Ubuntu
sun-java6 package

Bug #659937
Comment #3

Comment 3 for bug 659937

Revision history for this message

Mark Foster (fostermarkd) wrote on 2010-10-15:

(Adding advisory information from @RISK: The Consensus Security Vulnerability Alert Vol. 9 No. 42)
(2) HIGH: Oracle Java Multiple Vulnerabilities
Affected:
JDK and JRE 6 Update 21 and earlier for Windows, Solaris, and Linux Java SE
JDK 5.0 Update 25 and earlier for Solaris Java SE
SDK 1.4.2_27 and earlier for Solaris Java SE
JDK and JRE 6 Update 21 and earlier for Windows, Solaris and Linux Java for Business
JDK and JRE 5.0 Update 25 and earlier for Windows, Solaris and Linux Java for Business
SDK and JRE 1.4.2_27 and earlier for Windows, Solaris and Linux Java for Business

Description: Oracle has recently released a critical update addressing
multiple security vulnerabilities. According to Oracle, the patch
addresses 29 vulnerabilities, 28 of which could lead to code execution.
Some of these vulnerabilities exist because of flaws in the low-level
implementation of the Java Runtime Environment (JRE). Although Java is
intended to be type safe, low-level code sometimes writes user-defined
strings to C buffers, giving an attacker the opportunity to overwrite
return addresses and execute code. Vulnerabilities like these allow Java
applets, which start without user interaction when a target navigates
to a malicious site, to execute with the permissions of the Java process
running them. Normally applets run with restricted privileges.

Status: vendor confirmed, updates available

Status: vendor confirmed, updates available

Ubuntusun-java6 package

Comment 3 for bug 659937

Ubuntu
sun-java6 package