1. Ubuntu Security Notices
  2. USN-1553-1

USN-1553-1: OpenJDK 6 vulnerabilities

Publication date

3 September 2012

Overview

Two security issues were fixed in OpenJDK 6.

Releases

Packages

  • openjdk-6 - Open Source Java implementation

Details

It was discovered that the Beans component in OpenJDK 6 did not
properly prevent access to restricted classes. A remote attacker could
use this to create an untrusted Java applet or application that would
bypass Java sandbox restrictions. (CVE-2012-1682)

It was discovered that functionality in the AWT component in OpenJDK 6
made it easier for a remote attacker, in conjunction with other
vulnerabilities, to bypass Java sandbox restrictions. (CVE-2012-0547)

It was discovered that the Beans component in OpenJDK 6 did not
properly prevent access to restricted classes. A remote attacker could
use this to create an untrusted Java applet or application that would
bypass Java sandbox restrictions. (CVE-2012-1682)

It was discovered that functionality in the AWT component in OpenJDK 6
made it easier for a remote attacker, in conjunction with other
vulnerabilities, to bypass Java sandbox restrictions. (CVE-2012-0547)

Update instructions

After a standard system update you need to restart any Java applets or applications to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
12.04 precise icedtea-6-jre-cacao –  6b24-1.11.4-1ubuntu0.12.04.1
icedtea-6-jre-jamvm –  6b24-1.11.4-1ubuntu0.12.04.1
openjdk-6-jre –  6b24-1.11.4-1ubuntu0.12.04.1
openjdk-6-jre-headless –  6b24-1.11.4-1ubuntu0.12.04.1
openjdk-6-jre-zero –  6b24-1.11.4-1ubuntu0.12.04.1
openjdk-6-jre-lib –  6b24-1.11.4-1ubuntu0.12.04.1
11.10 oneiric icedtea-6-jre-cacao –  6b24-1.11.4-1ubuntu0.11.10.1
icedtea-6-jre-jamvm –  6b24-1.11.4-1ubuntu0.11.10.1
openjdk-6-jre –  6b24-1.11.4-1ubuntu0.11.10.1
openjdk-6-jre-headless –  6b24-1.11.4-1ubuntu0.11.10.1
openjdk-6-jre-zero –  6b24-1.11.4-1ubuntu0.11.10.1
openjdk-6-jre-lib –  6b24-1.11.4-1ubuntu0.11.10.1
11.04 natty icedtea-6-jre-cacao –  6b24-1.11.4-1ubuntu0.11.04.1
icedtea-6-jre-jamvm –  6b24-1.11.4-1ubuntu0.11.04.1
openjdk-6-jre –  6b24-1.11.4-1ubuntu0.11.04.1
openjdk-6-jre-headless –  6b24-1.11.4-1ubuntu0.11.04.1
openjdk-6-jre-zero –  6b24-1.11.4-1ubuntu0.11.04.1
openjdk-6-jre-lib –  6b24-1.11.4-1ubuntu0.11.04.1
10.04 lucid openjdk-6-jre-headless –  6b24-1.11.4-1ubuntu0.10.04.1
openjdk-6-jre-lib –  6b24-1.11.4-1ubuntu0.10.04.1
icedtea-6-jre-cacao –  6b24-1.11.4-1ubuntu0.10.04.1
openjdk-6-jre –  6b24-1.11.4-1ubuntu0.10.04.1
openjdk-6-jre-zero –  6b24-1.11.4-1ubuntu0.10.04.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›