j2sdk

Page content
  • Author: Miklos Vajna
  • Vulnerable: 6-21
  • Unaffected: 6-22locris1

Multiple vulnerabilities have been reported in Sun Java, where some have an unknown impact and others can be exploited by malicious people to manipulate certain data, disclose potentially sensitive information, cause a DoS (Denial of Service), or compromise a vulnerable system.

  1. An error in the implementation of the “HeadspaceSoundbank” class can be exploited to cause a stack-based buffer overflow via a crafted Soundbank file with an overly long name.
  2. An error in the implementation of the “HeadspaceSoundbank” class can be exploited to cause a heap-based buffer overflow via a crafted Soundbank file with an overly long record.
  3. An input validation error in the processing of image files can be exploited to cause a heap-based buffer overflow, e.g. if a user visits a web page containing a specially crafted java applet. Successful exploitation of these vulnerabilities allows execution of arbitrary code.
  4. Unspecified vulnerabilities exist in the ImageIO, Java 2D, Java Runtime Environment, Java Web Start, Java Plug-in, Pack200, Sound, and HotSpot Server components.
  5. An error in the JSSE component while handling TLS session re-negotiations can be exploited to manipulate certain data.
  6. An unspecified error in the Java Web Start, Java Plug-in component can be exploited to manipulate certain data or cause a DoS.
  7. Two unspecified errors in the Java Runtime Environment can be exploited to disclose unspecified information.
  8. An unspecified error in the Java Web Start, Java Plug-in component can be exploited to cause a DoS.

CVEs: