Bug 675984 (CVE-2010-4465)

Summary:	CVE-2010-4465 OpenJDK Swing timer-based security manager bypass (6907662)
Product:	[Other] Security Response	Reporter:	Marc Schoenefeld <mschoene>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ahughes, aph, dbhole, jlieskov, jvanek, mjc, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-09 02:23:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	676274, 676275, 676276, 676277, 676694, 676695, 676696, 684826, 684827, 684828, 688226, 688227, 688228, 701980, 701981
Bug Blocks:	712887

Comment 2 Jan Lieskovsky 2011-02-17 16:58:34 UTC

A flaw was found in the Swing library. Forged TimerEvents could be used to
bypass SecurityManager checks, allowing access to otherwise blocked files and
directories.

Comment 3 errata-xmlrpc 2011-02-17 18:13:49 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6
  Extras for RHEL 4

Via RHSA-2011:0282 https://rhn.redhat.com/errata/RHSA-2011-0282.html

Comment 4 errata-xmlrpc 2011-02-17 18:15:32 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:0281 https://rhn.redhat.com/errata/RHSA-2011-0281.html

Comment 6 errata-xmlrpc 2011-03-16 12:37:53 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5
  Extras for RHEL 4

Via RHSA-2011:0357 https://rhn.redhat.com/errata/RHSA-2011-0357.html

Comment 8 errata-xmlrpc 2011-03-17 19:15:17 UTC

This issue has been addressed in following products:

  Extras for RHEL 4
  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2011:0364 https://rhn.redhat.com/errata/RHSA-2011-0364.html

Comment 10 errata-xmlrpc 2011-05-05 17:44:38 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Extras for RHEL 4

Via RHSA-2011:0490 https://rhn.redhat.com/errata/RHSA-2011-0490.html

Comment 11 errata-xmlrpc 2011-06-15 09:56:08 UTC

This issue has been addressed in following products:

  RHEL 4 for SAP
  RHEL 5 for SAP
  RHEL 6 for SAP

Via RHSA-2011:0870 https://rhn.redhat.com/errata/RHSA-2011-0870.html

Comment 12 errata-xmlrpc 2011-06-16 19:21:54 UTC

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2011:0880 https://rhn.redhat.com/errata/RHSA-2011-0880.html