Bug 454603 (CVE-2008-3109)

Summary:	CVE-2008-3109 CVE-2008-3110 Security Vulnerabilities in the Java Runtime Environment Scripting Language Support (6529568, 6529579)
Product:	[Other] Security Response	Reporter:	Marc Schoenefeld <mschoene>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	kreilly
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-20 21:57:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	454628, 462076, 462486, 475760, 475819
Bug Blocks:

Description Marc Schoenefeld 2008-07-09 10:33:49 UTC

A vulnerability in the Java Runtime Environment relating to scripting language
support may allow an untrusted applet or application to elevate its privileges.
For example, an untrusted applet may grant itself permissions to read and write
local files or execute local applications that are accessible to the user
running the untrusted applet.

A second vulnerability in the Java Runtime Environment relating to scripting
language support may allow an untrusted applet to access information from
another applet.

Comment 6 Vincent Danen 2010-12-20 21:57:27 UTC

This issue has been addressed via:

RHEL Supplementary version 5 (RHSA-2008:0594 (java-1.6.0-sun) and RHSA-2008:0906 (java-1.6.0-ibm))
Red Hat Enterprise Linux version 4 Extras (RHSA-2008:0906)