• info
• discussion
• exploit
• solution
• references

Sun JDK JPG/BMP Parser Multiple Vulnerabilities

Solution:
Sun has released Sun Alert Advisory 102934 with fixes to address these issues. Please see the references for more information.


Slackware Linux 12.0

• Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz


• Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz

BEA Systems JRockit R27.3.1

• BEA Systems jrockit-jdk1.4.2_14-linux_ia32.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.4.2_14-linux_ia32.tar.gz


• BEA Systems jrockit-jdk1.4.2_14-linux_ia64.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.4.2_14-linux_ia64.tar.gz


• BEA Systems jrockit-jdk1.4.2_14-solaris_sparcv9.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.4.2_14-solaris_sparcv9.tar.gz


• BEA Systems jrockit-jdk1.4.2_14-windows_ia32.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.4.2_14-windows_ia32.zip


• BEA Systems jrockit-jdk1.4.2_14-windows_ia64.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.4.2_14-windows_ia64.zip


• BEA Systems jrockit-jdk1.5.0_11-linux_ia32.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-linux_ia32.tar.gz


• BEA Systems jrockit-jdk1.5.0_11-linux_ia64.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-linux_ia64.tar.gz


• BEA Systems jrockit-jdk1.5.0_11-linux_x86_64.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-linux_x86_64.tar.gz


• BEA Systems jrockit-jdk1.5.0_11-solaris_sparcv9.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-solaris_sparcv9.tar.gz


• BEA Systems jrockit-jdk1.5.0_11-windows_ia32.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-windows_ia32.zip


• BEA Systems jrockit-jdk1.5.0_11-windows_ia64.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-windows_ia64.zip


• BEA Systems jrockit-jdk1.5.0_11-windows_x86_64.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.5.0_11-windows_x86_64.zip


• BEA Systems jrockit-jdk1.6.0_01-linux_ia32.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.6.0_01-linux_ia32.tar.gz


• BEA Systems jrockit-jdk1.6.0_01-linux_x86_64.tar.gz
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.6.0_01-linux_x86_64.tar.gz


• BEA Systems jrockit-jdk1.6.0_01-windows_ia32.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.6.0_01-windows_ia32.zip


• BEA Systems jrockit-jdk1.6.0_01-windows_x86_64.zip
  ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/ jrockit-jdk1.6.0_01-windows_x86_64.zip

Slackware Linux 10.0

• Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz


• Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz

Slackware Linux 10.1

• Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz


• Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz

Slackware Linux 10.2

• Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz


• Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz

Apple Mac OS X 10.4.10

• Apple Java for Mac OS X 10.4, Release 6
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg

Apple Mac OS X Server 10.4.10

• Apple Java for Mac OS X 10.4, Release 6
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg

Apple Mac OS X 10.4.11

• Apple Java for Mac OS X 10.4, Release 6
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg

Apple Mac OS X Server 10.4.11

• Apple Java for Mac OS X 10.4, Release 6
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg

Slackware Linux 8.1

• Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz


• Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz

Slackware Linux 9.0

• Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz


• Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz