The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
Chris Evans discovered a flaw in how LittleCms checks certain upper-bounds sizes. This flaw could potentially lead to arbitrary code execution in applications that use the system LittleCms library, or embed the source into their application.
Acknowledgements:
Red Hat would like to thank Chris Evans from the Google Security Team for reporting these issues.
Chris Evans discovered an integer overflow flaw in LittleCms. This flaw could potentially lead to arbitrary code execution in applications that use the system LittleCms library, or embed the source into their application.
Acknowledgements:
Red Hat would like to thank Chris Evans from the Google Security Team for reporting these issues.
Integer overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows remote attackers to cause a denial of service (applet crash) via a crafted Pulse Audio source data line.
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
Chris Evans discovered a memory leak flaw in LittleCms. This flaw could cause applications that use the system LittleCms library, or embed the source into their application, to crash.
Acknowledgements:
Red Hat would like to thank Chris Evans from the Google Security Team for reporting this issue.