Red Hat Security Advisory

RHSA-2008:0186

java-1.5.0-sun security update

Released 2008-03-06 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 4 Extras java-1.5.0-sun-1.5.0.15-1jpp.2.el4, java-1.5.0-sun-1.5.0.15-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.15-1jpp.2.el4 +8
Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-sun-1.5.0.15-1jpp.2.el4, java-1.5.0-sun-1.5.0.15-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.15-1jpp.2.el4 +8
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-sun-1.5.0.15-1jpp.2.el5, java-1.5.0-sun-1.5.0.15-1jpp.2.el5.i586, java-1.5.0-sun-demo-1.5.0.15-1jpp.2.el5 +8
Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-sun-1.5.0.15-1jpp.2.el4, java-1.5.0-sun-1.5.0.15-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.15-1jpp.2.el4 +8
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-sun-1.5.0.15-1jpp.2.el5, java-1.5.0-sun-1.5.0.15-1jpp.2.el5.i586, java-1.5.0-sun-demo-1.5.0.15-1jpp.2.el5 +8
Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-sun-1.5.0.15-1jpp.2.el4, java-1.5.0-sun-1.5.0.15-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.15-1jpp.2.el4 +8

Fixes 11 records

TI-2008-01142 CVE-2008-1190 · GHSA-m6g6-6pj7-xcc2

Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier…

MEDIUM 57

Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an untrusted application,…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.16899 Published 2008-03-06 Fixed CWE-264

TI-2008-01145 CVE-2008-1193 · GHSA-85h9-hqf9-8hc6

Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK…

MEDIUM 54

Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted applicatio…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.12501 Published 2008-03-06 Fixed CWE-264

TI-2008-01140 CVE-2008-1188 · GHSA-x67m-cmr9-2j82

Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK…

MEDIUM 54

Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.1248 Published 2008-03-06 Fixed CWE-119

TI-2008-01147 CVE-2008-1195 · GHSA-hqpc-pj99-85gx

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and…

MEDIUM 49

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network serv…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05684 Published 2008-03-06 Fixed CWE-254

TI-2008-01138 CVE-2008-1186 · GHSA-vcxm-855r-p3hv

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE)…

MEDIUM 49

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and earlier, allows remote attackers to gain privileges via an untrusted app…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05556 Published 2008-03-06 Fixed CWE-264

TI-2008-01137 CVE-2008-1185 · GHSA-5568-r9mj-gq7m

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE)…

MEDIUM 49

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileg…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0563 Published 2008-03-06 Fixed CWE-264

TI-2008-01148 CVE-2008-1196 · GHSA-qjqr-g4rx-gjw2

Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4…

MEDIUM 40

Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to execute arbitrary code…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.07255 Published 2008-03-06 Fixed CWE-119

TI-2008-01141 CVE-2008-1189 · GHSA-hppm-r8m5-wmwp

Buffer overflow in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update…

MEDIUM 40

Buffer overflow in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.07186 Published 2008-03-06 Fixed CWE-119

TI-2008-01139 CVE-2008-1187 · GHSA-8m64-fhc9-rr82

Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and…

LOW 38

Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash)…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05422 Published 2008-03-06 Fixed CWE-264

TI-2008-01144 CVE-2008-1192 · GHSA-p6r7-6fjq-fqmc

Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier…

LOW 37

Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier, and 1.3.1_21 and earlier; allows remote attackers to bypass t…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04458 Published 2008-03-06 Fixed CWE-254

TI-2008-01146 CVE-2008-1194 · GHSA-9778-59qc-w9g9

Multiple unspecified vulnerabilities in the color management library in Sun JDK and JRE 6…

LOW 27

Multiple unspecified vulnerabilities in the color management library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to cause a denial of service (crash) via unknown vect…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04234 Published 2008-03-06 Fixed