Bug 454603 (CVE-2008-3109) - CVE-2008-3109 CVE-2008-3110 Security Vulnerabilities in the Java Runtime Environment Scripting Language Support (6529568, 6529579)
Summary: CVE-2008-3109 CVE-2008-3110 Security Vulnerabilities in the Java Runtime Envi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-3109
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://sunsolve.sun.com/search/docume...
Whiteboard:
Depends On: 454628 462076 462486 475760 475819
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-07-09 10:33 UTC by Marc Schoenefeld
Modified: 2019-09-29 12:25 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-20 21:57:27 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0594 0 normal SHIPPED_LIVE Critical: java-1.6.0-sun security update 2008-07-14 15:32:09 UTC
Red Hat Product Errata RHSA-2008:0906 0 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2008-10-24 14:44:07 UTC
Red Hat Product Errata RHSA-2008:1045 0 normal SHIPPED_LIVE Important: java-1.6.0-bea security update 2008-12-18 18:33:38 UTC

Description Marc Schoenefeld 2008-07-09 10:33:49 UTC 
A vulnerability in the Java Runtime Environment relating to scripting language
support may allow an untrusted applet or application to elevate its privileges.
For example, an untrusted applet may grant itself permissions to read and write
local files or execute local applications that are accessible to the user
running the untrusted applet.

A second vulnerability in the Java Runtime Environment relating to scripting
language support may allow an untrusted applet to access information from
another applet.
Comment 6 Vincent Danen 2010-12-20 21:57:27 UTC 
This issue has been addressed via:

RHEL Supplementary version 5 (RHSA-2008:0594 (java-1.6.0-sun) and RHSA-2008:0906 (java-1.6.0-ibm))
Red Hat Enterprise Linux version 4 Extras (RHSA-2008:0906)
Note You need to log in before you can comment on or make changes to this bug.