Description
Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +4 | 1:1.5.0.12.2-1jpp.1.el6 | RHSA-2010:0873 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.9.0-1jpp.4.el6 | RHSA-2010:0987 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.31.b17.el6_0 | RHSA-2010:0865 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.6-1jpp.2.el5 | RHSA-2010:0786 |
| RHEL 5 | java-1.4.2-ibm-sap +4 | 1.4.2.13.6.sap-1jpp.1.el5 | RHSA-2010:0986 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.12.2-1jpp.1.el5 | RHSA-2010:0807 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.9.0-1jpp.3.el5 | RHSA-2010:0987 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.16.b17.el5 | RHSA-2010:0768 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.22-1jpp.1.el5 | RHSA-2010:0770 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.13.6-1jpp.2.el4 | RHSA-2010:0786 |
| RHEL 4 | java-1.4.2-ibm-sap +4 | 1.4.2.13.6.sap-1jpp.1.el4_8 | RHSA-2010:0986 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.12.2-1jpp.1.el4 | RHSA-2010:0807 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.9.0-1jpp.3.el4 | RHSA-2010:0987 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.22-1jpp.1.el4 | RHSA-2010:0770 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.13.6-1jpp.3.el3 | RHSA-2010:0786 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.9.1-1jpp.1.el5 | RHSA-2011:0880 |
Advisories 9
- RHSA-2011:0880 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0987 Red Hat Security Advisory: java-1.6.0-ibm security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0986 Red Hat Security Advisory: java-1.4.2-ibm-sap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0873 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0865 Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0807 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0770 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0786 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0768 Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://support.avaya.com/css/P8/documents/100114327
- RHSA-2010:0865 vendor-advisory
- http://support.avaya.com/css/P8/documents/100114315
- GLSA-201406-32 vendor-advisory
- HPSBMU02799 vendor-advisory
- SUSE-SA:2010:061 vendor-advisory
- 44032 vdb-entry
- RHSA-2010:0770 vendor-advisory
- oval:org.mitre.oval:def:14354 vdb-entry signature
- SSRT100333 vendor-advisory
- RHSA-2010:0768 vendor-advisory
- FEDORA-2010-16240 vendor-advisory
- USN-1010-1 vendor-advisory
- oval:org.mitre.oval:def:12491 vdb-entry signature
- RHSA-2010:0987 vendor-advisory
- RHSA-2010:0986 vendor-advisory
- 44954 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=642202
- RHSA-2011:0880 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html
- RHSA-2010:0873 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- 42974 third-party-advisory
- 41972 third-party-advisory
- http://support.avaya.com/css/P8/documents/100123193
- RHSA-2010:0786 vendor-advisory
- SUSE-SR:2010:019 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- 41967 third-party-advisory
- RHSA-2010:0807 vendor-advisory
- FEDORA-2010-16312 vendor-advisory
- ADV-2010-2745 vdb-entry
- FEDORA-2010-16294 vendor-advisory