Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

• RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0100 Red Hat Security Advisory: java-1.4.2-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2007:1086 Red Hat Security Advisory: java-1.4.2-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2007:0956 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2007:0829 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2007:0817 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026

References

• 26933 third-party-advisory
• http://docs.info.apple.com/article.html?artnum=307177
• [Security-announce] 20080107 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1 mailing-list
• 26049 third-party-advisory
• BEA07-177.00 vendor-advisory
• 26311 third-party-advisory
• 20070703 Sun JDK Confusion mailing-list
• sun-java-image-bo(34652) vdb-entry
• 200856 vendor-advisory
• http://scary.beasts.org/security/CESA-2006-004.html
• 30805 third-party-advisory
• ADV-2008-0065 vdb-entry
• sunjava-iccprofile-overflow(34318) vdb-entry
• VU#138545 third-party-advisory
• GLSA-200705-23 vendor-advisory
• 24004 vdb-entry
• 20071218 Sun JDK Confusion Revisited mailing-list
• 26369 third-party-advisory
• GLSA-200804-28 vendor-advisory
• 102934 vendor-advisory
• 28056 third-party-advisory
• 29858 third-party-advisory
• SUSE-SA:2007:045 vendor-advisory
• ADV-2007-1836 vdb-entry
• APPLE-SA-2007-12-14 vendor-advisory
• RHSA-2008:0100 vendor-advisory
• RHSA-2007:0956 vendor-advisory
• http://support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html
• RHSA-2007:0817 vendor-advisory
• 26645 third-party-advisory
• 26119 third-party-advisory
• 28365 third-party-advisory
• 24267 vdb-entry
• 25832 third-party-advisory
• ADV-2007-4224 vdb-entry
• GLSA-200706-08 vendor-advisory
• 30780 third-party-advisory
• 25295 third-party-advisory
• ADV-2007-3009 vdb-entry
• 27266 third-party-advisory
• SUSE-SA:2007:056 vendor-advisory
• 20070711 Sun JDK Confusion mailing-list
• GLSA-200709-15 vendor-advisory
• 28115 third-party-advisory
• 1018182 vdb-entry
• RHSA-2008:0261 vendor-advisory
• 29340 third-party-advisory
• 25474 third-party-advisory
• RHSA-2007:1086 vendor-advisory
• 27203 third-party-advisory
• 20070704 [theall at tenablesecurity.com: Sun JDK Confusion] (fwd) mailing-list
• GLSA-200804-20 vendor-advisory
• GLSA-200806-11 vendor-advisory
• http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html
• RHSA-2007:0829 vendor-advisory
• 26631 third-party-advisory
• oval:org.mitre.oval:def:11700 vdb-entry signature
• RHSA-2008:0133 vendor-advisory