Bug 253488 – CVE-2007-4381 java: Vulnerability in the font parsing code

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 253488 - (CVE-2007-4381) CVE-2007-4381 java: Vulnerability in the font parsing code

Summary:	CVE-2007-4381 java: Vulnerability in the font parsing code

Status:	CLOSED ERRATA

Aliases:	CVE-2007-4381

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	reported=20070815,source=sunalert,pub...
Keywords:	Security

Depends On:	325951 325961 368071 368081 368091 417931 430799
Blocks:
	Show dependency tree / graph

Reported:	2007-08-20 03:48 EDT by Marc Schoenefeld
Modified:	2013-04-12 00:56 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2013-04-12 00:56:32 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2007:0956	normal	SHIPPED_LIVE	Moderate: java-1.5.0-bea security update	2007-10-16 03:08:21 EDT
Red Hat Product Errata	RHSA-2007:1086	normal	SHIPPED_LIVE	Moderate: java-1.4.2-bea security update	2007-12-12 07:27:35 EST
Red Hat Product Errata	RHSA-2008:0100	normal	SHIPPED_LIVE	Moderate: java-1.4.2-bea security update	2008-03-11 10:09:38 EDT
Red Hat Product Errata	RHSA-2008:0132	normal	SHIPPED_LIVE	Critical: java-1.4.2-ibm security update	2008-02-14 09:46:54 EST

Groups: None (edit)

Description Marc Schoenefeld 2007-08-20 03:48:31 EDT

Sun describes a flaw at

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103024-1:

A vulnerability in the font parsing code in the Java Runtime Environment may
allow an untrusted applet to elevate its privileges. For example, an applet may
grant itself permissions to read and write local files or execute local
applications that are accessible to the user running the untrusted applet.

Comment 8 Jan Lieskovsky 2010-08-31 09:40:38 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux version 4 Extras
  RHEL Supplementary version 5

Via RHSA-2007:0829 https://rhn.redhat.com/errata/RHSA-2007-0829.html

Comment 9 Jan Lieskovsky 2010-08-31 09:41:41 EDT

This issue has been addressed in following products:

  RHEL Supplementary version 5

Via RHSA-2007:0956 https://rhn.redhat.com/errata/RHSA-2007-0956.html

Comment 10 Jan Lieskovsky 2010-08-31 09:42:53 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux version 4 Extras 

Via RHSA-2007:1086 https://rhn.redhat.com/errata/RHSA-2007-1086.html

Comment 11 Jan Lieskovsky 2010-08-31 09:43:53 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux version 3 Extras

Via RHSA-2008:0100 https://rhn.redhat.com/errata/RHSA-2008-0100.html

Comment 12 Jan Lieskovsky 2010-08-31 09:45:24 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux version 3 Extras
  Red Hat Enterprise Linux version 4 Extras
  RHEL Supplementary version 5

Via RHSA-2008:0132 https://rhn.redhat.com/errata/RHSA-2008-0132.html

Note You need to log in before you can comment on or make changes to this bug.