Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
91
security advisorygentoobuffer overflowGentoo: 200701-15 Normal: Sun JDK and JRE Buffer Overflow Risk
Multiple unspecified vulnerabilities have been identified in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE).. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200701-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Sun JDK/JRE: Multiple vulnerabilities Date: January 22, 2007 Bugs: #158659 ID: 200701-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple unspecified vulnerabilities have been identified in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE). Background ========= The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment (JRE) provide the Sun Java platform. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/sun-jdk < 1.4.2.13 > = 1.4.2.13 > = 1.5.0.09 dev-java/sun-jdk < 1.5.0.09 > = 1.4.2.13 > = 1.5.0.09 2 dev-java/sun-jre-bin < 1.4.2.13 > = 1.4.2.13 > = 1.5.0.09 dev-java/sun-jre-bin < 1.5.0.09 > = 1.4.2.13 > = 1.5.0.09 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun JRE possibly related to various AWT or font layout functions. Tom Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun JRE relating to unintended applet data access. He has also discovered multiple other unspecified vulnerabilities in Sun JDK and Sun JRE allowing unintended Java applet or application resource acquisition. Impact ===== An attacker could entice a user to run a specially crafted Java applet or application that could read, write, or execute local files with the privileges of the user running the JVM; access data maintained in other Java applets; or escalate the privileges of the currently running Java applet or application allowing for unauthorized access to system resources. Workaround ========= There is no known workaround at this time. Resolution ========= All Sun Java Development Kit users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "dev-java/sun-jdk" All Sun Java Runtime Environment users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "dev-java/sun-jre-bin" References ========= [ 1 ] CVE-2006-6731 https://www.cve.org/CVERecord?id=CVE-2006-6731 [ 2 ] CVE-2006-6736 https://www.cve.org/CVERecord?id=CVE-2006-6736 [ 3 ] CVE-2006-6737 https://www.cve.org/CVERecord?id=CVE-2006-6737 [ 4 ] CVE-2006-6745 https://www.cve.org/CVERecord?id=CVE-2006-6745 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200701-15 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jan 23, 2007
Gentoo
91
security advisorygentooarbitrary code executionGentoo: GLSA-200602-07 Normal: Sun JDK/JRE Applet Escalation Threat
Sun's Java Development Kit (JDK) and Java Runtime Environment (JRE) do not adequately constrain applets from privilege escalation and arbitrary code execution. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200602-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Sun JDK/JRE: Applet privilege escalation Date: February 15, 2006 Bugs: #122156 ID: 200602-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Sun's Java Development Kit (JDK) and Java Runtime Environment (JRE) do not adequately constrain applets from privilege escalation and arbitrary code execution. Background ========= Sun's JDK and JRE provide interpreters for Java Applets in a sandboxed environment. These implementations provide the Java Web Start technology that can be used for easy client-side deployment of Java applications. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/sun-jdk < 1.4.2.10 > = 1.4.2.10 2 dev-java/sun-jre-bin < 1.4.2.10 > = 1.4.2.10 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Applets executed using JRE or JDK can use "reflection" APIs functions to elevate its privileges beyond the sandbox restrictions. Adam Gowdiak discovered five vulnerabilities that use this method for privilege escalation. Two more vulnerabilities werediscovered by the vendor. Peter Csepely discovered that Web Start Java applications also can an escalate their privileges. Impact ===== A malicious Java applet can bypass Java sandbox restrictions and hence access local files, connect to arbitrary network locations and execute arbitrary code on the user's machine. Java Web Start applications are affected likewise. Workaround ========= Select another Java implementation using java-config. Resolution ========= All Sun JDK users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-java/sun-jdk-1.4.2.10" All Sun JRE users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-java/sun-jre-bin-1.4.2.10" References ========= [ 1 ] Sun Security Alert ID 102170 [ 2 ] Sun Security Alert ID 102171 [ 3 ] CVE-2006-0614 [ 4 ] CVE-2006-0615 [ 5 ] CVE-2006-0616 [ 6 ] CVE-2006-0617 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200602-07 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Feb 15, 2006
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!