Information disclosure

The audio system in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by 1 untrusted applets and 2 Java Web Start applications, which allows context-dependent attackers to obtain sensiti...

Integer overflow

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a...

CVE-2009-2676

Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.221 and earlier; allows remote attackers to create or modify arbitrary files via vecto...

CVE-2009-2671

The SOCKS proxy implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted 1 applet or 2 Java Web Start application via unspecified vectors...

CVE-2009-2673

CVE-2009-2673 is the OpenJDK/Sun JRE proxy mechanism vulnerability that allows non-authenticated socket or URL connections due to a flaw in the proxy handling. Affected components include OpenJDK/OpenJRE proxy implementation and related JRE components as disclosed in multiple advisories (e.g., CV...

CVE-2009-2675

The CVE-2009-2675 entry concerns an integer overflow in the unpack200 utility of Sun Java Runtime Environment (JRE) / JDK. Affected: JRE/JDK 6 before Update 15 and JRE/JDK 5.0 before Update 20. Root cause: heap-based buffer overflow during decompression triggered by crafted Pack200 headers (unspe...

CVE-2009-2670

CVE-2009-2670 affects Sun Java Runtime Environment (JRE) in JDK/JRE 6 prior to Update 15 and JDK/JRE 5.0 prior to Update 20. The issue arises from the JRE audio system not preventing access to java.lang.System properties by untrusted applets and Java Web Start applications, enabling a context-dep...

CVE-2009-2674

CVE-2009-2674 affects Sun Java Web Start (javaws.exe) in Sun JRE/JDK 6 prior to Update 15. The root cause is an integer overflow/heap-based buffer overflow when processing crafted JPEG images displayed on the splash screen, enabling context-dependent attackers to execute arbitrary code. Connected...

CVE-2009-2672

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted 1 applets and 2 Java Web Start applications, which allows remote attackers to hijack web sessions...

CVE-2009-2674

Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a...

CVE-2009-2673

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lack...

openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-97)

This update brings the SUN JDK 6 to update level 7. CVE-2008-3115: Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit...

openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-698)

The Sun JDK 5 was updated to Update18 to fix various bugs and security issues. CVE-2009-1093: LdapCtx in the LDAP service in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.124 and earlier; and 1.4.219 and earlier do...

openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-705)

The Sun JDK 6 was updated to Update13 to fix various bugs and security issues. CVE-2009-1093: LdapCtx in the LDAP service in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.124 and earlier; and 1.4.219 and earlier do...

openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1017)

The Sun JDK/JRE 5 was updated to Update 19 fixing various bugs and security issues. An exact list of changes published by Sun can be found on http://java.sun.com/j2se/1.5.0/ReleaseNotes.html %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1017)

The Sun JDK/JRE 5 was updated to Update 19 fixing various bugs and security issues. An exact list of changes published by Sun can be found on http://java.sun.com/j2se/1.5.0/ReleaseNotes.html %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-698)

The Sun JDK 5 was updated to Update18 to fix various bugs and security issues. CVE-2009-1093: LdapCtx in the LDAP service in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.124 and earlier; and 1.4.219 and earlier do...

Oracle Critical Patch Update Advisory - July 2009

Oracle Critical Patch Update Advisory - July 2009 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required because of interdependencies by those security patches. Critical Patch Updates are...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

Authentication flaw

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...