Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially affected by multiple vulnerabilities affecting the Java software running on the host.

The version of Sun Java Runtime Environment (JRE) 6.0 installed on the remote host is affected by multiple security issues :

  - A vulnerability in the JRE could allow unauthorized     access to certain URL resources or cause a denial of     service condition while processing XML data. In order to     successfully exploit this issue, a JAX-WS client/service     included with a trusted application should process the     malicious XML content (238628).

  - A vulnerability in the JRE may allow an untrusted applet     to access information from another applet (238687).

  - A buffer overflow vulnerability in Java Web Start could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start may disclose the     location of Java Web Start cache (238905).

  - A vulnerability in Sun Java Management Extensions (JMX)     could allow a JMX client running on a remote host to     perform unauthorized actions on a host running JMX with     local monitoring enabled (238965).

  - A vulnerability in the JRE could allow an untrusted     applet / application to elevate its privileges to     read, write and execute local applications with the     privileges of the user running an untrusted applet     (238967, 238687).

  - A vulnerability in the JRE may allow an untrusted     applet to establish connections to services running on     the localhost and potentially exploit vulnerabilities     existing in the underlying JRE (238968).

The version of Sun Java Runtime Environment (JRE) 5.0 installed on the remote host is affected by multiple security issues :

  - A vulnerability in the XML processing module of the JRE     could allow an untrusted applet/application unauthorized     access to certain URL resources (238628).

  - A buffer overflow vulnerability in the font processing     module of the JRE, could allow an untrusted applet/     application to elevate its privileges to read, write     and execute local applications with the privileges of     the user running an untrusted applet (238666). Note this     issue only affects Sun Java JDK/JRE 5 Update 9 and     earlier.

  - A buffer overflow vulnerability in Java Web Start, could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start, could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start, may disclose the     location of Java Web Start cache (238905).

  - A vulnerability in Sun Java Management Extensions (JMX)     could allow a JMX client running on a remote host to     perform unauthorized actions on a host running JMX with     local monitoring enabled (238965).

  - A vulnerability in the JRE could allow an untrusted     applet/application to elevate its privileges to read,     write and execute local applications with the privileges     of the user running an untrusted applet (238967).

  - A vulnerability in the JRE may allow an untrusted applet     to establish connections to services running on the     localhost and potentially exploit vulnerabilities existing     in the underlying JRE (238968).

The version of Sun Java Runtime Environment (JRE) J2SE 1.4.2 installed on the remote host is affected by multiple security issues :

  - A buffer overflow vulnerability in the font processing     module of the JRE could allow an untrusted     applet/application to elevate its privileges to read,     write and execute local applications with the privileges     of the user running an untrusted applet (238666).

  - A vulnerability in the JRE could allow an untrusted     applet/application to elevate its privileges to read,     write and execute local applications with the privileges     of the user running an untrusted applet (238967).

  - A buffer overflow vulnerability in Java Web Start could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start, could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start, may disclose the     location of Java Web Start cache (238905).

  - A vulnerability in the JRE may allow an untrusted applet     to establish connections to services running on the     local host and potentially exploit vulnerabilities     existing in the underlying JRE (238968).

  - It should be noted that J2SE 1.4.2 is in its EOL period,     and the transition is set to complete on Oct 30th 2008.

Flaws in the JRE allowed an untrusted application or applet to elevate its privileges. This could be exploited by a remote attacker to access local files or execute local applications accessible to the user running the JRE (CVE-2008-1185, CVE-2008-1186)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

Several buffer overflow flaws were found in Java Web Start (JWS). An untrusted JNLP application could access local files or execute local applications accessible to the user running the JRE. (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1196)

A flaw was found in the Java Plug-in. A remote attacker could bypass the same origin policy, executing arbitrary code with the permissions of the user running the JRE. (CVE-2008-1192)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The JRE allowed untrusted JavaScript code to create local network connections by the use of Java APIs. A remote attacker could use these flaws to access local network services. (CVE-2008-1195)

A vulnerability was found in the Java Management Extensions (JMX) management agent, when local monitoring is enabled. This allowed remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote attacker could misuse an unsigned applet to connect to localhost services running on the host running the applet. (CVE-2008-3104)

A Java Runtime Environment (JRE) vulnerability could be triggered by an untrusted application or applet. A remote attacker could grant an untrusted applet extended privileges such as reading and writing local files, or executing local programs. (CVE-2008-3107)

Several buffer overflow vulnerabilities in Java Web Start were reported. These vulnerabilities may allow an untrusted Java Web Start application to elevate its privileges and thereby grant itself permission to read and/or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A remote attacker, by means of an untrusted Java Web Start application, was able to create or delete arbitrary files with the permissions of the user running the untrusted application. (CVE-2008-3112, CVE-2008-3113)

A vulnerability in Java Web Start when processing untrusted applications was reported. An attacker was able to acquire sensitive information, such as the cache location. (CVE-2008-3114)

Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in the Red Hat Network Satellite Server Sun Java Runtime Environment.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in the Sun Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.1. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Multiple flaws were fixed in the Sun Java 1.5.0 Runtime Environment.
(CVE-2008-3103, CVE-2008-3104, CVE-2008-3107, CVE-2008-3111, CVE-2008-3112, CVE-2008-3113, CVE-2008-3114)

Users of Red Hat Network Satellite Server 5.1 are advised to upgrade to 5.1.1, which resolves these issues.

The remote host is affected by the vulnerability described in GLSA-200911-02 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Sun Java     implementation. Please review the CVE identifiers referenced below and     the associated Sun Alerts for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JAR     archive, applet, or Java Web Start application, possibly resulting in     the execution of arbitrary code with the privileges of the user running     the application. Furthermore, a remote attacker could cause a Denial of     Service affecting multiple services via several vectors, disclose     information and memory contents, write or execute local files, conduct     session hijacking attacks via GIFAR files, steal cookies, bypass the     same-origin policy, load untrusted JAR files, establish network     connections to arbitrary hosts and posts via several vectors, modify     the list of supported graphics configurations, bypass HMAC-based     authentication systems, escalate privileges via several vectors and     cause applet code to be executed with older, possibly vulnerable     versions of the JRE.
    NOTE: Some vulnerabilities require a trusted environment, user     interaction, a DNS Man-in-the-Middle or Cross-Site-Scripting attack.
  Workaround :

    There is no known workaround at this time.

Sun Java was updated to 1.4.2u18 to fix following security vulnerabilities :

  - Unspecified vulnerability in Sun Java Web Start in JDK     and JRE 6 before Update 7, JDK and JRE 5.0 before Update     16, and SDK and JRE 1.4.x before 1.4.2_18 allows     context-dependent attackers to obtain sensitive     information (the cache location) via an untrusted     application, aka CR 6704074. (CVE-2008-3114)

  - Unspecified vulnerability in Sun Java Web Start in JDK     and JRE 5.0 before Update 16 and SDK and JRE 1.4.x     before 1.4.2_18 allows remote attackers to create or     delete arbitrary files via an untrusted application, aka     CR 6704077. (CVE-2008-3113)

  - Unspecified vulnerability in Sun Java Web Start in JDK     and JRE 6 before Update 7, JDK and JRE 5.0 before Update     16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote     attackers to create arbitrary files via an untrusted     application, aka CR 6703909. (CVE-2008-3112)

  - Multiple buffer overflows in Sun Java Web Start in JDK     and JRE 6 before Update 4, JDK and JRE 5.0 before Update     16, and SDK and JRE 1.4.x before 1.4.2_18 allow     context-dependent attackers to gain privileges via an     untrusted application, as demonstrated by an application     that grants itself privileges to (1) read local files,     (2) write to local files, or (3) execute local programs,     aka CR 6557220. (CVE-2008-3111)

  - Buffer overflow in Sun Java Runtime Environment (JRE) in     JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x     before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23     allows context-dependent attackers to gain privileges     via unspecified vectors related to font processing.
    (CVE-2008-3108)

  - Unspecified vulnerability in the Virtual Machine in Sun     Java Runtime Environment (JRE) in JDK and JRE 6 before     Update 7, JDK and JRE 5.0 before Update 16, and SDK and     JRE 1.4.x before 1.4.2_18 allows context-dependent     attackers to gain privileges via an untrusted (1)     application or (2) applet, as demonstrated by an     application or applet that grants itself privileges to     (a) read local files, (b) write to local files, or (c)     execute local programs. (CVE-2008-3107)

  - Multiple unspecified vulnerabilities in Sun Java Runtime     Environment (JRE) in JDK and JRE 6 before Update 7, JDK     and JRE 5.0 before Update 16, SDK and JRE 1.4.x before     1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow     remote attackers to violate the security model for an     applet's outbound connections by connecting to localhost     services running on the machine that loaded the applet.
    (CVE-2008-3104)

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

Multiple vulnerabilities with unsigned applets were reported. A remote attacker could misuse an unsigned applet to connect to localhost services running on the host running the applet. (CVE-2008-3104)

A vulnerability in the XML processing API was found. A remote attacker who caused malicious XML to be processed by an untrusted applet or application was able to elevate permissions to access URLs on a remote host. (CVE-2008-3106)

A buffer overflow vulnerability was found in the font processing code.
This allowed remote attackers to extend the permissions of an untrusted applet or application, allowing it to read and/or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3108)

Several buffer overflow vulnerabilities in Java Web Start were reported. These vulnerabilities allowed an untrusted Java Web Start application to elevate its privileges, allowing it to read and/or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A remote attacker, by means of an untrusted Java Web Start application, was able to create or delete arbitrary files with the permissions of the user running the untrusted application. (CVE-2008-3112, CVE-2008-3113)

A vulnerability in Java Web Start when processing untrusted applications was reported. An attacker was able to acquire sensitive information, such as the cache location. (CVE-2008-3114)

All users of java-1.5.0-ibm are advised to upgrade to these updated packages, that contain the IBM 1.5.0 SR8 Java release, which resolves these issues.

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools that users need to run applets and applications written using the Java programming language.

A vulnerability was found in the Java Management Extensions (JMX) management agent, when local monitoring is enabled. This allowed remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote attacker could misuse an unsigned applet to connect to localhost services running on the host running the applet. (CVE-2008-3104)

A Java Runtime Environment (JRE) vulnerability could be triggered by an untrusted application or applet. A remote attacker could grant an untrusted applet extended privileges such as reading and writing local files, or executing local programs. (CVE-2008-3107)

Several buffer overflow vulnerabilities in Java Web Start were reported. These vulnerabilities may allow an untrusted Java Web Start application to elevate its privileges and thereby grant itself permission to read and/or write local files, as well as to execute local applications accessible to the user running the untrusted application. (CVE-2008-3111)

Two file processing vulnerabilities in Java Web Start were found. A remote attacker, by means of an untrusted Java Web Start application, was able to create or delete arbitrary files with the permissions of the user running the untrusted application. (CVE-2008-3112, CVE-2008-3113)

A vulnerability in Java Web Start when processing untrusted applications was reported. An attacker was able to acquire sensitive information, such as the cache location. (CVE-2008-3114)

Users of java-1.5.0-sun should upgrade to these updated packages, which correct these issues.

a.  Privilege escalation on 64-bit guest operating systems

  VMware products emulate hardware functions, like CPU, Memory, and   IO.  

  A flaw in VMware's CPU hardware emulation could allow the   virtual CPU to jump to an incorrect memory address. Exploitation of   this issue on the guest operating system does not lead to a   compromise of the host system but could lead to a privilege   escalation on guest operating system.  An attacker would need to   have a user account on the guest operating system.

  Affected   64-bit Windows and 64-bit FreeBSD guest operating systems and   possibly other 64-bit operating systems. The issue does not   affect the 64-bit versions of Linux guest operating systems.

  VMware would like to thank Derek Soeder for discovering   this issue and working with us on its remediation.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2008-4279 this issue.

 b. Update for VirtualCenter fixes a potential information disclosure

 This release resolves an issue where a user's password could be  displayed in cleartext. When logging into VirtualCenter Server 2.0  with Virtual Infrastructure Client 2.5, the user password might be  displayed if it contains certain special characters. The dialog  box displaying the password can appear in front or hidden behind  other windows.

 To remediate this issue the VirtualCenter client installations must  be updated after updating to VirtualCenter Update 3

 VMware would like to thank Mark Woollatt for reporting this issue  to VMware.

 The Common Vulnerabilities and Exposures project (cve.mitre.org)  has assigned the name CVE-2008-4278 to this issue.

 c. Update for VirtualCenter updates JRE to version 1.5.0_16

 Update for VirtualCenter updates the JRE package to version 1.5.0_16,  which addresses multiple security issues that existed in the previous  version of JRE.

 The Common Vulnerabilities and Exposures project (cve.mitre.org)  has assigned the names CVE-2008-3103, CVE-2008-3104, CVE-2008-3105,  CVE-2008-3106, CVE-2008-3107, CVE-2008-3108, CVE-2008-3109,  CVE-2008-3110, CVE-2008-3111, CVE-2008-3112, CVE-2008-3113,  CVE-2008-3114, CVE-2008-3115 to the security issues fixed in  JRE 1.5.0_16.

This update brings the SUN JDK 6 to update level 7.

CVE-2008-3115: Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases.

CVE-2008-3114: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074. 

CVE-2008-3112: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via an untrusted application, aka CR 6703909. 

CVE-2008-3111: Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs, aka CR 6557220.

CVE-2008-3110: Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet. 

CVE-2008-3109: Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs. 

CVE-2008-3107: Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVE-2008-3106: Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105. 

CVE-2008-3105: Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving 'processing of XML data' by a trusted application. 

CVE-2008-3104: Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet. 

CVE-2008-3103: Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to 'perform unauthorized operations' via unspecified vectors.

Sun Java was updated to 1.5.0u16 to fix following security vulnerabilities :

CVE-2008-3115: Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases.

CVE-2008-3114: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074. 

CVE-2008-3113: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077. 

CVE-2008-3112: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via an untrusted application, aka CR 6703909. 

CVE-2008-3111: Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs, aka CR 6557220.

CVE-2008-3108: Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing. 

CVE-2008-3107: Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVE-2008-3106: Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105. 

CVE-2008-3104: Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet. 

CVE-2008-3103: Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to 'perform unauthorized operations' via unspecified vectors.

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 7.

The remote version of this software contains several security vulnerabilities which may allow a rogue java applet to execute arbitrary code on the remote host.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

The remote Mac OS X 10.5 host is running a version of Java for Mac OS X that is missing update 2.

The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to execute arbitrary code on the remote host.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

IBM Java 5 was updated to SR8 to fix various security issues :

  - Multiple vulnerabilities with unsigned applets were     reported. A remote attacker could misuse an unsigned     applet to connect to localhost services running on the     host running the applet. (CVE-2008-3104)

  - A vulnerability in the XML processing API was found. A     remote attacker who caused malicious XML to be processed     by an untrusted applet or application was able to     elevate permissions to access URLs on a remote host.
    (CVE-2008-3106)

  - A buffer overflow vulnerability was found in the font     processing code. This allowed remote attackers to extend     the permissions of an untrusted applet or application,     allowing it to read and/or write local files, as well as     to execute local applications accessible to the user     running the untrusted application. (CVE-2008-3108)

  - Several buffer overflow vulnerabilities in Java Web     Start were reported. These vulnerabilities allowed an     untrusted Java Web Start application to elevate its     privileges, allowing it to read and/or write local     files, as well as to execute local applications     accessible to the user running the untrusted     application. (CVE-2008-3111)

  - Two file processing vulnerabilities in Java Web Start     were found. A remote attacker, by means of an untrusted     Java Web Start application, was able to create or delete     arbitrary files with the permissions of the user running     the untrusted application. (CVE-2008-3112 /     CVE-2008-3113)

  - A vulnerability in Java Web Start when processing     untrusted applications was reported. An attacker was     able to acquire sensitive information, such as the cache     location. (CVE-2008-3114)

This release also reinstates previous Crypto Export policy jars lost between SR3 and SR8.

IBM Java 5 was updated to SR8 to fix various security issues :

  - Multiple vulnerabilities with unsigned applets were     reported. A remote attacker could misuse an unsigned     applet to connect to localhost services running on the     host running the applet. (CVE-2008-3104)

  - A vulnerability in the XML processing API was found. A     remote attacker who caused malicious XML to be processed     by an untrusted applet or application was able to     elevate permissions to access URLs on a remote host.
    (CVE-2008-3106)

  - A buffer overflow vulnerability was found in the font     processing code. This allowed remote attackers to extend     the permissions of an untrusted applet or application,     allowing it to read and/or write local files, as well as     to execute local applications accessible to the user     running the untrusted application. (CVE-2008-3108)

  - Several buffer overflow vulnerabilities in Java Web     Start were reported. These vulnerabilities allowed an     untrusted Java Web Start application to elevate its     privileges, allowing it to read and/or write local     files, as well as to execute local applications     accessible to the user running the untrusted     application. (CVE-2008-3111)

  - Two file processing vulnerabilities in Java Web Start     were found. A remote attacker, by means of an untrusted     Java Web Start application, was able to create or delete     arbitrary files with the permissions of the user running     the untrusted application. (CVE-2008-3112 /     CVE-2008-3113)

  - A vulnerability in Java Web Start when processing     untrusted applications was reported. An attacker was     able to acquire sensitive information, such as the cache     location. (CVE-2008-3114)

Sun Java was updated to 1.4.2u18 to fix following security vulnerabilities :

CVE-2008-3114: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074. 

CVE-2008-3113: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077. 

CVE-2008-3112: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via an untrusted application, aka CR 6703909. 

CVE-2008-3111: Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs, aka CR 6557220.

CVE-2008-3108: Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing. 

CVE-2008-3107: Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVE-2008-3104: Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.

The version of Sun Java Runtime Environment (JRE) 6.0 installed on the remote host is affected by multiple security issues :

  - A vulnerability in the JRE could allow unauthorized     access to certain URL resources or cause a denial of     service condition while processing XML data. In order to     successfully exploit this issue a JAX-WS client/service     included with a trusted application should process the     malicious XML content (238628).

  - A vulnerability in the JRE may allow an untrusted applet     to access information from another applet (238687).

  - A buffer overflow vulnerability in Java Web Start could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start, could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start, may disclose the     location of Java Web Start cache (238905).

  - An implementation defect in the JRE may allow an applet     designed to run 'only' on JRE 5.0 Update 6 or later may     run on older releases of the JRE. Note this only affects     Windows Vista releases of the JRE (238966).

  - Vulnerability in Sun Java Management Extensions (JMX)     could allow a JMX client running on a remote host to     perform unauthorized actions on a host running JMX with     local monitoring enabled (238965).

  - A vulnerability in the JRE could allow an untrusted     applet / application to elevate its privileges to read,     write and execute local applications with privileges of     the user running an untrusted applet (238967,238687).

  - A vulnerability in the JRE may allow an untrusted applet     to establish connections to services running on the     localhost and potentially exploit vulnerabilities     existing in the underlying JRE (238968).

The version of Sun Java Runtime Environment (JRE) 5.0 installed on the remote host is affected by multiple security issues :

- A vulnerability in the XML processing module of the JRE could allow   an untrusted applet/application unauthorized access to certain URL   resources (238628).

- A buffer overflow vulnerability in font processing module of the JRE,   could allow an untrusted applet/application to elevate its privileges   to read, write and execute local applications with privileges of the   user running an untrusted applet (238666). Note this issue only affects   Sun Java JDK/JRE 5 Update 9 and earlier.

- A buffer overflow vulnerability in Java Web Start, could allow an   untrusted applet to elevate its privileges to read, write and   execute local applications available to user running an untrusted   application (238905).

- A vulnerability in Java Web Start, could allow an untrusted   application to create or delete arbitrary files subject to   the privileges of the user running the application (238905).

- A vulnerability in Java Web Start, may disclose the location of   Java Web Start cache (238905).

- Vulnerability in Sun Java Management Extensions (JMX) could allow a   JMX client running on a remote host to perform unauthorized actions   on a host running JMX with local monitoring enabled (238965).

- An implementation defect in the JRE, may allow an applet designed to run   'only' on JRE 5.0 Update 6 or later may run on older releases of the JRE.
  Note this only affects Windows Vista releases of the JRE (238966).

- A vulnerability in the JRE could allow an untrusted applet/application   to elevate its privileges to read, write and execute local applications   with privileges of the user running an untrusted applet (238967).

- A vulnerability in the JRE may allow an untrusted applet to establish   connections to services running on the localhost and potentially   exploit vulnerabilities existing in the underlying JRE (238968).

The version of Sun Java Runtime Environment (JRE) J2SE 1.4.2 installed on the remote host is affected by multiple security issues :

  - A buffer overflow vulnerability in font processing     module of the JRE could allow an untrusted     applet/application to elevate its privilege to read,     write and execute local applications with privileges of     the user running an untrusted applet (238666). 

  - A vulnerability in the JRE could allow an untrusted     applet/application to elevate its privileges to read,     write and execute local applications with privileges of     the user running an untrusted applet (238967).

  - A buffer overflow vulnerability in Java Web Start could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start, could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start, may disclose the     location of Java Web Start cache (238905).

  - A vulnerability in the JRE may allow an untrusted applet     to establish connections to services running on the     localhost and potentially exploit vulnerabilities     existing in the underlying JRE (238968).

  - It should be noted that J2SE 1.4.2 is in its EOL period,     and the transition is set to complete on Oct 30th 2008.     Please refer to See also section for more details.

ID	Name	Product	Family	Severity
69874	Juniper NSM Servers Multiple Java JDK/JRE Vulnerabilities (PSN-2012-08-689)	Nessus	Misc.	critical
64833	Sun Java JDK/JRE 6 < Update 7 Multiple Vulnerabilities (Unix)	Nessus	Misc.	critical
64832	Sun Java JDK/JRE 5 < Update 16 Multiple Vulnerabilities (Unix)	Nessus	Misc.	critical
64817	Sun Java J2SE 1.4.2 < Update 18 Multiple Vulnerabilities (Unix)	Nessus	Misc.	critical
60440	Scientific Linux Security Update : java (jdk 1.5.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43841	RHEL 4 : Sun Java Runtime in Satellite Server (RHSA-2008:0636)	Nessus	Red Hat Local Security Checks	critical
42834	GLSA-200911-02 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
41224	SuSE9 Security Update : Java2 (YOU Patch Number 12206)	Nessus	SuSE Local Security Checks	critical
40725	RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2008:0790)	Nessus	Red Hat Local Security Checks	critical
40723	RHEL 4 / 5 : java-1.5.0-sun (RHSA-2008:0595)	Nessus	Red Hat Local Security Checks	critical
40383	VMSA-2008-0016 : VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues	Nessus	VMware ESX Local Security Checks	critical
40001	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-97)	Nessus	SuSE Local Security Checks	critical
39996	openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-96)	Nessus	SuSE Local Security Checks	critical
34291	Mac OS X : Java for Mac OS X 10.4 Release 7	Nessus	MacOS X Local Security Checks	high
34290	Mac OS X : Java for Mac OS X 10.5 Update 2	Nessus	MacOS X Local Security Checks	high
34200	SuSE 10 Security Update : IBM Java 1.5 (ZYPP Patch Number 5591)	Nessus	SuSE Local Security Checks	critical
34072	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 5557)	Nessus	SuSE Local Security Checks	critical
34038	openSUSE 10 Security Update : java-1_6_0-sun (java-1_6_0-sun-5435)	Nessus	SuSE Local Security Checks	critical
34037	openSUSE 10 Security Update : java-1_5_0-sun (java-1_5_0-sun-5434)	Nessus	SuSE Local Security Checks	critical
34036	SuSE 10 Security Update : Java 1.4.2 (ZYPP Patch Number 5431)	Nessus	SuSE Local Security Checks	critical
34035	openSUSE 10 Security Update : java-1_4_2-sun (java-1_4_2-sun-5430)	Nessus	SuSE Local Security Checks	critical
33488	Sun Java JDK/JRE 6 < Update 7 Multiple Vulnerabilities	Nessus	Windows	high
33487	Sun Java JDK/JRE 5 < Update 16 Multiple Vulnerabilities	Nessus	Windows	high
33486	Sun Java J2SE 1.4.2 < Update 18 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2008-3111

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

high

high

high