Description
Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.12-1jpp.1.el5 | RHSA-2008:0955 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.8-1jpp.1.el5 | RHSA-2008:0790 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.16-1jpp.2.el5 | RHSA-2008:0595 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.2-1jpp.2.el5 | RHSA-2008:0906 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.7-1jpp.1.el5 | RHSA-2008:0594 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.12-1jpp.1.el4 | RHSA-2008:0955 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.8-1jpp.1.el4 | RHSA-2008:0790 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.16-1jpp.2.el4 | RHSA-2008:0595 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.2-1jpp.2.el4 | RHSA-2008:0906 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.7-1jpp.2.el4 | RHSA-2008:0594 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.12-1jpp.1.el3 | RHSA-2008:0955 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.5.0-ibm +1 | 1:1.5.0.8-1jpp.1.el4 | RHSA-2008:0638 |
| Red Hat Network Satellite 5 | java-1.5.0-sun +1 | 1.5.0.16-1jpp.2.el4 | RHSA-2008:0636 |
Advisories 7
- RHSA-2008:0955 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0906 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0790 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0636 Red Hat Security Advisory: Red Hat Network Satellite Server Sun Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0638 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0594 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0595 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- APPLE-SA-2008-09-24 vendor-advisory
- 20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and mailing-list
- 32436 third-party-advisory
- 32826 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-428.htm
- 31600 third-party-advisory
- SUSE-SA:2008:042 vendor-advisory
- 32018 third-party-advisory
- GLSA-200911-02 vendor-advisory
- 32179 third-party-advisory
- 33194 third-party-advisory
- ADV-2008-2740 vdb-entry
- 31320 third-party-advisory
- SUSE-SA:2008:043 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-042/
- ADV-2008-2056 vdb-entry
- 238905 vendor-advisory
- 31055 third-party-advisory
- 32180 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2008-0016.html
- 31736 third-party-advisory
- 35065 third-party-advisory
- http://support.apple.com/kb/HT3178
- 1020452 vdb-entry
- 30148 vdb-entry
- RHSA-2008:0594 vendor-advisory
- sun-javawebstart-file-create(43666) vdb-entry
- 31497 third-party-advisory
- SUSE-SR:2009:010 vendor-advisory
- RHSA-2008:0955 vendor-advisory
- oval:org.mitre.oval:def:11102 vdb-entry signature
- SUSE-SR:2008:028 vendor-advisory
- 20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues mailing-list
- SUSE-SA:2008:045 vendor-advisory
- RHSA-2008:0790 vendor-advisory
- RHSA-2008:0906 vendor-advisory
- TA08-193A third-party-advisory
- 37386 third-party-advisory
- http://support.apple.com/kb/HT3179
- RHSA-2008:0595 vendor-advisory
- 31010 third-party-advisory