Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability

Bugtraq ID:	35944
Class:	Boundary Condition Error
CVE:	CVE-2009-2675 CVE-2009-3403
Remote:	Yes
Local:	No
Published:	Aug 03 2009 12:00AM
Updated:	Apr 13 2015 09:29PM
Credit:	regenrecht and iDefense.
Vulnerable:	VMWare vMA 4.0 VMWare VirtualCenter 2.0.2 VMWare VirtualCenter 2.5.Update 3 build 1 VMWare VirtualCenter 2.5 Update 5 VMWare VirtualCenter 2.5 Update 2 VMWare VirtualCenter 2.5 Update 1 VMWare VirtualCenter 2.5 VMWare VirtualCenter 2.0.2 Update 5 VMWare VirtualCenter 2.0.2 Update 4 VMWare VirtualCenter 2.0.2 Update 3 VMWare VirtualCenter 2.0.2 Update 2 VMWare VirtualCenter 2.0.2 Update 1 VMWare vCenter 4.0 VMWare Server 2.0 VMWare ESX Server 3.0.3 VMWare ESX Server 4.0 VMWare ESX Server 3.5 ESX350-200910401 VMWare ESX Server 3.5 ESX350-200906407 VMWare ESX Server 3.5 ESX350-200904401 VMWare ESX Server 3.5 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 SuSE SUSE Linux Enterprise Server 11 DEBUGINFO SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE Suse Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise 11 Sun OpenJDK 6 Build b12 Sun JRE (Windows Production Release) 1.5 _06 Sun JRE (Windows Production Release) 1.5 _05 Sun JRE (Windows Production Release) 1.5 _04 Sun JRE (Windows Production Release) 1.5 _03 Sun JRE (Windows Production Release) 1.5 _02 Sun JRE (Windows Production Release) 1.5 _01 Sun JRE (Windows Production Release) 1.5 Sun JRE (Windows Production Release) 1.5.0_17 Sun JRE (Windows Production Release) 1.5.0_14 Sun JRE (Windows Production Release) 1.5.0_13 Sun JRE (Windows Production Release) 1.5.0_12 Sun JRE (Windows Production Release) 1.5.0_11 Sun JRE (Windows Production Release) 1.5.0_10 Sun JRE (Windows Production Release) 1.5.0.0_09 Sun JRE (Windows Production Release) 1.5.0.0_08 Sun JRE (Windows Production Release) 1.5.0.0_07 Sun JRE (Solaris Production Release) 1.5 _15 Sun JRE (Solaris Production Release) 1.5 _06 Sun JRE (Solaris Production Release) 1.5 _05 Sun JRE (Solaris Production Release) 1.5 _04 Sun JRE (Solaris Production Release) 1.5 _03 Sun JRE (Solaris Production Release) 1.5 _02 Sun JRE (Solaris Production Release) 1.5 _01 Sun JRE (Solaris Production Release) 1.5 Sun JRE (Solaris Production Release) 1.5.0_17 Sun JRE (Solaris Production Release) 1.5.0_14 Sun JRE (Solaris Production Release) 1.5.0_13 Sun JRE (Solaris Production Release) 1.5.0_12 Sun JRE (Solaris Production Release) 1.5.0_11 Sun JRE (Solaris Production Release) 1.5.0_10 Sun JRE (Solaris Production Release) 1.5.0.0_09 Sun JRE (Solaris Production Release) 1.5.0.0_08 Sun JRE (Solaris Production Release) 1.5.0.0_07 Sun JRE (Linux Production Release) 1.6 _13 Sun JRE (Linux Production Release) 1.6 _12 Sun JRE (Linux Production Release) 1.6 _10 Sun JRE (Linux Production Release) 1.6 _07 Sun JRE (Linux Production Release) 1.6 _06 Sun JRE (Linux Production Release) 1.6 _05 Sun JRE (Linux Production Release) 1.6 _04 Sun JRE (Linux Production Release) 1.5 _18 Sun JRE (Linux Production Release) 1.5 _16 Sun JRE (Linux Production Release) 1.5 _15 Sun JRE (Linux Production Release) 1.5 _07 Sun JRE (Linux Production Release) 1.5 _06 Sun JRE (Linux Production Release) 1.5 _05 Sun JRE (Linux Production Release) 1.5 _04 Sun JRE (Linux Production Release) 1.5 _03 Sun JRE (Linux Production Release) 1.5 _02 Sun JRE (Linux Production Release) 1.5 _01 Sun JRE (Linux Production Release) 1.5 .0 beta Sun JRE (Linux Production Release) 1.5 Sun JRE (Linux Production Release) 1.6.0_14 Sun JRE (Linux Production Release) 1.6.0_11 Sun JRE (Linux Production Release) 1.6.0_03 Sun JRE (Linux Production Release) 1.6.0_02 Sun JRE (Linux Production Release) 1.6.0_01 Sun JRE (Linux Production Release) 1.5.0_17 Sun JRE (Linux Production Release) 1.5.0_14 Sun JRE (Linux Production Release) 1.5.0_13 Sun JRE (Linux Production Release) 1.5.0_12 Sun JRE (Linux Production Release) 1.5.0_11 Sun JRE (Linux Production Release) 1.5.0_10 Sun JRE (Linux Production Release) 1.5.0_09 Sun JRE (Linux Production Release) 1.5.0_08 Sun JDK (Windows Production Release) 1.6.0_03 Sun JDK (Windows Production Release) 1.6.0_02 Sun JDK (Windows Production Release) 1.6.0_01-b06 Sun JDK (Windows Production Release) 1.6.0_01 Sun JDK (Solaris Production Release) 1.5 _15 Sun JDK (Solaris Production Release) 1.6.0_03 Sun JDK (Solaris Production Release) 1.6.0_02 Sun JDK (Solaris Production Release) 1.6.0_01 Sun JDK (Linux Production Release) 1.6 _14 Sun JDK (Linux Production Release) 1.6 _13 Sun JDK (Linux Production Release) 1.6 _11 Sun JDK (Linux Production Release) 1.6 _10 Sun JDK (Linux Production Release) 1.6 _07 Sun JDK (Linux Production Release) 1.6 _06 Sun JDK (Linux Production Release) 1.6 _05 Sun JDK (Linux Production Release) 1.6 _04 Sun JDK (Linux Production Release) 1.6 Sun JDK (Linux Production Release) 1.5 0_10 Sun JDK (Linux Production Release) 1.5 _18 Sun JDK (Linux Production Release) 1.5 _17 Sun JDK (Linux Production Release) 1.5 _15 Sun JDK (Linux Production Release) 1.5 _14 Sun JDK (Linux Production Release) 1.5 _07 Sun JDK (Linux Production Release) 1.5 _06 Sun JDK (Linux Production Release) 1.5 _02 Sun JDK (Linux Production Release) 1.5 _01 Sun JDK (Linux Production Release) 1.5 .0_05 Sun JDK (Linux Production Release) 1.6.0_03 Sun JDK (Linux Production Release) 1.6.0_02 Sun JDK (Linux Production Release) 1.5.0_13 Sun JDK (Linux Production Release) 1.5.0.0_12 Sun JDK (Linux Production Release) 1.5.0.0_11 Sun JDK (Linux Production Release) 1.5.0.0_08 Sun JDK (Linux Production Release) 1.5.0.0_04 Sun JDK (Linux Production Release) 1.5.0.0_03 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Red Hat Network Satellite (for RHEL 4) 5.1 Redhat Network Satellite (for RHEL 5 Server) 5.3 Redhat Network Satellite (for RHEL 4 AS) 5.3 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux Supplementary EUS 5.3.z Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4.8.z Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux EUS 5.3.z server Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS Extras 4 Redhat Enterprise Linux 5 Server Redhat Desktop Extras 4 Pardus Linux 2009 0 Oracle JRockit R27.6.4 Oracle JRockit R27.6.3 Oracle JRockit R27.6.2 Oracle JRockit R27.6.0 Oracle JRockit R27.1.0 Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks Contact Center - CCT 0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM Java SE 6.0 SR5 IBM J2SE 5.0 SR9 HP HP-UX 11.23 HP HP-UX 11.11 HP HP-UX 11.31 Gentoo Linux Avaya Interactive Response 4.0 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5
Not Vulnerable:	VMWare vMA 4.0 Patch 2 VMWare VirtualCenter 2.5 Update 6 VMWare vCenter 4.0 Update 1 VMWare ESX Server 3.5 ESX350-201003403 Sun JRE (Windows Production Release) 1.5.0_20 Sun JRE (Solaris Production Release) 1.5.0_20 Sun JRE (Linux Production Release) 1.6.0_15 Sun JRE (Linux Production Release) 1.5.0_20 Sun JDK (Windows Production Release) 1.6.0_15 Sun JDK (Solaris Production Release) 1.6.0_15 Sun JDK (Linux Production Release) 1.6.0_15 Sun JDK (Linux Production Release) 1.5.0_20 IBM J2SE 5.0 SR10

Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability

Sun Java Runtime Environment (JRE) is prone to an integer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected application. Failed attempts may result in denial-of-service conditions.

This issue affects the following:

JDK and JRE 6 Update 14 and prior
JDK and JRE 5.0 Update 19 and prior

NOTE: This issue was previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Sun JRE (Windows Production Release) 1.5.0.0_09

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Windows Production Release) 1.5.0_10

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

VMWare ESX Server 3.5 ESX350-200906407

• VMWare ESX350-201003403-SG
  http://download3.vmware.com/software/vi/ESX350-201003403-SG.zip

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/icedtea6-plugin_6b12-0ub untu6.5_powerpc.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-dbg_6b12-0ubun tu6.5_powerpc.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-demo_6b12-0ubu ntu6.5_powerpc.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jdk_6b12-0ubun tu6.5_powerpc.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre-headless_6 b12-0ubuntu6.5_powerpc.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre_6b12-0ubun tu6.5_powerpc.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JRE (Windows Production Release) 1.5.0_14

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.5.0.0_08

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Linux Production Release) 1.5.0_13

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Windows Production Release) 1.6.0_01

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.5.0_10

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Solaris Production Release) 1.5.0_13

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.5.0_13

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/icedtea6-plugin_6b12-0ub untu6.5_sparc.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-dbg_6b12-0ubun tu6.5_sparc.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-demo_6b12-0ubu ntu6.5_sparc.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jdk_6b12-0ubun tu6.5_sparc.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre-headless_6 b12-0ubuntu6.5_sparc.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_sparc.deb
  http://ports.ubuntu.com/pool/main/o/openjdk-6/openjdk-6-jre_6b12-0ubun tu6.5_sparc.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JDK (Linux Production Release) 1.5.0.0_03

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.6.0_02

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

S.u.S.E. openSUSE 11.0

• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-1.5.0 _update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-1.5 .0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-alsa- 1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-als a-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-demo-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-demo- 1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-demo-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-dem o-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-devel -1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-dev el-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-jdbc- 1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-jdb c-1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-plugin-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-plugi n-1.5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_5_0-sun-src-1 .5.0_update20-0.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_5_0-sun-src -1.5.0_update20-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-1.6.0 .u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-1.6 .0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-alsa- 1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-als a-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-demo-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-demo- 1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-demo-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-dem o-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-devel -1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-dev el-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-jdbc- 1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-jdb c-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-plugi n-1.6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-plu gin-1.6.0.u15-0.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/java-1_6_0-sun-src-1 .6.0.u15-0.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.x86_64.rpm
  http://download.opensuse.org/update/11.0/rpm/x86_64/java-1_6_0-sun-src -1.6.0.u15-0.1.x86_64.rpm

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.3mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

VMWare ESX Server 4.0

• VMWare ESX-4.0.0-update01.zip
  https://hostupdate.vmware.com/software/VUM/OFFLINE/release-158-2009111 8-187517/ESX-4.0.0-update01.zip

Sun JRE (Windows Production Release) 1.5.0_13

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.3mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu icedtea6-plugin_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/icedtea6-plugi n_6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-dbg_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-dbg_ 6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-demo_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-demo _6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-doc_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-doc_ 6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jdk_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jdk_ 6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-jre-headless_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- headless_6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-jre-lib_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre- lib_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-jre_6b12-0ubuntu6.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-jre_ 6b12-0ubuntu6.5_i386.deb


• Ubuntu openjdk-6-source-files_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/o/openjdk-6/openjdk-6- source-files_6b12-0ubuntu6.5_all.deb


• Ubuntu openjdk-6-source_6b12-0ubuntu6.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/openjdk-6/openjdk-6-sour ce_6b12-0ubuntu6.5_all.deb

Sun JDK (Windows Production Release) 1.6.0_03

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Solaris Production Release) 1.5.0.0_09

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

S.u.S.E. openSUSE 11.1

• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-1.5.0 _update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-1.5 .0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-alsa- 1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-alsa-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-als a-1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-devel -1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-devel-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-dev el-1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-jdbc- 1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-jdbc-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-jdb c-1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_5_0-sun-plugin-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-plugi n-1.5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_5_0-sun-src-1 .5.0_update20-0.1.1.i586.rpm


• S.u.S.E. java-1_5_0-sun-src-1.5.0_update20-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_5_0-sun-src -1.5.0_update20-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-1.6.0 .u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-1.6 .0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-alsa- 1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-alsa-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-als a-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-devel -1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-devel-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-dev el-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-jdbc- 1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-jdbc-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-jdb c-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-plugi n-1.6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-plugin-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-plu gin-1.6.0.u15-0.1.1.x86_64.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/java-1_6_0-sun-src-1 .6.0.u15-0.1.1.i586.rpm


• S.u.S.E. java-1_6_0-sun-src-1.6.0.u15-0.1.1.x86_64.rpm
  http://download.opensuse.org/update/11.1/rpm/x86_64/java-1_6_0-sun-src -1.6.0.u15-0.1.1.x86_64.rpm

MandrakeSoft Enterprise Server 5

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Sun JDK (Solaris Production Release) 1.6.0_02

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Windows Production Release) 1.5.0_11

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Mandriva Linux Mandrake 2009.0

• Mandriva java-1.6.0-openjdk-1.6.0.0-0.20.b16.0.3mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-demo-1.6.0.0-0.20.b16.0.3mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-devel-1.6.0.0-0.20.b16.0.3mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-javadoc-1.6.0.0-0.20.b16.0.3mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-plugin-1.6.0.0-0.20.b16.0.3mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva java-1.6.0-openjdk-src-1.6.0.0-0.20.b16.0.3mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Sun JRE (Linux Production Release) 1.5.0_14

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Solaris Production Release) 1.5 _05

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.5 .0_05

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Windows Production Release) 1.5 _01

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.5 _02

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Linux Production Release) 1.5

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Windows Production Release) 1.5 _02

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Linux Production Release) 1.5 _03

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.5 _18

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Linux Production Release) 1.5 _15

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Windows Production Release) 1.5 _06

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Solaris Production Release) 1.5

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Linux Production Release) 1.5 .0 beta

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JDK (Linux Production Release) 1.5 _15

• Sun JDK and JRE 5.0 Update 20
  http://java.sun.com/javase/downloads/index_jdk5.jsp

Sun JRE (Linux Production Release) 1.6 _07

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _04

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _11

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6 _05

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JRE (Linux Production Release) 1.6 _04

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

Sun JDK (Linux Production Release) 1.6 _07

• Sun JDK and JRE 6 Update 15
  http://java.sun.com/javase/downloads/index.jsp

VMWare ESX Server 3.0.3

• VMWare ESX350-201003403-SG
  http://download3.vmware.com/software/vi/ESX350-201003403-SG.zip

Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability

References:

• Advance notification of Security Updates for Java SE (Sun)
  
• Integer Overflow Vulnerability in the Java Runtime Environment (JRE) "Unpack200" (Avaya)
  
• Java SE 6 Update Release Notes (Sun)
  
• Java�?� 2 Platform Standard Edition Development Kit 5.0 Update 20 (JDK 5.0 Update (Sun)
  
• Sun's latest Java security alerts (IBM)
  
• iDefense Security Advisory 08.06.09: Sun Java Runtime Environment (JRE) Pack200 (iDefense Labs )
  
• VMSA-2009-0016 VMware vCenter and ESX update release and VMA patch release addre (VMware Security Team )
  
• ZDI-09-049: Sun Java Pack200 Decoding Inner Class Count Integer Overflow Vulnera (ZDI Disclosures )
  
• 263488 Unpack200 (Sun)
  
• Nortel Enterprise Response to Sun Java JDK / JRE Multiple Vulnerabilities (Aug 0 (Nortel Networks)
  
• Oracle Critical Patch Update Advisory - October 2009 (Oracle)
  
• RHSA-2009:1199 java-1.5.0-sun security update (Red Hat)
  
• RHSA-2009:1200 java-1.6.0-sun security update (Red Hat)
  
• RHSA-2009:1201 java-1.6.0-openjdk security and bug fix update (Red Hat)
  
• Sun Java Runtime Environment (JRE) Pack200 Decompression Integer Overflow Vulner (iDefense Labs)
  
• ZDI-09-049: Sun Java Pack200 Decoding Inner Class Count Integer Overflow Vulnera (Zero Day Initiative)