Apple Safari禁用Java偏好失败漏洞

BUGTRAQ ID: 25157 CVECAN ID: CVE-2007-2408 Safari是苹果家族操作系统默认所捆绑的WEB浏览器。 Safari在处理Java Applet的下载和执行时存在漏洞，远程攻击者可能利用此漏洞在用户浏览器中非授权执行Java Applet。 Safari提供了Enable Java偏好选项，如果取消了这个偏好的话就应禁止加载Java Applet。但默认下Safari允许下载Java Applet，因此即使取消了这个偏好仍可能在用户访问恶意网页的时候未经检查偏好便下载并执行Java Applet。 Apple Safari 3.0.2 Beta...

US-CERT Technical Cyber Security Alert TA07-193A -- Apple Releases Security Updates for QuickTime

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-193A Apple Releases Security Updates for QuickTime Original release date: July 12, 2007 Last revised: -- Source: US-CERT Systems Affected Apple QuickTime on systems running Apple Mac OS X...

Apple Quicktime For Java远程堆溢出漏洞

Apple QuickTime是一款流行的多媒体播放器，支持多种媒体格式。 QuickTime的实现上存在漏洞，远程攻击者可能利用此漏洞控制用户机器。 QuickTime for Java可能允许在所分配的堆之外实例化或操作对象。漏洞起因是QTObject的子类没有正确设置安全限制，不可信任的Java代码允许将调用QTJava.dll中不安全函数的QuickTime对象归为子类，导致读写任意内存。如果用户受骗访问了包含有特制Java Applet的Web页面的话，就可能触发堆溢出，导致执行任意指令。 Apple QuickTime Player 7.1.6...

Quicktime Multiple Vulnerabilities (Mac OS X 7.1.6 Security Update)

According to its version, the installation of Quicktime on the remote Mac OS X host that contains a bug which might allow a rogue Java program to write anywhere in the heap. An attacker may be able to leverage these issues to execute arbitrary code on the remote host by luring a victim into...

Apple QuickTime for Java information disclosure vulnerability

Overview Apple QuickTime for Java fails to properly clear memory. As a result, sensitive information may be exposed to unintended parties. Description Apple QuickTime includes the ability to integrate QuickTime into Java applications and applets. This feature is known as QuickTime for Java. Apple...

Quicktime < 7.1.6 quicktime.util.QTHandleRef toQTPointer Method Arbitrary Code Execution (Mac OS X)

According to its version, the installation of Quicktime on the remote Mac OS X host which contains a bug which might allow a rogue Java program to write anywhere in the heap. An attacker may be able to leverage these issues to execute arbitrary code on the remote host by luring a victim into...

Akamai Technologies Security Advisory 2007-0001

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------- Akamai Technologies Security Advisory 2007-0001 Akamai ID: 2007-0001 Date: 2007/04/16 Product Name: Download Manager Affected Versions: 2.2.1.0 Fixed Version: 2.2.1.0 CVE IDs: CVE-2007-1891...

AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities

Background The Sun Java Development Kit JDK and the Sun Java Runtime Environment JRE provide the Sun Java platform. The x86 emulation Sun's J2SE Development Kit for AMD64 contains a vulnerable version of Sun's JDK. Description Chris Evans has discovered multiple buffer overflows in Sun JDK and Su...

GLSA-200701-15 : Sun JDK/JRE: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200701-15 Sun JDK/JRE: Multiple vulnerabilities Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun JRE possibly related to various AWT or font layout functions. Tom Hawtin has discovered an unspecified...

Sun JDK/JRE: Multiple vulnerabilities

Background The Sun Java Development Kit JDK and the Sun Java Runtime Environment JRE provide the Sun Java platform. Description Chris Evans has discovered multiple buffer overflows in Sun JDK and Sun JRE possibly related to various AWT or font layout functions. Tom Hawtin has discovered an...

CVE-2006-5681: Undefined Security Weakness

QuickTime for Java on Mac OS X 10.4 through 10.4.8, when used with Quartz Composer, allows remote attackers to obtain sensitive information screen images via a Java applet that accesses images that are being rendered by other embedded QuickTime objects...

Multiple OpenOffice security vulnerabilities

BASIC macro auto launch without user intercation, Java applet sandbox protection bypass, XML parsing buffer overflow...

JDK java applet disk space DoS

It's possible to consume all available disk space with temporary file...

Sun Java Reflection API security bypass vulnerabilities

Overview Multiple vulnerabilities in the Sun Java Reflection API may allow an untrusted Java applet to bypass security restrictions and execute arbitrary code. Description The Sun Java Reflection API allows Java classes to determine information about other Java classes, such as public methods...

GLSA-200601-10 : Sun and Blackdown Java: Applet privilege escalation

The remote host is affected by the vulnerability described in GLSA-200601-10 Sun and Blackdown Java: Applet privilege escalation Adam Gowdiak discovered multiple vulnerabilities in the Java Runtime Environment's Reflection APIs that may allow untrusted applets to elevate privileges. Impact : A...

CVE-2005-4197

tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet...

CVE-2005-4197: Undefined Security Weakness

tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet...

CVE-2005-3946

Opera 8.50 allows remote attackers to cause a denial of service crash via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class...

CVE-2005-3946

Opera 8.50 allows remote attackers to cause a denial of service crash via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class...

CVE-2005-3946: Improper Input Validation

Opera 8.50 allows remote attackers to cause a denial of service crash via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class...