iDefense Security Advisory 03.26.09: Sun Java Web Start (JWS ) GIF Decoding Heap Corruption Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 03.25.09 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 25, 2009 I. BACKGROUND Java Web Start JWS is a framework built by Sun that is used to run Java applications outside of the browser. It is distributed with t...

Java Web Start exposes username and the pathname of the JWS cache

Unspecified vulnerability in Java Web Start JWS and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071...

Java Web Start exposes username and the pathname of the JWS cache

Unspecified vulnerability in Java Web Start JWS and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071...

CVE-2008-5344

The CVE-2008-5344 entry describes an unspecified vulnerability in Sun Java Web Start (JWS) and Java Plug-in affecting Sun JDK/JRE 6u10 and earlier, JDK/JRE 5.0u16 and earlier, and SDK/JRE 1.4.2_18 and earlier. The issue allows untrusted applets to read arbitrary files and make unauthorized networ...

CVE-2008-5340

CVE-2008-5340 concerns an unspecified vulnerability in Java Web Start (JWS) and Java Plug-in affecting Sun JDK/JRE lines: Java SE 6 Update 10 and earlier; Java SE 5.0 Update 16 and earlier; and SDK/JRE 1.4.2_18 and earlier. The untrusted JWS applications can gain privileges to access local files ...

CVE-2008-5339

CVE-2008-5339 affects Sun JDK/JRE components (Java Web Start and Java Plug-in) across multiple older builds: Java 6 Update 10 and earlier, Java 5.0 Update 16 and earlier, and SDK/JRE 1.4.2_18 and earlier. The description indicates an unspecified vulnerability where untrusted JWS applications coul...

Critical: Red Hat Security Advisory: java-1.4.2-ibm security update

Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.4.2 SR11 Java release includes the IBM...

Critical: Red Hat Security Advisory: java-1.6.0-ibm security update

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.6.0 Java release includes the IBM Java 2 Runtime Environmen...

CVE-2006-2469

The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges...

CVE-2005-4472

Macromedia JRun 4 Web Server (JWS) is affected by a stack-based buffer overflow when converting long requests to wide characters, enabling remote denial of service and potentially arbitrary code execution. Affected component: JRun 4 web server (JWS). Root cause: improper handling of long requests...

CVE-2005-4473

CVE-2005-4473 concerns Macromedia JRun 4 web server (JWS). The public description states an unspecified vulnerability that enables remote attackers to view web application source code via a malformed URL. This is the only concrete detail provided across linked records; no version-specific impact,...

[SA18077] Macromedia JRun Server Two Vulnerabilities

TITLE: Macromedia JRun Server Two Vulnerabilities SECUNIA ADVISORY ID: SA18077 VERIFY ADVISORY: http://secunia.com/advisories/18077/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information, DoS WHERE: From remote SOFTWARE: Macromedia Jrun 4.x http://secunia.com/product/863/...

CVE-2001-1511

The CVE-2001-1511 issue affects JRun 3.0/3.1 running on JRun Web Server (JWS) and IIS, where remote attackers can read arbitrary JSP source code by requesting a URL containing a source filename ending in jsp%00 or js%2570. This indicates a file-disclosure vulnerability enabling access to server-s...