Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE, 7, 6 Update 27 and earlier, and 5.0 Update 31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deserialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.10-0+squeeze2 | DSA-2356-1 |
| Debian 5.0 | openjdk-6 | 6b18-1.8.10-0~lenny2 | DSA-2358-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.10.0-1jpp.2.el6 | RHSA-2012:0034 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.40.1.9.10.el6_1 | RHSA-2011:1380 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.29-1jpp.1.el6 | RHSA-2011:1384 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.10.0-1jpp.2.el5 | RHSA-2012:0034 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.23.1.9.10.el5_7 | RHSA-2011:1380 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.29-1jpp.1.el5 | RHSA-2011:1384 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.10.0-1jpp.2.el4 | RHSA-2012:0034 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.29-1jpp.1.el4 | RHSA-2011:1384 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1455 |
Advisories 6
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0034 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1380 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1384 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2358-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2356-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-201406-32 vendor-advisory
- 48692 third-party-advisory
- HPSBMU02799 vendor-advisory
- oval:org.mitre.oval:def:13662 vdb-entry signature
- SSRT100805 vendor-advisory
- 48308 third-party-advisory
- HPSBUX02730 vendor-advisory
- SUSE-SU-2012:0114 vendor-advisory
- 50215 vdb-entry
- RHSA-2013:1455 vendor-advisory
- RHSA-2011:1384 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
- SSRT100867 vendor-advisory
- oracle-jre-deserialization-unspecified(70850) vdb-entry
- 1026215 vdb-entry
- USN-1263-1 vendor-advisory
- http://www.ibm.com/developerworks/java/jdk/alerts/