Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability

Bugtraq ID:	35942
Class:	Boundary Condition Error
CVE:	CVE-2009-2674 CVE-2009-3403
Remote:	Yes
Local:	No
Published:	Aug 03 2009 12:00AM
Updated:	Apr 13 2015 10:13PM
Credit:	An anonymous researcher
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 SuSE SUSE Linux Enterprise Server 11 DEBUGINFO SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE Suse Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise 11 Sun OpenJDK 6 Build b12 Sun JRE (Linux Production Release) 1.6 _13 Sun JRE (Linux Production Release) 1.6 _12 Sun JRE (Linux Production Release) 1.6 _10 Sun JRE (Linux Production Release) 1.6 _07 Sun JRE (Linux Production Release) 1.6 _06 Sun JRE (Linux Production Release) 1.6 _05 Sun JRE (Linux Production Release) 1.6 _04 Sun JRE (Linux Production Release) 1.6.0_14 Sun JRE (Linux Production Release) 1.6.0_11 Sun JRE (Linux Production Release) 1.6.0_03 Sun JRE (Linux Production Release) 1.6.0_02 Sun JRE (Linux Production Release) 1.6.0_01 Sun JDK (Windows Production Release) 1.6.0_03 Sun JDK (Windows Production Release) 1.6.0_02 Sun JDK (Windows Production Release) 1.6.0_01-b06 Sun JDK (Windows Production Release) 1.6.0_01 Sun JDK (Solaris Production Release) 1.6.0_03 Sun JDK (Solaris Production Release) 1.6.0_02 Sun JDK (Solaris Production Release) 1.6.0_01 Sun JDK (Linux Production Release) 1.6 _14 Sun JDK (Linux Production Release) 1.6 _13 Sun JDK (Linux Production Release) 1.6 _11 Sun JDK (Linux Production Release) 1.6 _10 Sun JDK (Linux Production Release) 1.6 _07 Sun JDK (Linux Production Release) 1.6 _06 Sun JDK (Linux Production Release) 1.6 _05 Sun JDK (Linux Production Release) 1.6 _04 Sun JDK (Linux Production Release) 1.6 Sun JDK (Linux Production Release) 1.6.0_03 Sun JDK (Linux Production Release) 1.6.0_02 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Network Satellite (for RHEL 5 Server) 5.3 Redhat Network Satellite (for RHEL 4 AS) 5.3 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux Supplementary EUS 5.3.z Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4.8.z Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux EUS 5.3.z server Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS Extras 4 Redhat Enterprise Linux 5 Server Redhat Desktop Extras 4 Pardus Linux 2009 0 Oracle JRockit R27.6.4 Oracle JRockit R27.6.3 Oracle JRockit R27.6.2 Oracle JRockit R27.6.0 Oracle JRockit R27.1.0 Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks Contact Center - CCT 0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM Java SE 6.0 SR5 HP HP-UX 11.23 HP HP-UX 11.11 HP HP-UX 11.31 Gentoo Linux Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5
Not Vulnerable:	Sun JRE (Linux Production Release) 1.6.0_15 Sun JDK (Windows Production Release) 1.6.0_15 Sun JDK (Solaris Production Release) 1.6.0_15 Sun JDK (Linux Production Release) 1.6.0_15

Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability

Sun Java Runtime Environment (JRE) is prone to an integer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected application. Failed attempts may result in denial-of-service conditions.

This issue affects the following:

JDK and JRE 6 Update 14 and prior

NOTE: This issue was previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Sun JDK (Windows Production Release) 1.6.0_02

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/icedtea6-plugin_6b12-0ub untu6.5_powerpc.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-dbg_6b12-0ubun tu6.5_powerpc.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-demo_6b12-0ubu ntu6.5_powerpc.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jdk_6b12-0ubun tu6.5_powerpc.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre-headless_6 b12-0ubuntu6.5_powerpc.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre_6b12-0ubun tu6.5_powerpc.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JDK (Windows Production Release) 1.6.0_01

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/icedtea6-plugin_6b12-0ub untu6.5_sparc.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-dbg_6b12-0ubun tu6.5_sparc.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-demo_6b12-0ubu ntu6.5_sparc.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jdk_6b12-0ubun tu6.5_sparc.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre-headless_6 b12-0ubuntu6.5_sparc.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre_6b12-0ubun tu6.5_sparc.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JDK (Linux Production Release) 1.6.0_02

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

S.u.S.E. openSUSE 11.0

• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-1.5.0 _update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-1.5 .0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-alsa- 1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-als a-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-demo-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-demo- 1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-demo-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-dem o-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-devel -1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-dev el-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-jdbc- 1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-jdb c-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-plugin-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-plugi n-1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-src-1 .5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-src -1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-1.6.0 .u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-1.6 .0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-alsa- 1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-als a-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-demo-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-demo- 1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-demo-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-dem o-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-devel -1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-dev el-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-jdbc- 1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-jdb c-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-plugi n-1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-plu gin-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-src-1 .6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-src -1.6.0.u15-0.1.x86_64.rpm

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.3mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.3mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.3mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.3mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.3mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.3mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/icedtea6-plugi n_6b12-0ubuntu6.5_amd64.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-dbg_ 6b12-0ubuntu6.5_amd64.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-demo _6b12-0ubuntu6.5_amd64.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jdk_ 6b12-0ubuntu6.5_amd64.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- headless_6b12-0ubuntu6.5_amd64.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre_ 6b12-0ubuntu6.5_amd64.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JDK (Linux Production Release) 1.6.0_03

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/icedtea6-plugi n_6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-dbg_ 6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-demo _6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jdk_ 6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- headless_6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre_ 6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.4mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.4mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.4mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.4mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.4mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.4mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

Sun JDK (Windows Production Release) 1.6.0_03

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

S.u.S.E. openSUSE 11.1

• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-1.5.0 _update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-1.5 .0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-alsa- 1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-als a-1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-devel -1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-dev el-1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-jdbc- 1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-jdb c-1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-plugin-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-plugi n-1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-src-1 .5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-src -1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-1.6.0 .u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-1.6 .0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-alsa- 1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-als a-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-devel -1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-dev el-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-jdbc- 1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-jdb c-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-plugi n-1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-plu gin-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-src-1 .6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-src -1.6.0.u15-0.1.1.x86_64.rpm

MandrakeSoft Enterprise Server 5

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Sun JDK (Solaris Production Release) 1.6.0_03

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_lpia.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/icedtea6-plugin_6b12-0ub untu6.5_lpia.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_lpia.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-dbg_6b12-0ubun tu6.5_lpia.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_lpia.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-demo_6b12-0ubu ntu6.5_lpia.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_lpia.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jdk_6b12-0ubun tu6.5_lpia.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_lpia.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre-headless_6 b12-0ubuntu6.5_lpia.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_lpia.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre_6b12-0ubun tu6.5_lpia.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JRE (Linux Production Release) 1.6.0_02

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Solaris Production Release) 1.6.0_02

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6.0_03

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _06

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _14

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _13

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6 _07

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _04

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6 _05

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _11

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6 _04

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _10

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6 _06

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability

References:

• Advance notification of Security Updates for Java SE (Sun)
  
• Java SE 6 Update Release Notes (Sun)
  
• Java�?� 2 Platform Standard Edition Development Kit 5.0 Update 20 (JDK 5.0 Update (Sun)
  
• Sun's latest Java security alerts (IBM)
  
• ZDI-09-050: Sun Java Web Start JPEG Header Parsing Integer Overflow Vulnerabilit (Zero Day Initiative)
  
• ZDI-09-050: Sun Java Web Start JPEG Header Parsing Integer Overflow Vulnerabilit (ZDI Disclosures )
  
• 263428 Integer Overflow (Sun)
  
• Nortel Enterprise Response to Sun Java JDK / JRE Multiple Vulnerabilities (Aug 0 (Nortel Networks)
  
• Oracle Critical Patch Update Advisory - October 2009 (Oracle)
  
• RHSA-2009:1199 java-1.5.0-sun security update (Red Hat)
  
• RHSA-2009:1200 java-1.6.0-sun security update (Red Hat)
  
• RHSA-2009:1201 java-1.6.0-openjdk security and bug fix update (Red Hat)