Part of http://www.securityfocus.com/bid/28083/discuss (1/7) Sun Java SE March 2008 Advance Notification of Multiple Vulnerabilities Sun has released an advance notification for security updates for Java SE. The notification indicates that seven advisories addressing multiple vulnerabilities will be released on March 4, 2008. The issues affect the following: JDK and JRE 6 Update 5 JDK and JRE 5.0 Update 15 SDK and JRE 1.4.2_17 SDK and JRE 1.3.1_22 The following Sun Alerts corresponding to these updates will be released after the updates are available: 2233321 2233322 2233323 2233324 2233325 2233326 2233327
A security vulnerability in the Java Runtime Environment (JRE) with the processing of XSLT transformations may allow an untrusted applet or application that is downloaded from a website to elevate its privileges. For example, an applet may read certain unauthorized URL resources (such as some files and web pages) or potentially execute arbitrary code. This vulnerability may also be exploited to create a Denial-of-Service (DoS) condition by causing the JRE to crash.
Please refer to https://access.redhat.com/security/cve/CVE-2008-1187 for a list of platforms and errata that correct this flaw.