11.4-1ubuntu0.11.10.1
  openjdk-6-jre-lib               6b24-1.11.4-1ubuntu0.11.10.1
  openjdk-6-jre-zero              6b24-1.11.4-1ubuntu0.11.10.1

Ubuntu 11.04:
  icedtea-6-jre-cacao             6b24-1.11.4-1ubuntu0.11.04.1
  icedtea-6-jre-jamvm             6b24-1.11.4-1ubuntu0.11.04.1
  openjdk-6-jre                   6b24-1.11.4-1ubuntu0.11.04.1
  openjdk-6-jre-headless          6b24-1.11.4-1ubuntu0.11.04.1
  openjdk-6-jre-lib               6b24-1.11.4-1ubuntu0.11.04.1
  openjdk-6-jre-zero              6b24-1.11.4-1ubuntu0.11.04.1

Ubuntu 10.04 LTS:
  icedtea-6-jre-cacao             6b24-1.11.4-1ubuntu0.10.04.1
  openjdk-6-jre                   6b24-1.11.4-1ubuntu0.10.04.1
  openjdk-6-jre-headless          6b24-1.11.4-1ubuntu0.10.04.1
  openjdk-6-jre-lib               6b24-1.11.4-1ubuntu0.10.04.1
  openjdk-6-jre-zero              6b24-1.11.4-1ubuntu0.10.04.1

After a standard system update you need to restart any Java applets
or applications to make all the necessary changes.