Description
The Javadoc tool in Sun JDK 6 and JDK 5.0 Update 11 can generate HTML documentation pages that contain cross-site scripting (XSS) vulnerabilities, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.5.0-bea +5 | 1.5.0.11-1jpp.1.el5 | RHSA-2007:0956 |
| RHEL 5 | java-1.5.0-ibm +6 | 1:1.5.0.5-1jpp.0.1.el5 | RHSA-2007:0829 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.5-1jpp.2.el4 | RHSA-2007:0829 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.12-1jpp.2.el4 | RHSA-2007:0818 |
Advisories 3
- RHSA-2007:0956 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0829 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0818 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2007:0818 vendor-advisory
- oval:org.mitre.oval:def:10704 vdb-entry signature
- 26933 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307177
- 36488 vdb-entry
- 26314 third-party-advisory
- BEA07-177.00 vendor-advisory
- sun-jdk-javadoc-xss(35168) vdb-entry
- 25769 third-party-advisory
- 26369 third-party-advisory
- 102958 vendor-advisory
- APPLE-SA-2007-12-14 vendor-advisory
- RHSA-2007:0956 vendor-advisory
- 26645 third-party-advisory
- ADV-2007-4224 vdb-entry
- ADV-2007-3009 vdb-entry
- GLSA-200709-15 vendor-advisory
- 28115 third-party-advisory
- ADV-2007-2383 vdb-entry
- 27203 third-party-advisory
- 1018327 vdb-entry
- RHSA-2007:0829 vendor-advisory
- 24690 vdb-entry
- 26631 third-party-advisory