-
Committer:
Bazaar Package Importer
-
Author(s):
Matthias Klose
-
Date:
2010-03-29 21:32:02 UTC
-
Revision ID:
james.westby@ubuntu.com-20100329213202-cn6b3sjpcojqwhjx
Tags: 6b12-0ubuntu6.7
* SECURITY UPDATE: multiple upstream vulnerabilities. Upstream fixes:
- 6626217: Loader-constraint table allows arrays instead of only
the base-classes.
- 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
- 6639665: ThreadGroup finalizer allows creation of false root ThreadGroups.
- 6736390: File TOCTOU deserialization vulnerability.
- 6745393: Inflater/Deflater clone issues.
- 6887703: Unsigned applet can retrieve the dragged information before drop
action occur.
- 6888149: AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error.
- 6892265: System.arraycopy unable to reference elements beyond
Integer.MAX_VALUE bytes.
- 6893947: Deserialization of RMIConnectionImpl objects should enforce
stricter checks [ZDI-CAN-588].
- 6893954: Subclasses of InetAddress may incorrectly interpret network
addresses [ZDI-CAN-603].
- 6894807: No ClassCastException for HashAttributeSet constructors if run
with -Xcomp.
- 6898622: ObjectIdentifer.equals is not capable of detecting incorrectly
encoded CommonName OIDs.
- 6898739: TLS renegotiation issue.
- 6899653: Java Runtime CMM readMabCurveData Buffer Overflow Vulnerability.
- 6902299: Java JAR "unpack200" must verify input parameters.
- 6904691: Java Applet Trusted Methods Chaining Privilege Escalation
Vulnerability.
- 6909597: Java Runtime Environment JPEGImageReader stepX Integer Overflow
Vulnerability.
- 6910590: Application can modify command array, in ProcessBuilder.
- 6914823: Java AWT Library Invalid Index Vulnerability.
- 6914866: JRE ImagingLib arbitrary code execution vulnerability.
- 6932480: Crash in CompilerThread/Parser.