Description
The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.15-1jpp.1.el5 | RHSA-2009:1200 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.15-1jpp.1.el4 | RHSA-2009:1200 |
Advisories 1
- RHSA-2009:1200 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 37460 third-party-advisory
- GLSA-200911-02 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://java.sun.com/javase/6/webnotes/6u15.html
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 37386 third-party-advisory
- ADV-2009-3316 vdb-entry