Name: CVE-2008-5358 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5358 Reference: IDEFENSE:20081204 Sun Java Web Start GIF Decoding Memory Corruption Vulnerability Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=758 Reference: SUNALERT:244987 Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-244987-1 Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier might allow remote attackers to execute arbitrary code via a crafted GIF file that triggers memory corruption during display of the splash screen, possibly related to splashscreen.dll.
java-1.6.0-openjdk-1.6.0.0-0.20.b09.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
java-1.6.0-openjdk-1.6.0.0-7.b12.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
Another mention of this issue: http://secunia.com/advisories/32991/ (Point 3) ).
This issue has been addressed in following products: Extras for RHEL 4 Extras for Red Hat Enterprise Linux 5 Via RHSA-2009:0369 https://rhn.redhat.com/errata/RHSA-2009-0369.html
This was addressed via: Red Hat Enterprise Linux version 4 Extras (java-1.6.0-sun) RHSA-2008:1018 RHEL Supplementary version 5 (java-1.6.0-sun) RHSA-2008:1018 Red Hat Enterprise Linux version 4 Extras (java-1.6.0-ibm) RHSA-2009:0369 RHEL Supplementary version 5 (java-1.6.0-ibm) RHSA-2009:0369