Remotely DoSing JBoss 4.0.2 with serialized java objects

=+============================================================= Remotely DoSing JBoss 4.0.2 with serialized java objects Implications of serialisation vulnerabilies in JDK =+============================================================= Author: Marc Schoenefeld , illegalaccess.org...

Solaris 8 (x86) : 118669-86

JavaSE 5.0x86: update 85 patch equivalent to JDK 5.0u85, 64bit. Date this patch was last updated by Sun : Apr/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 8 (sparc) : 118667-86

JavaSE 5.0: update 85 patch equivalent to JDK 5.0u85, 64bit. Date this patch was last updated by Sun : Apr/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 8 (x86) : 118668-86

JavaSE 5.0x86: update 85 patch equivalent to JDK 5.0u85. Date this patch was last updated by Sun : Apr/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 8 (sparc) : 118666-86

JavaSE 5.0: update 85 patch equivalent to JDK 5.0u85. Date this patch was last updated by Sun : Apr/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

FreeBSD : opera -- multiple vulnerabilities in Java implementation (1489df94-6bcb-11d9-a21e-000a95bc6fae)

Marc Schoenefeld reports : Opera 7.54 is vulnerable to leakage of the java sandbox, allowing malicious applets to gain unacceptable privileges. This allows them to be used for information gathering spying of local identity information and system configurations as well as causing annoying crash...

FreeBSD : jdk -- jar directory traversal vulnerability (18e5428f-ae7c-11d9-837d-000e0c2e438a)

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string '../' on its names, so it's possible for an attacker to create a malicio...

[Full-disclosure] [ GLSA 200506-14 ] Sun and Blackdown Java: Applet privilege escalation

Gentoo Linux Security Advisory GLSA 200506-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

[SA14902] Sun Java JDK/SDK Jar Directory Traversal Vulnerability

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Sun Java JDK/SDK Jar Directory Traversal Vulnerability...

jdk -- jar directory traversal vulnerability

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicio...

Sun Java: Web Start argument injection vulnerability

Background Sun provides implementations of Java Development Kits JDK and Java Runtime Environments JRE. These implementations provide the Java Web Start technology that can be used for easy client-side deployment of Java applications. Description Jouko Pynnonen discovered that Java Web Start...

Java XSLT security advisory addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================ Illegalaccess.org security advisory addendum ============================================ Vendor informed: April, 2004 Public Advisory released: August 2, 2004 Today: August 9, 2004 URL:...

CVE-2004-0253: Undefined Security Weakness

IBM Cloudscape 5.1 running jdk 1.4.203 allows remote attackers to execute arbitrary programs or cause a denial of service via certain SQL code, possibly due to a SQL injection vulnerability...

Advisory: Sun's jre/jdk 1.4.2 multiple vulernabilities in linux installers

Author: Stan Bubrouski Date: October 31, 2003 Packages: j2re/j2sdk OS: Linux possibly others, see below Versions: 1.4.2 - 1.4.202 Severity: Local users may overwrite any file owned by the user who installs java due to insecure file handling while unpacking/installing java. Problem: There are two...

JRE/JDK sandbox breaking

By using / instead of . in class name it's possible to bypass sandbox restrictions...

SUN jdk crossite scripting

jdk undocumented static variable may allow data exchange between sites...

CVE-2002-0076

CVE-2002-0076 affects the Java Runtime Environment (JRE) Bytecode Verifier. The verifier flaw allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation. Affected are Microsoft VM builds up to 3802 (Internet Explorer 4.x/5.x) and Net...

CVE-2003-0042: Undefined Security Weakness

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character...

Apache Tomcat 3.x - Null Byte Directory / File Disclosure

source: https://www.securityfocus.com/bid/6721/info Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier. It has been reported that remote attackers may view directory contents even when an 'index.html' or other welcome file. It is also possible...

CVE-2002-0058: Undefined Security Weakness

Vulnerability in Java Runtime Environment JRE allows remote malicious web sites to hijack or sniff a web client's sessions, when an HTTP proxy is being used, via a Java applet that redirects the session to another server, as seen in 1 Netscape 6.0 through 6.1 and 4.79 and earlier, 2 Microsoft VM...