REDHAT-BUG-1273338: Medium severity OpenJDK OpenJDK 2D Component vulnerability

Published Oct 20, 2015

Updated

It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

Affected Software

1 affected component

OpenJDK OpenJDK 2D Component

Event History

Oct 20, 2015

Data Sourced

via Red Hat·09:06 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1273338?

The severity of REDHAT-BUG-1273338 is considered high due to potential out of bounds memory access.

How do I fix REDHAT-BUG-1273338?

To fix REDHAT-BUG-1273338, you should upgrade to the latest patched version of OpenJDK that addresses this vulnerability.

What causes the vulnerability referenced in REDHAT-BUG-1273338?

REDHAT-BUG-1273338 is caused by the bundled lcms2 code using a fast floor() implementation leading to out of bounds access.

Which software is affected by REDHAT-BUG-1273338?

The vulnerability REDHAT-BUG-1273338 affects the OpenJDK 2D component.

What are the potential consequences of exploiting REDHAT-BUG-1273338?

Exploiting REDHAT-BUG-1273338 could lead to disclosure of sensitive portions of the Java Virtual Machine memory.