The update brings IBM Java 5 to SR9-SSU.

It fixes a lot of security issues: CVE-2009-1100: A vulnerability in the Java Runtime Environment (JRE) with storing temporary font files may allow an untrusted applet or application to consume a disproportionate amount of disk space resulting in a denial-of-service condition.

  - A vulnerability in the Java Runtime Environment (JRE)     with processing temporary font files may allow an     untrusted applet or application to retain temporary     files resulting in a denial-of-service condition.
    (CVE-2009-1100)

  - A vulnerability in the Java Plug-in with deserializing     applets may allow an untrusted applet to escalate     privileges. For example, an untrusted applet may grant     itself permissions to read and write local files or     execute local applications that are accessible to the     user running the untrusted applet. (CVE-2009-1103)

  - The Java Plug-in allows JavaScript code that is loaded     from the localhost to connect to any port on the system.
    This may be leveraged together with XSS vulnerabilities     in a blended attack to access other applications     listening on ports other than the one where the     JavaScript code was served from. (CVE-2009-1104)

  - A vulnerability in the Java Runtime Environment (JRE)     with initializing LDAP connections may be exploited by a     remote client to cause a denial-of-service condition on     the LDAP service. (CVE-2009-1093)

  - A vulnerability in Java Runtime Environment LDAP client     implementation may allow malicious data from an LDAP     server to cause malicious code to be unexpectedly loaded     and executed on an LDAP client. (CVE-2009-1094)

  - The Java Plugin displays a warning dialog for signed     applets. A signed applet can obscure the contents of the     dialog and trick a user into trusting the applet.
    (CVE-2009-1107)

  - Buffer overflow vulnerabilities in the Java Runtime     Environment (JRE) with unpacking applets and Java Web     Start applications using the unpack200 JAR unpacking     utility may allow an untrusted applet or application to     escalate privileges. For example, an untrusted applet     may grant itself permissions to read and write local     files or execute local applications that are accessible     to the user running the untrusted applet. (CVE-2009-1095     / CVE-2009-1096)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing GIF images may allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     may grant itself permissions to read and write local     files or execute local applications that are accessible     to the user running the untrusted applet.
    (CVE-2009-1098)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing fonts may allow an untrusted     applet or Java Web Start application to escalate     privileges. For example, an untrusted applet may grant     itself permissions to read and write local files or     execute local applications that are accessible to the     user running the untrusted applet. (CVE-2009-1099)

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section.

All running instances of Sun Java must be restarted for the update to take effect.

Note: jdk-1.6.0_13-fcs.x86_64.rpm could not be signed. All other rpm's are signed with the usual signature.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
41528	SuSE 10 Security Update : IBM Java 5 (ZYPP Patch Number 6253)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
60555	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
44029	RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)	Nessus	Red Hat Local Security Checks	2010/1/15	2021/1/14	critical

検出

プラグインの検索

critical

critical

critical