Description
Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries, which allows remote attackers to execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.5-1jpp.1.el5 | RHSA-2010:0574 |
| RHEL 5 | java-1.4.2-ibm-sap +4 | 1.4.2.13.5.sap-1jpp.1.el5 | RHSA-2010:0586 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.11.2-1jpp.1.el5 | RHSA-2010:0489 |
| RHEL 5 | java-1.5.0-sun-uninstall | 1.5.0.22-1jpp.3.el5 | RHSA-2010:0338 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.8-1jpp.1.el5 | RHSA-2010:0383 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.19-1jpp.1.el5 | RHSA-2010:0337 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.13.5-1jpp.1.el4 | RHSA-2010:0574 |
| RHEL 4 | java-1.4.2-ibm-sap +4 | 1.4.2.13.5.sap-1jpp.1.el4_8 | RHSA-2010:0586 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.11.2-1jpp.1.el4 | RHSA-2010:0489 |
| RHEL 4 | java-1.5.0-sun-uninstall | 1.5.0.22-1jpp.3.el4 | RHSA-2010:0338 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.8-1jpp.1.el4 | RHSA-2010:0383 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.19-1jpp.1.el4 | RHSA-2010:0337 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.13.5-1jpp.1.el3 | RHSA-2010:0574 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.8-1jpp.1.el4 | RHSA-2010:0471 |
Advisories 7
- RHSA-2010:0574 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0586 Red Hat Security Advisory: java-1.4.2-ibm-sap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0489 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0471 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0383 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0337 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0338 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- APPLE-SA-2010-05-18-1 vendor-advisory
- HPSBMU02799 vendor-advisory
- 39317 third-party-advisory
- RHSA-2010:0383 vendor-advisory
- 40545 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-052/
- ADV-2010-1454 vdb-entry
- 39819 third-party-advisory
- 39083 vdb-entry
- RHSA-2010:0338 vendor-advisory
- ADV-2010-1793 vdb-entry
- APPLE-SA-2010-05-18-2 vendor-advisory
- 63492 vdb-entry
- 43308 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- SSRT100179 vendor-advisory
- SSRT100089 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html
- http://support.apple.com/kb/HT4170
- ADV-2010-1523 vdb-entry
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- SUSE-SR:2010:008 vendor-advisory
- 39659 third-party-advisory
- oval:org.mitre.oval:def:14092 vdb-entry signature
- RHSA-2010:0471 vendor-advisory
- SUSE-SR:2010:017 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- RHSA-2010:0337 vendor-advisory
- RHSA-2010:0489 vendor-advisory
- 40211 third-party-advisory
- http://support.apple.com/kb/HT4171
- 20100405 ZDI-10-052: Sun Java Runtime Environment XNewPtr Remote Code Execution Vulnerability mailing-list
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- ADV-2010-1191 vdb-entry