Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL.
Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to access restricted classes via unspecified vectors.
IBM Java SDK updates 7 SR4-FP1, 6 SR13-FP1, 5.0 SR16-FP1 and 1.4.2 SR13-FP16 fix an unspecified security issue listed in release notes as:
IV38147 196141 Class Libraries FIX SECURITY VULNERABILITY CVE-2013-0485
http://www.ibm.com/developerworks/java/jdk/aix/j732/Java7.fixes.html#SR4FP1 http://www.ibm.com/developerworks/java/jdk/aix/j664/Java664.fixes.html#SR13FP1 http://www.ibm.com/developerworks/java/jdk/aix/j532/fixes.html#SR16FP1 http://www.ibm.com/developerworks/java/jdk/aix/14264/fixes.html#SR13FP16
No further details are currently available for this issue.
A vulnerability was found in the Java Certificate Management System (CMS) keystore provider that could potentially allow an attacker to recover the private key from CMS keystores via a brute-force attack.
External References:
http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateJuly2014 http://www-01.ibm.com/support/docview.wss?uid=swg21680334 http://xforce.iss.net/xforce/xfdb/93756
IBM JDK updates 5.0 SR16-FP8, 6 SR16-FP2, 6R1 SR8-FP2, 7 SR8, and 7R1 SR2 fix a security issue described in the IBM security bulletin as:
IBM Java SDK contains a vulnerability in which the default configuration for the shared classes feature potentially allows arbitrary code to be injected into the shared classes cache, which may subsequently be executed by other local users.
This issue may possibly allow local users to run arbitrary code with the privileges of other users that use IBM JDK.
References: http://www-01.ibm.com/support/docview.wss?uid=swg21688283 http://xforce.iss.net/xforce/xfdb/93629 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateNovember2014
Additional references that describe the shared class cache feature: http://www.ibm.com/developerworks/library/j-ibmjava4/ http://www.ibm.com/developerworks/library/j-sharedclasses/ http://www-01.ibm.com/support/knowledgecenter/SSYKE27.0.0/com.ibm.java.lnx.71.doc/diag/understanding/sharedclasses.html http://www-01.ibm.com/support/knowledgecenter/SSYKE27.0.0/com.ibm.java.lnx.71.doc/diag/appendixes/cmdline/Xshareclasses.html
IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine.