Description
Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the Java Runtime Environment that allows remote attackers to execute arbitrary code via a JPEG image that contains subsample dimensions with large values, related to JPEGImageReader and "stepX".
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.5-1jpp.1.el5 | RHSA-2010:0574 |
| RHEL 5 | java-1.4.2-ibm-sap +4 | 1.4.2.13.5.sap-1jpp.1.el5 | RHSA-2010:0586 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.11.2-1jpp.1.el5 | RHSA-2010:0489 |
| RHEL 5 | java-1.5.0-sun-uninstall | 1.5.0.22-1jpp.3.el5 | RHSA-2010:0338 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.8-1jpp.1.el5 | RHSA-2010:0383 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.19-1jpp.1.el5 | RHSA-2010:0337 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.13.5-1jpp.1.el4 | RHSA-2010:0574 |
| RHEL 4 | java-1.4.2-ibm-sap +4 | 1.4.2.13.5.sap-1jpp.1.el4_8 | RHSA-2010:0586 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.11.2-1jpp.1.el4 | RHSA-2010:0489 |
| RHEL 4 | java-1.5.0-sun-uninstall | 1.5.0.22-1jpp.3.el4 | RHSA-2010:0338 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.8-1jpp.1.el4 | RHSA-2010:0383 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.19-1jpp.1.el4 | RHSA-2010:0337 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.13.5-1jpp.1.el3 | RHSA-2010:0574 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.8-1jpp.1.el4 | RHSA-2010:0471 |
Advisories 7
- RHSA-2010:0574 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0586 Red Hat Security Advisory: java-1.4.2-ibm-sap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0489 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0471 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0383 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0337 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0338 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- APPLE-SA-2010-05-18-1 vendor-advisory
- HPSBMU02799 vendor-advisory
- 39317 third-party-advisory
- RHSA-2010:0383 vendor-advisory
- 40545 third-party-advisory
- ADV-2010-1454 vdb-entry
- 39819 third-party-advisory
- 39067 vdb-entry
- RHSA-2010:0338 vendor-advisory
- ADV-2010-1793 vdb-entry
- APPLE-SA-2010-05-18-2 vendor-advisory
- 20100405 ZDI-10-054: Sun Java Runtime Environment JPEGImageReader stepX Remote Code Execution Vulnerability mailing-list
- 43308 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- SSRT100179 vendor-advisory
- SSRT100089 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html
- oval:org.mitre.oval:def:14144 vdb-entry signature
- http://support.apple.com/kb/HT4170
- ADV-2010-1523 vdb-entry
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- SUSE-SR:2010:008 vendor-advisory
- 39659 third-party-advisory
- RHSA-2010:0471 vendor-advisory
- SUSE-SR:2010:017 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-054/
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- RHSA-2010:0337 vendor-advisory
- RHSA-2010:0489 vendor-advisory
- 40211 third-party-advisory
- http://support.apple.com/kb/HT4171
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- ADV-2010-1191 vdb-entry