[Full-disclosure] [ GLSA 200506-14 ] Sun and Blackdown Java: Applet privilege escalation

Gentoo Linux Security Advisory GLSA 200506-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

[SA14902] Sun Java JDK/SDK Jar Directory Traversal Vulnerability

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Sun Java JDK/SDK Jar Directory Traversal Vulnerability...

jdk -- jar directory traversal vulnerability

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicio...

Sun Java: Web Start argument injection vulnerability

Background Sun provides implementations of Java Development Kits JDK and Java Runtime Environments JRE. These implementations provide the Java Web Start technology that can be used for easy client-side deployment of Java applications. Description Jouko Pynnonen discovered that Java Web Start...

Java XSLT security advisory addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================ Illegalaccess.org security advisory addendum ============================================ Vendor informed: April, 2004 Public Advisory released: August 2, 2004 Today: August 9, 2004 URL:...

Advisory: Sun's jre/jdk 1.4.2 multiple vulernabilities in linux installers

Author: Stan Bubrouski Date: October 31, 2003 Packages: j2re/j2sdk OS: Linux possibly others, see below Versions: 1.4.2 - 1.4.202 Severity: Local users may overwrite any file owned by the user who installs java due to insecure file handling while unpacking/installing java. Problem: There are two...

JRE/JDK sandbox breaking

By using / instead of . in class name it's possible to bypass sandbox restrictions...

SUN jdk crossite scripting

jdk undocumented static variable may allow data exchange between sites...

CVE-2002-0076

CVE-2002-0076 affects the Java Runtime Environment (JRE) Bytecode Verifier. The verifier flaw allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation. Affected are Microsoft VM builds up to 3802 (Internet Explorer 4.x/5.x) and Net...

Apache Tomcat 3.x - Null Byte Directory / File Disclosure

source: https://www.securityfocus.com/bid/6721/info Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier. It has been reported that remote attackers may view directory contents even when an 'index.html' or other welcome file. It is also possible...

KLA10345 SB vulnerability in SUN JRE & JDK

An unspecified vulnerability was found in Sun JRE & JDK. By exploiting this vulnerability malicious users can access the clipboard. This vulnerability can be exploited remotely via a specially designed applet. Original advisories - Related products Sun-Java-JRE CVE list CVE-2001-1480 high Solutio...

CVE-2000-1099

Java Runtime Environment in Java Development Kit JDK 1.2.205 and earlier can allow an untrusted Java class to call into a disallowed class, which could allow an attacker to escape the Java sandbox and conduct unauthorized activities...

CVE-2000-1099

CVE-2000-1099 affects the Java Runtime Environment in JDK 1.2.2_05 and earlier . The vulnerability allows an untrusted Java class to call into a disallowed class, potentially allowing sandbox escape and unauthorized activities. The available documents do not provide a specific patch version or re...

JDK 1.1.x Listening Socket Vulnerability (was Re: BrownOrifice can break firewalls!)

On Sat, 12 Aug 2000 05:33:29 +0900 "TAKAGI, Hiromitsu" [email protected] wrote: This can be verified by trying the following refined proof of concept Applet. http://java-house.etl.go.jp/takagi/java/test/Brumleve-BrownOrifice-modified-netscape.net.URLConnection/Test.html I have confirmed that Mac O...

CVE-1999-0142

The CVE-1999-0142 issue concerns the Java Applet Security Manager in Netscape Navigator 2.0 and Java Developer’s Kit 1.0, where an applet could connect to arbitrary hosts due to how the security manager operates. Affected software/components are the Java Applet Security Manager implementation wit...

java.jvm.byte.code.ver.txt

Date: Mon, 5 Apr 1999 08:56:10 -0400 From: Gary McGraw To: [email protected] Subject: Security Hole in Java 2 and JDK 1.1.x Hi all, Karsten Sohr at the University of Marburg in Germany email [email protected] has discovered a very serious security flaw in several current versions ...