Description
The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.
References
- APPLE-SA-2009-06-15-1 vendor-advisory
- 35401 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-09-043
- 20090616 ZDI-09-043: Apple Java CColorUIResource Pointer Derference Code Execution Vulnerability mailing-list
- 35381 vdb-entry
- http://support.apple.com/kb/HT3632
- hotspot-ccolouruiresource-code-execution(51185) vdb-entry