Description
Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application, aka "three vulnerabilities."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el5 | RHSA-2008:0132 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.6-1jpp.1.el5 | RHSA-2007:1041 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.13-1jpp.1.el5 | RHSA-2007:0963 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0132 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.6-1jpp.2.el4 | RHSA-2007:1041 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.13-1jpp.1.el4 | RHSA-2007:0963 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0132 |
Advisories 3
- RHSA-2008:0132 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:1041 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0963 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2008:0132 vendor-advisory
- RHSA-2007:1041 vendor-advisory
- ADV-2007-3895 vdb-entry
- 30676 third-party-advisory
- 29042 third-party-advisory
- 27693 third-party-advisory
- http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html
- SUSE-SA:2007:055 vendor-advisory
- javaweb-cache-information-disclosure(36946) vdb-entry
- 29897 third-party-advisory
- 27206 third-party-advisory
- 27804 third-party-advisory
- GLSA-200804-28 vendor-advisory
- HPSBUX02284 vendor-advisory
- 29858 third-party-advisory
- RHSA-2007:0963 vendor-advisory
- ADV-2008-0609 vdb-entry
- SUSE-SA:2008:025 vendor-advisory
- 27261 third-party-advisory
- 20071029 FLEA-2007-0061-1 sun-jre sun-jdk mailing-list
- 28777 third-party-advisory
- BEA08-198.00 vendor-advisory
- 30780 third-party-advisory
- oval:org.mitre.oval:def:11592 vdb-entry signature
- 25920 vdb-entry
- 28880 third-party-advisory
- 27716 third-party-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- 103073 vendor-advisory
- 1018770 vdb-entry
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory