Java vulnerability details released

Patch now available for GIF processing issue.

A flaw in the GIF processing procedures of Sun Microsystems' Java Virtual Machine, which could allow code to break out of the Java sandbox, has been reported and a patch released.

The flaw, which could allow remote execute of code on a victim machine if exploited accurately, was first discovered over six months ago, and reported to TippingPoint's Zero Day Initiative (ZDI) by an anonymous researcher. The release of details of the flaw follows a patch release from Sun.

The issue is thought to affect several versions of the Java Runtime Environment software, on multiple platforms. The latest version of the software is thought to be already safe from the flaw, users of older versions (version 5 update 9 and earlier) are advised to apply updates as soon as possible. The alert from ZDI is here, with Sun's announcement and links to fixes here.

19 January 2007

Tags:

del.icio.us

digg this

News


	February issue of VB published The February issue of Virus Bulletin is now available for subscribers to download. 1 February 2012 Hacktivists hijack DNS of popular websites Security at registrars may be weak link. 26 January 2012 New RFC describes best practices for running DNS-based lists DNSBL users advised to avoid those lists that charge for delisting. 24 January 2012 Vulnerability turns McAfee's anti-malware solution into open relay Flaw allows for spam to be sent through customers' PCs. 19 January 2012 AV-Test releases latest results Business and consumer products achieve high pass rate. 18 January 2012 Subscribe \| View All virusbtn: Collaboration among malware authors has made Citadel trojan mature quickly http://t.co/4p2JFbmU 4 hours ago virusbtn: Waledac/Kelihos botnet now used to send out Russian political spam http://t.co/jnAsQCGT 4 hours ago Follow us

News Archive


	2011 2010 2009 2008 2008 2007 2006 2005 2004 2003 2002 Subscribe \| View All

News


	See also Calendar of Events Polls

Quick Links

Poll

The Japanese government is reported to have commissioned a 'defensive virus'. Is 'defensive' malware ever a good idea?
Leave a comment
View 11 comments

Virus Bulletin


	In this month's magazine: Living the meme If Svar is the answer... Static analysis of mobile malware And the devil is six: the security consequences of the switch to IPv6 Behind enemy lines: reporting from the CCC 28C3 Congress Subscribe now!

Virus Bulletin currently has 224,223 registered users.

Fighting malware and spam

Java vulnerability details released