98 lines
3.7 KiB
XML
98 lines
3.7 KiB
XML
|
<?xml version="1.0" encoding="utf-8"?>
|
||
|
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||
|
|
|
||
|
|
<glsa id="200701-15">
|
||
|
|
<title>Sun JDK/JRE: Multiple vulnerabilities</title>
|
||
|
|
<synopsis>
|
||
|
|
Multiple unspecified vulnerabilities have been identified in Sun Java
|
||
|
|
Development Kit (JDK) and Java Runtime Environment (JRE).
|
||
|
|
</synopsis>
|
||
|
|
<product type="ebuild">java</product>
|
||
|
|
<announced>January 22, 2007</announced>
|
||
|
|
<revised>July 16, 2008: 04</revised>
|
||
|
|
<bug>158659</bug>
|
||
|
|
<access>remote</access>
|
||
|
|
<affected>
|
||
|
|
<package name="dev-java/sun-jdk" auto="yes" arch="*">
|
||
|
|
<unaffected range="ge">1.5.0.09</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.18</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.17</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.15</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.14</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.13</unaffected>
|
||
|
|
<vulnerable range="lt">1.5.0.09</vulnerable>
|
||
|
|
</package>
|
||
|
|
<package name="dev-java/sun-jre-bin" auto="yes" arch="*">
|
||
|
|
<unaffected range="ge">1.5.0.09</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.18</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.17</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.15</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.14</unaffected>
|
||
|
|
<unaffected range="rge">1.4.2.13</unaffected>
|
||
|
|
<vulnerable range="lt">1.5.0.09</vulnerable>
|
||
|
|
</package>
|
||
|
|
</affected>
|
||
|
|
<background>
|
||
|
|
<p>
|
||
|
|
The Sun Java Development Kit (JDK) and the Sun Java Runtime Environment
|
||
|
|
(JRE) provide the Sun Java platform.
|
||
|
|
</p>
|
||
|
|
</background>
|
||
|
|
<description>
|
||
|
|
<p>
|
||
|
|
Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun
|
||
|
|
JRE possibly related to various AWT or font layout functions. Tom
|
||
|
|
Hawtin has discovered an unspecified vulnerability in Sun JDK and Sun
|
||
|
|
JRE relating to unintended applet data access. He has also discovered
|
||
|
|
multiple other unspecified vulnerabilities in Sun JDK and Sun JRE
|
||
|
|
allowing unintended Java applet or application resource acquisition.
|
||
|
|
</p>
|
||
|
|
</description>
|
||
|
|
<impact type="normal">
|
||
|
|
<p>
|
||
|
|
An attacker could entice a user to run a specially crafted Java applet
|
||
|
|
or application that could read, write, or execute local files with the
|
||
|
|
privileges of the user running the JVM; access data maintained in other
|
||
|
|
Java applets; or escalate the privileges of the currently running Java
|
||
|
|
applet or application allowing for unauthorized access to system
|
||
|
|
resources.
|
||
|
|
</p>
|
||
|
|
</impact>
|
||
|
|
<workaround>
|
||
|
|
<p>
|
||
|
|
There is no known workaround at this time.
|
||
|
|
</p>
|
||
|
|
</workaround>
|
||
|
|
<resolution>
|
||
|
|
<p>
|
||
|
|
All Sun Java Development Kit users should upgrade to the latest
|
||
|
|
version:
|
||
|
|
</p>
|
||
|
|
<code>
|
||
|
|
# emerge --sync
|
||
|
|
# emerge --ask --oneshot --verbose "dev-java/sun-jdk"</code>
|
||
|
|
<p>
|
||
|
|
All Sun Java Runtime Environment users should upgrade to the latest
|
||
|
|
version:
|
||
|
|
</p>
|
||
|
|
<code>
|
||
|
|
# emerge --sync
|
||
|
|
# emerge --ask --oneshot --verbose "dev-java/sun-jre-bin"</code>
|
||
|
|
</resolution>
|
||
|
|
<references>
|
||
|
|
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6731">CVE-2006-6731</uri>
|
||
|
|
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6736">CVE-2006-6736</uri>
|
||
|
|
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6737">CVE-2006-6737</uri>
|
||
|
|
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6745">CVE-2006-6745</uri>
|
||
|
|
</references>
|
||
|
|
<metadata tag="requester" timestamp="Fri, 12 Jan 2007 22:36:56 +0000">
|
||
|
|
falco
|
||
|
|
</metadata>
|
||
|
|
<metadata tag="bugReady" timestamp="Sun, 14 Jan 2007 21:54:21 +0000">
|
||
|
|
falco
|
||
|
|
</metadata>
|
||
|
|
<metadata tag="submitter" timestamp="Mon, 15 Jan 2007 01:12:01 +0000">
|
||
|
|
shellsage
|
||
|
|
</metadata>
|
||
|
|
</glsa>
|