IBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues.

The timezone update to 1.6.9s (with the latest Fiji change).

  - A vulnerability in the Java Runtime Environment with     decoding DER encoded data might allow a remote client to     cause the JRE to crash, resulting in a denial of service     condition. (CVE-2009-3876 / CVE-2009-3877)

  - A buffer overflow vulnerability in the Java Runtime     Environment audio system might allow an untrusted applet     or Java Web Start application to escalate privileges.
    For example, an untrusted applet might grant itself     permissions to read and write local files, or run local     applications that are accessible to the user running the     untrusted applet. (CVE-2009-3867)

  - A buffer overflow vulnerability in the Java Runtime     Environment with parsing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3868)

  - An integer overflow vulnerability in the Java Runtime     Environment with reading JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3872)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3873)

  - A security vulnerability in the Java Runtime Environment     with verifying HMAC digests might allow authentication     to be bypassed. This action can allow a user to forge a     digital signature that would be accepted as valid.
    Applications that validate HMAC-based digital signatures     might be vulnerable to this type of attack.
    (CVE-2009-3875)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3869)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3871)

  - An integer overflow vulnerability in the Java Runtime     Environment with processing JPEG images might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3874)

  - The Java Runtime Environment includes the Java Web Start     technology that uses the Java Web Start ActiveX control     to launch Java Web Start in Internet Explorer. A     security vulnerability in the Active Template Library     (ATL) in various releases of Microsoft Visual Studio,     which is used by the Java Web Start ActiveX control,     might allow the Java Web Start ActiveX control to be     leveraged to run arbitrary code. This might occur as the     result of a user of the Java Runtime Environment viewing     a specially crafted web page that exploits this     vulnerability. (CVE-2009-2493)

Please also see http://www.ibm.com/developerworks/java/jdk/alerts/

CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky)

CVE-2009-3873 OpenJDK JPEG Image Writer quantization problem (6862968)

CVE-2009-3875 OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)

CVE-2009-3876 OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877

CVE-2009-3869 OpenJDK JRE AWT setDifflCM stack overflow (6872357)

CVE-2009-3871 OpenJDK JRE AWT setBytePixels heap overflow (6872358)

CVE-2009-3874 OpenJDK ImageI/O JPEG heap overflow (6874643)

CVE-2009-3728 OpenJDK ICC_Profile file existence detection information leak (6631533)

CVE-2009-3881 OpenJDK resurrected classloaders can still have children (6636650)

CVE-2009-3882 CVE-2009-3883 OpenJDK information leaks in mutable variables (6657026,6657138)

CVE-2009-3880 OpenJDK UI logging information leakage(6664512)

CVE-2009-3879 OpenJDK GraphicsConfiguration information leak(6822057)

CVE-2009-3884 OpenJDK zoneinfo file existence information leak (6824265)

CVE-2009-3729 JRE TrueType font parsing crash (6815780)

CVE-2009-3872 JRE JPEG JFIF Decoder issue (6862969)

CVE-2009-3886 JRE REGRESSION:have problem to run JNLP app and applets with signed Jar files (6870531)

CVE-2009-3865 java-1.6.0-sun: ACE in JRE Deployment Toolkit (6869752)

CVE-2009-3866 java-1.6.0-sun: Privilege escalation in the Java Web Start Installer (6872824)

CVE-2009-3867 java-1.5.0-sun, java-1.6.0-sun: Stack-based buffer overflow via a long file: URL argument (6854303)

CVE-2009-3868 java-1.5.0-sun, java-1.6.0-sun: Privilege escalation via crafted image file due improper color profiles parsing (6862970)

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. (CVE-2009-2409, CVE-2009-3728, CVE-2009-3729,

CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868,

CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873,

CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877,

CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,

CVE-2009-3883, CVE-2009-3884, CVE-2009-3886)

All running instances of Sun Java must be restarted for the update to take effect.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities     exist. (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.
    (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.
    (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.
    (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the bundled version of the Java Runtime Environment (JRE).

Add latest security patches Bug numbers:510197, 530053, 530057, 530061, 530062, 530063, 530067, 530098, 530173, 530175, 530296, 530297, 530300

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New icedtea update to fix :

  - ICC_Profile file existence detection information leak;
    CVE-2009-3728: CVSS v2 Base Score: 5.0

  - BMP parsing DoS with UNC ICC links; CVE-2009-3885: CVSS     v2 Base Score: 5.0

  - resurrected classloaders can still have children;
    CVE-2009-3881: CVSS v2 Base Score: 7.5

  - Numerous static security flaws in Swing; CVE-2009-3882:
    CVSS v2 Base Score: 7.5

  - Mutable statics in Windows PL&F; CVE-2009-3883: CVSS v2     Base Score: 7.5

  - UI logging information leakage; CVE-2009-3880: CVSS v2     Base Score: 5.0

  - GraphicsConfiguration information leak; CVE-2009-3879:
    CVSS v2 Base Score: 7.5

  - zoneinfo file existence information leak; CVE-2009-3884:
    CVSS v2 Base Score: 5.0

  - deprecate MD2 in SSL cert validation; CVE-2009-2409:
    CVSS v2 Base Score: 6.4

  - JPEG Image Writer quantization problem; CVE-2009-3873:
    CVSS v2 Base Score: 9.3

  - MessageDigest.isEqual introduces timing attack     vulnerabilities; CVE-2009-3875: CVSS v2 Base Score: 5.0

  - OpenJDK ASN.1/DER input stream parser denial of service;
    CVE-2009-3876,CVE-2009-3877: CVSS v2 Base Score: 5.0

  - JRE AWT setDifflCM stack overflow; CVE-2009-3869: CVSS     v2 Base Score: 9.3

  - ImageI/O JPEG heap overflow; CVE-2009-3874: CVSS v2 Base     Score: 9.3

  - JRE AWT setBytePixels heap overflow; CVE-2009-3871: CVSS     v2 Base Score: 9.3

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities.
    (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.     (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.     (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors. (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.     (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

java-1_5_0-sun u22 update fixes the following security bugs :

  - CVE-2009-3864: CVSS v2 Base Score: 7.5

  - CVE-2009-3867: CVSS v2 Base Score: 9.3

  - CVE-2009-3868: CVSS v2 Base Score: 9.3

  - CVE-2009-3869: CVSS v2 Base Score: 9.3

  - CVE-2009-3871: CVSS v2 Base Score: 9.3

  - CVE-2009-3872: CVSS v2 Base Score: 10.0

  - CVE-2009-3873: CVSS v2 Base Score: n/a

  - CVE-2009-3874: CVSS v2 Base Score: 9.3

  - CVE-2009-3875: CVSS v2 Base Score: 5.0

  - CVE-2009-3876: CVSS v2 Base Score: 5.0

  - CVE-2009-3877: CVSS v2 Base Score: 5.0 For bug details     use the CVE-ID to query the Mitre database at     http://cve.mitre.org/cve please.

The Sun Java 6 SDK/JRE was updated to u17 update fixing bugs and various security issues :

CVE-2009-3866:The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that poi nts to an unintended trusted application, aka Bug Id 6872824.

CVE-2009-3867: Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

CVE-2009-3869: Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_ 24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.

CVE-2009-3871: Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4. 2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.

CVE-2009-3874: Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensi ons in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.

CVE-2009-3875: The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital si gnatures, and possibly bypass authentication, via unspecified vectors related to 'timing attack vulnerabilities,' aka Bug Id 6863503.

CVE-2009-3876: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVE-2009-3877: Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP header s, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVE-2009-3864: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to lev erage vulnerabilities in older releases of this software, aka Bug Id 6869694.

CVE-2009-3865: The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.

CVE-2009-3868: Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x be fore 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.

CVE-2009-3872: Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK a nd JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.

CVE-2009-3873: The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2 _24 allows remote attackers to gain privileges via a crafted image file, related to a 'quanization problem,' aka Bug Id 6862968.

Multiple Java OpenJDK security vulnerabilities has been identified and fixed :

  - TLS: MITM attacks via session renegotiation     (CVE-2009-3555).

    - Loader-constraint table allows arrays instead of only       the b ase-classes (CVE-2010-0082).

  - Policy/PolicyFile leak dynamic ProtectionDomains.
    (CVE-2010-0084).

    - File TOCTOU deserialization vulnerability       (CVE-2010-0085).

    - Inflater/Deflater clone issues (CVE-2010-0088).

    - Unsigned applet can retrieve the dragged information       before drop action occurs (CVE-2010-0091).

  - AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error     (CVE-2010-0092).

  - System.arraycopy unable to reference elements beyond     Integer.MAX_VALUE bytes (CVE-2010-0093).

  - Deserialization of RMIConnectionImpl objects should     enforce stricter checks (CVE-2010-0094).

  - Subclasses of InetAddress may incorrectly interpret     network addresses (CVE-2010-0095).

  - JAR unpack200 must verify input parameters     (CVE-2010-0837).

    - CMM readMabCurveData Buffer Overflow Vulnerability       (CVE-2010-0838).

    - Applet Trusted Methods Chaining Privilege Escalation       Vulnerability (CVE-2010-0840).

  - No ClassCastException for HashAttributeSet constructors     if run with -Xcomp (CVE-2010-0845)

  - ImagingLib arbitrary code execution vulnerability     (CVE-2010-0847).

    - AWT Library Invalid Index Vulnerability       (CVE-2010-0848).

Additional security issues that was fixed with IcedTea6 1.6.2 :

  - deprecate MD2 in SSL cert validation (CVE-2009-2409).

    - ICC_Profile file existence detection information leak       (CVE-2009-3728).

  - JRE AWT setDifflCM stack overflow (CVE-2009-3869).

    - JRE AWT setBytePixels heap overflow (CVE-2009-3871).

    - JPEG Image Writer quantization problem       (CVE-2009-3873).

    - ImageI/O JPEG heap overflow (CVE-2009-3874).

    - MessageDigest.isEqual introduces timing attack       vulnerabilities (CVE-2009-3875).

  - OpenJDK ASN.1/DER input stream parser denial of service     (CVE-2009-3876, CVE-2009-3877)

  - GraphicsConfiguration information leak (CVE-2009-3879).

    - UI logging information leakage (CVE-2009-3880).

    - resurrected classloaders can still have children       (CVE-2009-3881).

    - Numerous static security flaws in Swing (findbugs)       (CVE-2009-3882).

    - Mutable statics in Windows PL&amp;F (findbugs)       (CVE-2009-3883).

    - zoneinfo file existence information leak       (CVE-2009-3884).

    - BMP parsing DoS with UNC ICC links (CVE-2009-3885).

Additionally Paulo Cesar Pereira de Andrade (pcpa) at Mandriva found and fixed a bug in IcedTea6 1.8 that is also applied to the provided packages :

  - plugin/icedteanp/IcedTeaNPPlugin.cc     (plugin_filter_environment): Increment malloc size by     one to account for NULL terminator. Bug# 474.

Packages for 2009.0 are provided due to the Extended Maintenance Program.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
49863	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 6741)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high
60691	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
64831	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ...) (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	high
89736	VMware ESX Java Runtime Environment (JRE) Multiple Vulnerabilities (VMSA-2010-0002) (remote check)	Nessus	VMware ESX Local Security Checks	2016/3/8	2021/1/6	critical
42806	Fedora 10 : java-1.6.0-openjdk-1.6.0.0-23.b16.fc10 (2009-11490)	Nessus	Fedora Local Security Checks	2009/11/16	2021/1/11	high
42923	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1613)	Nessus	SuSE Local Security Checks	2009/11/30	2021/1/14	high
42373	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ..)	Nessus	Windows	2009/11/4	2022/4/11	high
42460	openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1529)	Nessus	SuSE Local Security Checks	2009/11/11	2021/1/14	high
42853	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1541)	Nessus	SuSE Local Security Checks	2009/11/19	2021/1/14	high
46176	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2010:084)	Nessus	Mandriva Local Security Checks	2010/4/29	2022/5/25	high

检测

插件搜索

high

high

high

critical

high

high

high

high

high

high