Sun Java JRE jpiexp32.dll NULL Pointer Remote DoS

According to its version number, the Sun Java Runtime Environment JRE installed on the remote host reportedly contains an issue in 'jpiexp32.dll' that can lead to a NULL pointer exception when an HTML object references a Java applet but does not define the 'name' attribute. If a remote attacker c...

Sun Java JRE External XML Entities Restriction Bypass (231246)

According to its version number, the Sun Java Runtime Environment JRE installed on the remote host reportedly allows processing of external entity references even when the 'external general entities' property is set to 'FALSE'. This could allow an application to access certain URL resources, such...

Sun Java运行时环境jpiexp32.dll对象名称空指针引用漏洞

BUGTRAQ ID: 27185 CVECAN ID: CVE-2007-0012 Solaris系统的Java运行时环境（JRE）为JAVA应用程序提供可靠的运行环境。 JRE处理畸形的Applet数据时存在漏洞，远程攻击者可能利用此漏洞导致相关的应用崩溃。 RFC2397标准允许在URI中编码java applet并嵌入到HTML文档中。如果applet被编码为带有未定义name属性对象标签的数据参数的话，并将其传送给Internet Explorer，则解码后将其传送给JVM就会在jpiexp32.dll中触发空指针引用，导致拒绝服务。 Sun JRE 5.0 Update 14...

CVE-2007-0012

Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service Internet Explorer crash via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM...

Null pointer dereference

Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service Internet Explorer crash via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM...

CVE-2007-0012

Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service Internet Explorer crash via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM...

CVE-2007-0012

Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service Internet Explorer crash via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM...

CVE-2007-0012

CVE-2007-0012 affects Sun JRE 5.0 before update 14. An issue in the jpiexp32.dll can trigger a NULL pointer dereference when an HTML object tag encodes a Java applet without a defined name attribute, potentially crashing Internet Explorer/JRE. Exploitation described as remote and requiring a user...

CVE-2007-0012: Improper Input Validation

Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service Internet Explorer crash via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM...

Updated Tomcat and Java JRE packages for VirtualCenter 2.5, VirtualCenter 2.0.2, ESX 3.5, ESX 3.0.2, and ESX 3.0.1.

Updated ESX and VirtualCenter fixes the following application vulnerabilities...

VMSA-2008-0002:Updated Tomcat and Java JRE packages for VirtualCenter 2.5, VirtualCenter 2.0.2, ESX 3.5, ESX 3.0.2, and ESX 3.0.1.

VMSA-2008-0002.1 Updated Tomcat and Java JRE packages for VirtualCenter 2.5, VirtualCenter 2.0.2, ESX 3.5, ESX 3.0.2, and ESX 3.0.1. VMware Security Advisory VMware Security AdvisoryAdvisory ID: VMSA-2008-0002.1 VMware Security AdvisorySynopsis: Updated Tomcat and Java JRE packages for...

SuSE 10 Security Update : Java (ZYPP Patch Number 3891)

The IBM Java JRE/SDK has been brought to release 1.4.2 SR8, containing several bugfixes, including the following security fixes : - A buffer overflow vulnerability in the JavaTM Runtime Environment may allow an untrusted applet to elevate its privileges. For example, an applet may grant itself...

SuSE 10 Security Update : Sun Java 1.4.2 (ZYPP Patch Number 4533)

The Sun JAVA JDK 1.4.2 was upgraded to release 16 to fix various bugs, including the following security bugs : http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1 - Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and...

openSUSE 10 Security Update : derby (derby-4091)

Apache Derby did not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode. CVE-2006-7217 This update also brings a new requirement of a Java 1.5 JRE. %NASLMINLEVE...

Sun Java JRE / JDK multiple security vulnerabilities

Multiple sandbox restriction bypass vulnerabilities...

CVE-2007-5689

CVE-2007-5689 affects Sun JRE/JDK in multiple lines: JVM in JRE 1.3.x–1.4.x and JDK/JRE 5.x–6.x allows remote code execution or reading/modifying files via applets granted privileges. Connected docs indicate remediation via updated JRE/JDK packages (e.g., JVM/JRE updates to address these issues; ...

Anti-DNS Pinning and Java Applets with Opera and Firefox

Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound...

FreeBSD : jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented (c93e4d41-75c5-11dc-b903-0016179b2dd5)

SUN reports : A vulnerability in the Java Runtime Environment JRE with applet caching may allow an untrusted applet that is downloaded from a malicious website to make network connections to network services on machines other than the one that the applet was downloaded from. This may allow networ...

CVE-2007-5273

Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound...

CVE-2007-5274

The CVE-2007-5274 entry concerns Sun JRE/JDK/J2SE (various 4.x/5.x/6.x releases) where, when a user runs Firefox or Opera, JavaScript outbound connections could be violated due to a multi-pin DNS rebinding flaw tied to the LiveConnect API. The vulnerability arises because JavaScript code relies o...