Description
Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC) profile files via a .. (dot dot) in a pathname, aka Bug Id 6631533.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.22-1jpp.1.el5 | RHSA-2009:1571 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.7.b09.el5 | RHSA-2009:1584 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.17-1jpp.2.el5 | RHSA-2009:1560 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.22-1jpp.1.el4 | RHSA-2009:1571 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.17-1jpp.1.el4 | RHSA-2009:1560 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.5.0-sun +1 | 1.5.0.22-1jpp.1.el4 | RHSA-2009:1662 |
Advisories 4
- RHSA-2009:1662 Red Hat Security Advisory: Red Hat Network Satellite Server Sun Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1584 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1571 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1560 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- oval:org.mitre.oval:def:6657 vdb-entry signature
- http://support.apple.com/kb/HT3970
- http://support.apple.com/kb/HT3969
- GLSA-200911-02 vendor-advisory
- oval:org.mitre.oval:def:10520 vdb-entry signature
- APPLE-SA-2009-12-03-1 vendor-advisory
- APPLE-SA-2009-12-03-2 vendor-advisory
- 37581 third-party-advisory
- http://java.sun.com/javase/6/webnotes/6u17.html
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.html
- MDVSA-2010:084 vendor-advisory
- 37386 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=530098