Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2009-1099

Published: 25 March 2009

Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.

Notes

AuthorNote
kees
RedHat lists this as "OpenJDK: Type1 font processing buffer overflow vulnerability" and bug 492302.
Sun's bug seems to be 6804999, from http://sunsolve.sun.com/search/document.do?assetkey=1-26-254571-1

Priority

Low

Status

Package Release Status
openjdk-6
Launchpad, Ubuntu, Debian
dapper Does not exist

gutsy Does not exist

hardy Not vulnerable
(Sun Java only)
intrepid Not vulnerable
(Sun Java only)
jaunty Not vulnerable
(Sun Java only)
karmic Not vulnerable
(Sun Java only)
lucid Not vulnerable
(Sun Java only)
upstream Not vulnerable
(Sun Java only)
sun-java5
Launchpad, Ubuntu, Debian
dapper Ignored
(end of life)
gutsy Ignored
(end of life, was needs-triage)
hardy Not vulnerable
(1.5.0-22-0ubuntu0.8.04)
intrepid Ignored
(end of life, was needs-triage)
jaunty Not vulnerable
(1.5.0-19-0ubuntu0.9.04)
karmic Does not exist

lucid Does not exist

upstream
Released (1.5.0-18)
sun-java6
Launchpad, Ubuntu, Debian
dapper Does not exist

gutsy Ignored
(end of life, was needs-triage)
hardy
Released (6.20dlj-0ubuntu1.8.04)
intrepid Ignored
(end of life, was needs-triage)
jaunty
Released (6.20dlj-0ubuntu1.9.04)
karmic
Released (6.20dlj-0ubuntu1.9.10)
lucid
Released (6.20dlj-1ubuntu3)
upstream
Released (6.13)