Bug 575747 (CVE-2010-0085) - CVE-2010-0085 OpenJDK File TOCTOU deserialization vulnerability (6736390)
Summary: CVE-2010-0085 OpenJDK File TOCTOU deserialization vulnerability (6736390)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-0085
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 594679 618146 618147 618148 618196 618246 618971
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-03-22 10:33 UTC by Marc Schoenefeld
Modified: 2021-10-19 09:11 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-19 09:11:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0337 0 normal SHIPPED_LIVE Critical: java-1.6.0-sun security update 2010-04-01 00:21:33 UTC
Red Hat Product Errata RHSA-2010:0338 0 normal SHIPPED_LIVE Critical: java-1.5.0-sun security update 2010-04-01 04:04:18 UTC
Red Hat Product Errata RHSA-2010:0339 0 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security update 2010-04-01 00:14:40 UTC
Red Hat Product Errata RHSA-2010:0383 0 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2010-04-29 17:49:44 UTC
Red Hat Product Errata RHSA-2010:0471 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite Server IBM Java Runtime security update 2010-06-14 23:23:31 UTC
Red Hat Product Errata RHSA-2010:0574 0 normal SHIPPED_LIVE Critical: java-1.4.2-ibm security update 2010-07-29 16:40:02 UTC
Red Hat Product Errata RHSA-2010:0586 0 normal SHIPPED_LIVE Moderate: java-1.4.2-ibm-sap security update 2010-08-02 20:44:00 UTC

Comment 1 Murray McAllister 2010-03-31 15:08:24 UTC 
The java.io.File class did not ensure that the deserialized value of the
"path" field is the value later used. This could be used to bypass file access
restrictions.
Comment 2 Josh Bressers 2010-03-31 23:56:09 UTC 
This is now public:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
Comment 3 errata-xmlrpc 2010-04-01 00:14:59 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0339 https://rhn.redhat.com/errata/RHSA-2010-0339.html
Comment 4 errata-xmlrpc 2010-04-01 00:21:47 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0337 https://rhn.redhat.com/errata/RHSA-2010-0337.html
Comment 5 errata-xmlrpc 2010-04-01 02:57:00 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5
  Supplementary for RHEL 5.2.z
  Supplementary for RHEL 5.3.z

Via RHSA-2010:0338 https://rhn.redhat.com/errata/RHSA-2010-0338.html
Comment 6 Fedora Update System 2010-04-06 16:33:42 UTC 
java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-34.b17.fc11
Comment 7 Fedora Update System 2010-04-06 16:36:10 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc12
Comment 8 Fedora Update System 2010-04-07 07:10:05 UTC 
java-1.6.0-openjdk-1.6.0.0-36.b17.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-36.b17.fc13
Comment 9 Fedora Update System 2010-04-09 01:27:08 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2010-04-09 01:30:46 UTC 
java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2010-04-09 06:56:57 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc13
Comment 12 Fedora Update System 2010-04-09 21:05:14 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2010-04-29 17:49:49 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0383 https://rhn.redhat.com/errata/RHSA-2010-0383.html
Comment 15 errata-xmlrpc 2010-06-14 23:23:43 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.3

Via RHSA-2010:0471 https://rhn.redhat.com/errata/RHSA-2010-0471.html
Comment 20 errata-xmlrpc 2010-07-29 16:40:41 UTC 
This issue has been addressed in following products:

  Extras for RHEL 3
  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0574 https://rhn.redhat.com/errata/RHSA-2010-0574.html
Comment 21 errata-xmlrpc 2010-08-02 20:44:32 UTC 
This issue has been addressed in following products:

  RHEL 4 for SAP
  RHEL 5 for SAP

Via RHSA-2010:0586 https://rhn.redhat.com/errata/RHSA-2010-0586.html
Note You need to log in before you can comment on or make changes to this bug.