Description
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is heap corruption related to the Verifier and "backward jsrs."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.7-2~squeeze1 | DSA-2224-1 |
| Debian 5.0 | openjdk-6 | 6b18-1.8.7-2~lenny1 | DSA-2224-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.39.b17.el6_0 | RHSA-2011:0281 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.24-1jpp.1.el6 | RHSA-2011:0282 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.20.b17.el5 | RHSA-2011:0281 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.24-1jpp.1.el5 | RHSA-2011:0282 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.24-1jpp.1.el4 | RHSA-2011:0282 |
Advisories 3
- RHSA-2011:0282 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0281 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2224-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html
- FEDORA-2011-1631 vendor-advisory
- 46400 vdb-entry
- GLSA-201406-32 vendor-advisory
- HPSBMU02799 vendor-advisory
- oval:org.mitre.oval:def:12833 vdb-entry signature
- FEDORA-2011-1645 vendor-advisory
- oval:org.mitre.oval:def:13639 vdb-entry signature
- http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html
- 43350 third-party-advisory
- RHSA-2011:0282 vendor-advisory
- DSA-2224 vendor-advisory
- SSRT100867 vendor-advisory
- 49198 third-party-advisory
- oracle-hotspot-code-exec(65399) vdb-entry
- HPSBUX02777 vendor-advisory
- RHSA-2011:0281 vendor-advisory
- MDVSA-2011:054 vendor-advisory