TITLE: Sun JRE Applet Handling Two Vulnerabilities SECUNIA ADVISORY ID: SA28795 VERIFY ADVISORY: http://secunia.com/advisories/28795/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Sun Java JDK 1.5.x http://secunia.com/product/4621/ Sun Java JDK 1.6.x http://secunia.com/product/14273/ Sun Java JRE 1.5.x / 5.x http://secunia.com/product/4228/ Sun Java JRE 1.6.x / 6.x http://secunia.com/product/12878/ DESCRIPTION: Two vulnerabilities have been reported in Sun JRE, which can be exploited by malicious people to compromise a user's system. The vulnerabilities are caused due to unspecified errors within the handling of Java applets. These can be exploited by malicious, untrusted applets to read and write local files, or to execute local applications. The vulnerabilities are reported in the following products (for Windows, Solaris, and Linux): * JDK and JRE 6 Update 1 and earlier * JDK and JRE 5.0 Update 13 and earlier SOLUTION: Update to the latest versions or apply patches. JDK and JRE 6 Update 2 or later: http://java.sun.com/javase/downloads/index.jsp JDK and JRE 5.0 Update 14 or later: http://java.sun.com/javase/downloads/index_jdk5.jsp -- Java SE 6 -- Java SE 6 update 2 (as patch 125136-02 or later) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125136-02-1 Java SE 6 update 2 (as patch 125137-02 or later (64bit)) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125137-02-1 Java SE 6_x86 update 2 (as patch 125138-02 or later) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125138-02-1 Java SE 6_x86 update 2 (as patch 125139-02 or later (64bit)) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125139-02-1 -- For J2SE 5.0 -- J2SE 5.0 update 14 (as patch 118666-15 or later) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118666-15-1 J2SE 5.0 update 14 (as patch 118667-15 or later (64bit)) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118667-15-1 J2SE 5.0_x86 update 14 (as patch 118668-15 or later) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118668-15-1 J2SE 5.0_x86 update 14 (as patch 118669-15 or later (64bit)) http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118669-15-1 PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://sunsolve.sun.com/search/document.do?assetkey=1-66-231261-1 ========================= The list's FAQ's can be seen by sending an email to PCWorks-request@xxxxxxxxxxxxx with FAQ in the subject line. To unsubscribe, subscribe, set Digest or Vacation to on or off, go to //www.freelists.org/list/pcworks . You can also send an email to PCWorks-request@xxxxxxxxxxxxx with Unsubscribe in the subject line. Your member list settings can be found at //www.freelists.org/cgi-bin/lsg2.cgi/l=pcworks . Once logged in, you have access to numerous other email options. The list archives are located at //www.freelists.org/archives/pcworks/ . All email posted to the list will be placed there in the event anyone needs to look for previous posts.