Critical Flaws Found in Java Development Kit

May 18, 2007

The two flaws could be exploited remotely by hackers, with one resulting in the possible execution of code.

Two vulnerabilities open to remote exploitation by hackers have been found in Java Development Kit, one of which could be used to take over a compromised system.

JDK (Java Development Kit) is a software development tool made by Sun Microsystems specifically for Java users. The vulnerabilities were rated "critical" by FrSIRT (French Security Incident Response Team), a security research organization based in France.

One flaw is caused by an integer overflow error in the image parser when processing ICC profiles embedded within JPEG images, according to FrSIRT researchers.

Security experts at Secunia outlined the dangers of the flaw in a separate advisory. "This can be exploited to crash the JVM and potentially allow the execution of arbitrary code by e.g. tricking an application using the JDK to process a malicious image file," Secunia security experts stated.

The second vulnerability is caused by an error in the BMP image parser when processing malformed files on Unix/Linux systems, which could be exploited by attackers to cause a denial of service. Both flaws affect Sun JDK version 1.x.

Users can find an answer to both vulnerabilities by upgrading to JDK versions 1.5.0_11-b03 or 1.6.0_01-b06.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: The new Candy Crush? Chinese language apps make learning a game

add to favorites email to friend print save as pdf

Related Stories

iWorm hack shows Macs are vulnerable too

Oct 08, 2014

The computer operating systems and applications we use today have often evolved over many years, decades even, and contain tens or hundreds of millions of lines of code. Flaws in that code – and there will ...

Indonesia enlists wasps in war on crop killer

Sep 24, 2014

They are the size of a pinhead and don't even pack a sting, but these tiny wasps are cold-blooded killers nonetheless. They work as nature's SWAT team, neutralizing a pest that threatens to destroy one of ...

For secure software: X-rays instead of passport control

Aug 21, 2014

Trust is good, control is better. This also applies to the security of computer programs. Instead of trusting "identification documents" in the form of certificates, JOANA, the new software analysis tool, examines the source ...

Recommended for you

New app first to use gesture for language learning

Jan 29, 2015

While you might think a person shaking her phone or tablet from side to side is having issues with the device, she might actually be playing a game that has her mimicking a steering wheel motion as part of ...

Linux distrib vendors make patches available for GHOST

Jan 29, 2015

Qualys said on Tuesday that there was a serious weakness in the Linux glibc library. During a code audit, Qualys researchers discovered a buffer overflow in the __nss_hostname_digits_dots() function of glibc. ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.