Bug 575818 (CVE-2010-0837) - CVE-2010-0837 OpenJDK JAR "unpack200" must verify input parameters (6902299)
Summary: CVE-2010-0837 OpenJDK JAR "unpack200" must verify input parameters (6902299)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-0837
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 594679
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-03-22 13:49 UTC by Marc Schoenefeld
Modified: 2019-09-29 12:35 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-09 02:25:11 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0337 0 normal SHIPPED_LIVE Critical: java-1.6.0-sun security update 2010-04-01 00:21:33 UTC
Red Hat Product Errata RHSA-2010:0338 0 normal SHIPPED_LIVE Critical: java-1.5.0-sun security update 2010-04-01 04:04:18 UTC
Red Hat Product Errata RHSA-2010:0339 0 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security update 2010-04-01 00:14:40 UTC
Red Hat Product Errata RHSA-2010:0383 0 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2010-04-29 17:49:44 UTC
Red Hat Product Errata RHSA-2010:0471 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite Server IBM Java Runtime security update 2010-06-14 23:23:31 UTC

Comment 1 Murray McAllister 2010-03-31 15:02:12 UTC 
An input validation flaw was found in the JRE unpack200 functionality. An untrusted applet or application could use this flaw to elevate its privileges.
Comment 2 Josh Bressers 2010-04-01 00:05:39 UTC 
This is now public:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
Comment 3 errata-xmlrpc 2010-04-01 00:15:17 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0339 https://rhn.redhat.com/errata/RHSA-2010-0339.html
Comment 4 errata-xmlrpc 2010-04-01 00:22:03 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0337 https://rhn.redhat.com/errata/RHSA-2010-0337.html
Comment 5 errata-xmlrpc 2010-04-01 02:57:17 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5
  Supplementary for RHEL 5.2.z
  Supplementary for RHEL 5.3.z

Via RHSA-2010:0338 https://rhn.redhat.com/errata/RHSA-2010-0338.html
Comment 6 Fedora Update System 2010-04-06 16:33:56 UTC 
java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-34.b17.fc11
Comment 7 Fedora Update System 2010-04-06 16:36:24 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc12
Comment 8 Fedora Update System 2010-04-07 07:10:20 UTC 
java-1.6.0-openjdk-1.6.0.0-36.b17.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-36.b17.fc13
Comment 9 Fedora Update System 2010-04-09 01:27:22 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2010-04-09 01:31:00 UTC 
java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2010-04-09 06:56:44 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc13
Comment 12 Fedora Update System 2010-04-09 21:05:01 UTC 
java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2010-04-29 17:50:04 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0383 https://rhn.redhat.com/errata/RHSA-2010-0383.html
Comment 15 errata-xmlrpc 2010-06-14 23:23:57 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.3

Via RHSA-2010:0471 https://rhn.redhat.com/errata/RHSA-2010-0471.html
Note You need to log in before you can comment on or make changes to this bug.