Description
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5.0 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to 2D. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to the exposure of system properties via vectors related to Font.createFont and exception text.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.7-2~squeeze1 | DSA-2224-1 |
| Debian 5.0 | openjdk-6 | 6b18-1.8.7-2~lenny1 | DSA-2224-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.12.4-1jpp.1.el6 | RHSA-2011:0364 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.9.1-1jpp.1.el6 | RHSA-2011:0357 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.24-1jpp.1.el6 | RHSA-2011:0282 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.12.4-1jpp.1.el5 | RHSA-2011:0364 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.9.1-1jpp.1.el5 | RHSA-2011:0357 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.24-1jpp.1.el5 | RHSA-2011:0282 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.12.4-1jpp.1.el4 | RHSA-2011:0364 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.9.1-1jpp.1.el4 | RHSA-2011:0357 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.24-1jpp.1.el4 | RHSA-2011:0282 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.9.1-1jpp.1.el5 | RHSA-2011:0880 |
Advisories 5
- RHSA-2011:0880 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0364 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0357 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0282 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2224-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html
- FEDORA-2011-1631 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- GLSA-201406-32 vendor-advisory
- HPSBMU02799 vendor-advisory
- FEDORA-2011-1645 vendor-advisory
- oracle-runtime-information-disclosure(65405) vdb-entry
- http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html
- 44954 third-party-advisory
- oval:org.mitre.oval:def:12089 vdb-entry signature
- RHSA-2011:0880 vendor-advisory
- 43350 third-party-advisory
- RHSA-2011:0282 vendor-advisory
- DSA-2224 vendor-advisory
- oval:org.mitre.oval:def:14417 vdb-entry signature
- SSRT100867 vendor-advisory
- 46399 vdb-entry
- MDVSA-2011:054 vendor-advisory