ZDI-20-897: Oracle Java Runtime Environment HTML Rendering Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Java Runtime Environment. Interaction with the JavaFX library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the rendering of HTML in JavaFX. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-897?
The severity of ZDI-20-897 is critical due to the potential for remote code execution.
How do I fix ZDI-20-897?
To fix ZDI-20-897, update the Oracle Java Runtime Environment to the latest version.
Who is affected by ZDI-20-897?
ZDI-20-897 affects installations of Oracle Java Runtime Environment, specifically Sun Java Runtime Environment 5.
What is the impact of exploiting ZDI-20-897?
Exploiting ZDI-20-897 allows remote attackers to execute arbitrary code on affected systems.
Is user interaction required for ZDI-20-897?
Yes, interaction with the JavaFX library is required to exploit the ZDI-20-897 vulnerability.