Red Hat Security Advisory

RHSA-2009:1038

java-1.5.0-ibm security update

Released 2009-05-18 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 4 Extras java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4, java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.9-1jpp.5.el4 +9
Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4, java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4.i386, java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4.ppc +17
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.9-1jpp.3.el5, java-1.5.0-ibm-1:1.5.0.9-1jpp.3.el5.i386, java-1.5.0-ibm-accessibility-1:1.5.0.9-1jpp.3.el5 +11
Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4, java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.9-1jpp.5.el4 +9
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.9-1jpp.3.el5, java-1.5.0-ibm-1:1.5.0.9-1jpp.3.el5.i386, java-1.5.0-ibm-1:1.5.0.9-1jpp.3.el5.ppc +20
Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4, java-1.5.0-ibm-1:1.5.0.9-1jpp.5.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.9-1jpp.5.el4 +9

Fixes 14 records

TI-2009-01050 CVE-2009-1096 · GHSA-67c2-9w2r-cg77

Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime…

MEDIUM 54

Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code v…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.08233 Published 2009-03-25 Fixed CWE-119

TI-2009-01049 CVE-2009-1095 · GHSA-86hj-mfgv-6432

Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime…

MEDIUM 53

Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07099 Published 2009-03-25 Fixed CWE-189

TI-2009-01052 CVE-2009-1098 · GHSA-97w6-6433-7ccq

Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0…

MEDIUM 50

Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access fil…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06787 Published 2009-03-25 Fixed CWE-119

TI-2009-01051 CVE-2009-1097 · GHSA-q7x4-hch5-5w3x

Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment…

MEDIUM 50

Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that trig…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07089 Published 2009-03-25 Fixed CWE-119

TI-2009-01048 CVE-2009-1094 · GHSA-5w5h-m7x5-fq48

Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and…

MEDIUM 50

Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04389 Published 2009-03-25 Fixed

TI-2009-01053 CVE-2009-1099 · GHSA-6g46-c364-qcjc

Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment…

MEDIUM 41

Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via c…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0566 Published 2009-03-25 Fixed CWE-189

TI-2009-01059 CVE-2009-1105 · GHSA-q538-87mq-rwpp

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6…

LOW 39

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be us…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03558 Published 2009-03-25 Fixed

TI-2009-01057 CVE-2009-1103 · GHSA-4hqw-69p6-5rh9

Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java…

LOW 36

Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.04519 Published 2009-03-25 Fixed

TI-2009-01060 CVE-2009-1106 · GHSA-wfxj-4rq5-wv9c

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6…

LOW 35

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrict…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03558 Published 2009-03-25 Fixed CWE-20

TI-2009-01058 CVE-2009-1104 · GHSA-pqph-446w-r3p4

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0…

LOW 30

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localh…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.02165 Published 2009-03-25 Fixed CWE-16

TI-2009-01055 CVE-2009-1101 · GHSA-84rr-q55c-9hm6

Unspecified vulnerability in the lightweight HTTP server implementation in Java SE…

LOW 29

Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (pr…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03584 Published 2009-03-25 Fixed

TI-2009-01054 CVE-2009-1100 · GHSA-mh7w-frv3-83jh

Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime…

LOW 29

Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service (disk c…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03584 Published 2009-03-25 Fixed

TI-2009-01047 CVE-2009-1093 · GHSA-4qmv-gqgr-jxhq

LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment…

LOW 29

LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not clos…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03381 Published 2009-03-25 Fixed CWE-16

TI-2009-01061 CVE-2009-1107 · GHSA-xx8v-jwch-cjrx

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6…

LOW 25

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a signed applet via unkno…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02799 Published 2009-03-25 Fixed