Security vulnerabilities in sun-java6-*

[Mika Wahlroos]

Binary package hint: sun-java6-jre

Sun Java 6 update 6 (both JRE and JDK, included in multiverse for Ubuntu 8.04 / Hardy Heron) has several known security vulnerabilities, including a vulnerability that may allow applets to remotely read sensitive data if a user enters a malicious web page, considered highly critical by Secunia [1].

Java 6 update 7 from Sun contains fixes for these vulnerabilities [2].

I know that these packages are non-free and not officially supported, but if it's possible for the sun-java6-* package maintainers to prepare and upload an updated package, that would be great since it would greatly improve the security of these packages. They are, although in multiverse, commonly installed on Ubuntu systems. Even a backport would be better than nothing -- update 7 already seems to be in intrepid.

[1] http://secunia.com/advisories/31010
[2] http://java.sun.com/javase/6/webnotes/ReleaseNotes.html#160_07

[Mika Wahlroos (mpw)]

Making public since the vulnerabilities have been public at least since the new upstream version anyway.

[Matthias Klose (doko)]

fixed in intrepid

[Mika Wahlroos (mpw)]

Fixed in hardy-updates (see #254997). Older releases (gutsy, feisty) are probably still affected, and their sun-java6 versions are a lot older anyway. I don't suppose those are going to get SRUs for Java anymore?

I'm marking this as "fix released" for hardy. I added nominations for the older releases just so that we can keep track of where the vulnerabilities still exist.

[Matthias Klose (doko)]

Mika Wahlroos schrieb:
> I'm marking this as "fix released" for hardy. I added nominations for
> the older releases just so that we can keep track of where the
> vulnerabilities still exist.

sure, please prepare an update (based on the package for hardy).

[Mika Wahlroos (mpw)]

I don't currently have any feisty or gutsy systems installed. The nomination of the bug for those releases is based on the (upstream) version numbers of the packages available for them which suggest that the packages are vulnerable.

If I have time to install feisty and gutsy build/test environments, I'll try building a package. I wouldn't count on having the time soon, though. Feisty is nearing end-of-life anyway, but gutsy users might still benefit.