Bug 676005 – CVE-2010-4470 OpenJDK JAXP untrusted component state manipulation (6927050)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 676005 - (CVE-2010-4470) CVE-2010-4470 OpenJDK JAXP untrusted component state manipulation (6927050)

Summary:	CVE-2010-4470 OpenJDK JAXP untrusted component state manipulation (6927050)

Status:	CLOSED ERRATA

Aliases:	CVE-2010-4470

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,source=oracle,public=...
Keywords:	Security

Depends On:	676274 676275 676276 676277 676694 676695 676696
Blocks:
	Show dependency tree / graph

Reported:	2011-02-08 10:27 EST by Marc Schoenefeld
Modified:	2015-08-19 05:04 EDT (History)
CC List:	8 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-09-09 02:43:53 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0281	normal	SHIPPED_LIVE	Important: java-1.6.0-openjdk security update	2011-02-17 13:15:12 EST
Red Hat Product Errata	RHSA-2011:0282	normal	SHIPPED_LIVE	Critical: java-1.6.0-sun security update	2011-02-17 13:13:17 EST

Groups: None (edit)

Comment 4 Jan Lieskovsky 2011-02-17 12:03:19 EST

A flaw was found in the way JAXP (Java API for XML Processing) components were
handled, allowing them to be manipulated by untrusted applets. This could be
used to elevate privileges and bypass secure XML processing restrictions.

Comment 5 errata-xmlrpc 2011-02-17 13:13:53 EST

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6
  Extras for RHEL 4

Via RHSA-2011:0282 https://rhn.redhat.com/errata/RHSA-2011-0282.html

Comment 6 errata-xmlrpc 2011-02-17 13:15:34 EST

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:0281 https://rhn.redhat.com/errata/RHSA-2011-0281.html

Note You need to log in before you can comment on or make changes to this bug.