[Forgot Password]
Login  Register Subscribe

23631

 
 

122183

 
 

98060

 
 

909

 
 

79198

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

MDVSA-2009:209 -- Mandriva java-1.6.0-openjdk

ID: oval:org.secpod.oval:def:300474Date: (C)2012-01-07   (M)2017-10-04
Class: PATCHFamily: unix




Multiple Java OpenJDK security vulnerabilities has been identified and fixed: The design of the W3C XML Signature Syntax and Processing recommendation specifies an HMAC truncation length but does not require a minimum for its length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits . The Java Web Start framework does not properly check all application jar files trust and this allows context-dependent attackers to execute arbitrary code via a crafted application, related to NetX . Some variables and data structures without the final keyword definition allows context-depend attackers to obtain sensitive information. The target variables and data structures are stated as follow: LayoutQueue, Cursor.predefined, AccessibleResourceBundle.getContents, ImageReaderSpi.STANDARD_INPUT_TYPE, ImageWriterSpi.STANDARD_OUTPUT_TYPE, the imageio plugins, DnsContext.debug, RmfFileReader/StandardMidiFileWriter.types, AbstractSaslImpl.logger, Synth.Region.uiToRegionMap/lowerCaseNameMap, the Introspector class and a cache of BeanInfo, and JAX-WS . The Java Management Extensions implementation does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object . A flaw in the Xerces2 as used in OpenJDK allows remote attackers to cause denial of service via a malformed XML input . The audio system does not prevent access to java.lang.System properties either by untrusted applets and Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties . A flaw in the SOCKS proxy implementation allows remote attackers to discover the user name of the account that invoked either an untrusted applet or Java Web Start application via unspecified vectors . A flaw in the proxy mechanism implementation allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lacks the final keyword . An integer overflow in the JPEG images parsing allows context-dependent attackers to gain privileges via an untrusted Java Web Start application that grants permissions to itself . An integer overflow in the unpack200 utility decompression allows context-dependent attackers to gain privileges via vectors involving either an untrusted applet or Java Web Start application that grants permissions to itself . A flaw in the JDK13Services.getProviders grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions either via an untrusted applet or application . A flaw in the OpenJDK"s encoder, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information either via an untrusted applet or application .

Platform:
Mandriva Linux 2009.0
Mandriva Linux 2009.1
Product:
java-1.6.0-openjdk
Reference:
MDVSA-2009:209
CVE-2009-2690
CVE-2009-2689
CVE-2009-2675
CVE-2009-2674
CVE-2009-2673
CVE-2009-2671
CVE-2009-2670
CVE-2009-2625
CVE-2009-2476
CVE-2009-2475
CVE-2009-1896
CVE-2009-0217
CVE    12
CVE-2009-1896
CVE-2009-0217
CVE-2009-2689
CVE-2009-2476
...
CPE    1
cpe:/o:mandriva:linux:2009.0

© 2013 SecPod Technologies