Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2009-1104

Published: 25 March 2009

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.

Priority

Low

Status

Package Release Status
openjdk-6
Launchpad, Ubuntu, Debian
dapper Does not exist

gutsy Does not exist

hardy Not vulnerable
(Sun Java only)
intrepid Not vulnerable
(Sun Java only)
jaunty Not vulnerable
(Sun Java only)
karmic Not vulnerable
(Sun Java only)
lucid Not vulnerable
(Sun Java only)
upstream Not vulnerable
(Sun Java only)
sun-java5
Launchpad, Ubuntu, Debian
dapper Ignored
(end of life)
gutsy Ignored
(end of life, was needs-triage)
hardy Not vulnerable
(1.5.0-22-0ubuntu0.8.04)
intrepid Ignored
(end of life, was needs-triage)
jaunty Not vulnerable
(1.5.0-19-0ubuntu0.9.04)
karmic Does not exist

lucid Does not exist

upstream
Released (1.5.0-18)
sun-java6
Launchpad, Ubuntu, Debian
dapper Does not exist

gutsy Ignored
(end of life, was needs-triage)
hardy
Released (6.20dlj-0ubuntu1.8.04)
intrepid Ignored
(end of life, was needs-triage)
jaunty
Released (6.20dlj-0ubuntu1.9.04)
karmic
Released (6.20dlj-0ubuntu1.9.10)
lucid
Released (6.20dlj-1ubuntu3)
upstream
Released (6.13)