Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Sun Java JDK/JRE JPEG Images Integer Overflow Vulnerability - Aug09

Information

Severity

Severity

Critical

Family

Family

General

CVSSv2 Base

CVSSv2 Base

10.0

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Solution Type

Solution Type

Vendor Patch

Created

Created

14 years ago

Modified

Modified

5 years ago

Share

Summary

This host is installed with Sun Java JDK/JRE and is prone to Integer Overflow vulnerability.

Insight

Insight

Multiple flaws exist: - Integer overflow occurs in JRE while vectors involving an untrusted Java Web Start application that grants permissions to itself, related to parsing of JPEG images. - Error in the Java Management Extensions (JMX) implementation which does not properly enforce OpenType checks. - Error in encoder which grants read access to private variables with unspecified names via an untrusted applet or application. - The plugin functionality does not properly implement version selection, which can be exploited by 'old zip and certificate handling' via unknown vectors. - Unspecified error in the 'javax.swing.plaf.synth.SynthContext.isSubregion' method in the Swing implementation which causes NullPointerException via unknown vectors. - Error in Java Web Start implementation which causes NullPointerException via a crafted '.jnlp' file.

Affected Software

Affected Software

Sun Java JDK/JRE version 6 before Update 15.

Solution

Solution

Upgrade to JDK/JRE version 6 Update 15.

Common Vulnerabilities and Exposures (CVE)

References