Bug 575747 (CVE-2010-0085) - CVE-2010-0085 OpenJDK File TOCTOU deserialization vulnerability (6736390)
Summary: CVE-2010-0085 OpenJDK File TOCTOU deserialization vulnerability (6736390)
Keywords:
Status: NEW
Alias: CVE-2010-0085
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 594679 618146 618147 618148 618196 618246 618971
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-03-22 10:33 UTC by Marc Schoenefeld
Modified: 2019-09-29 12:35 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0337 normal SHIPPED_LIVE Critical: java-1.6.0-sun security update 2010-04-01 00:21:33 UTC
Red Hat Product Errata RHSA-2010:0338 normal SHIPPED_LIVE Critical: java-1.5.0-sun security update 2010-04-01 04:04:18 UTC
Red Hat Product Errata RHSA-2010:0339 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security update 2010-04-01 00:14:40 UTC
Red Hat Product Errata RHSA-2010:0383 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2010-04-29 17:49:44 UTC
Red Hat Product Errata RHSA-2010:0471 normal SHIPPED_LIVE Low: Red Hat Network Satellite Server IBM Java Runtime security update 2010-06-14 23:23:31 UTC
Red Hat Product Errata RHSA-2010:0574 normal SHIPPED_LIVE Critical: java-1.4.2-ibm security update 2010-07-29 16:40:02 UTC
Red Hat Product Errata RHSA-2010:0586 normal SHIPPED_LIVE Moderate: java-1.4.2-ibm-sap security update 2010-08-02 20:44:00 UTC

Comment 1 Murray McAllister 2010-03-31 15:08:24 UTC
The java.io.File class did not ensure that the deserialized value of the
"path" field is the value later used. This could be used to bypass file access
restrictions.

Comment 3 errata-xmlrpc 2010-04-01 00:14:59 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0339 https://rhn.redhat.com/errata/RHSA-2010-0339.html

Comment 4 errata-xmlrpc 2010-04-01 00:21:47 UTC
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0337 https://rhn.redhat.com/errata/RHSA-2010-0337.html

Comment 5 errata-xmlrpc 2010-04-01 02:57:00 UTC
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5
  Supplementary for RHEL 5.2.z
  Supplementary for RHEL 5.3.z

Via RHSA-2010:0338 https://rhn.redhat.com/errata/RHSA-2010-0338.html

Comment 6 Fedora Update System 2010-04-06 16:33:42 UTC
java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-34.b17.fc11

Comment 7 Fedora Update System 2010-04-06 16:36:10 UTC
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc12

Comment 8 Fedora Update System 2010-04-07 07:10:05 UTC
java-1.6.0-openjdk-1.6.0.0-36.b17.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-36.b17.fc13

Comment 9 Fedora Update System 2010-04-09 01:27:08 UTC
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2010-04-09 01:30:46 UTC
java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2010-04-09 06:56:57 UTC
java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc13

Comment 12 Fedora Update System 2010-04-09 21:05:14 UTC
java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 errata-xmlrpc 2010-04-29 17:49:49 UTC
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0383 https://rhn.redhat.com/errata/RHSA-2010-0383.html

Comment 15 errata-xmlrpc 2010-06-14 23:23:43 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.3

Via RHSA-2010:0471 https://rhn.redhat.com/errata/RHSA-2010-0471.html

Comment 20 errata-xmlrpc 2010-07-29 16:40:41 UTC
This issue has been addressed in following products:

  Extras for RHEL 3
  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0574 https://rhn.redhat.com/errata/RHSA-2010-0574.html

Comment 21 errata-xmlrpc 2010-08-02 20:44:32 UTC
This issue has been addressed in following products:

  RHEL 4 for SAP
  RHEL 5 for SAP

Via RHSA-2010:0586 https://rhn.redhat.com/errata/RHSA-2010-0586.html


Note You need to log in before you can comment on or make changes to this bug.