Description
Sun Java Media Framework (JMF) 2.1.1 through 2.1.1c allows unsigned applets to cause a denial of service (JVM crash) and read or write unauthorized memory locations via the ReadEnv class, as demonstrated by reading environment variables using modified .data and .size fields.
References
- 20030625 Privilege escalation applet, Java Media Framework mailing-list
- http://www.illegalaccess.org/java/jmf.php
- 54760 vendor-advisory
- 1006777 vdb-entry