ID

VAR-201206-0061

CVE

CVE-2012-1711

TITLE

Oracle Java SE of Java Runtime Environment (JRE) In CORBA Processing vulnerability

DESCRIPTION

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to CORBA. (DoS) An attack may be carried out. Oracle Java SE is prone to a remote vulnerability in Java Runtime Environment. The vulnerability can be exploited over multiple protocols. This issue affects the 'CORBA' sub-component. This vulnerability affects the following supported versions: 7 Update 4, 6 Update 32, 5 Update 35, 1.4.2_37. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-06-12-1 Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 is now available and addresses the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.4, OS X Lion Server v10.7.4 Impact: Multiple vulnerabilities in Java Description: Multiple vulnerabilities exist in Java, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. These issues are addressed by updating to Java version 1.6.0_33. Further information is available via the Java website at http://www.o racle.com/technetwork/java/javase/releasenotes-136954.html CVE-ID CVE-2012-0551 CVE-2012-1711 CVE-2012-1713 CVE-2012-1716 CVE-2012-1718 CVE-2012-1719 CVE-2012-1721 CVE-2012-1722 CVE-2012-1723 CVE-2012-1724 CVE-2012-1725 Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: The Java browser plugin and Java Web Start are deactivated if they remain unused for 35 days Description: As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they are unused for 35 days. Users may re-enable Java if they encounter Java applets on a web page or Java Web Start applications by clicking the region labeled "Inactive plug-in" on a web page. This security measure is also available for OS Lion systems if the prior update "Java for OS X 2012-003" was not installed. Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.4, OS X Lion Server v10.7.4 Impact: The Java browser plugin and Java Web Start are deactivated if they do not meet the criteria for minimum safe version Description: As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they do not meet the criteria for minimum safe version. The minimum safe version of Java is updated daily, as needed. Note: These updates include the security content from Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8. Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 systems The download file is named: JavaForMacOSX10.6.dmg Its SHA-1 digest is: c2fcc844b7073d8243588f3407eb3ce1d497043d For OS X Lion systems The download file is named: JavaForOSX.dmg Its SHA-1 digest is: f176546327bc62d8cd397d54d1dc22b72aee1d2b Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJP15giAAoJEPefwLHPlZEw0JUQAI8bP4nvp9BgEyc8K2Z1GrKW sH0nTQtVCei8yF/ORZh7bnxTgANx/kbcwyy/+rfRuU0cKCryvIH5I6Odjt4qE17q Kqa/L8Xsl3pBdEwRVbo2rvy5IAVB32L8fUMfcQ4mweYeimTilR/+O9qQnFChZiEU KZgLCGDmBbGqhP/P/g9CM9G+g2rC+nG/07U8MN9nk0Mfio2mHxMSxFy96b4DK3TX g5R6nYOth+GEQPCC0+O7zKoVViL/6xLxvrnuGQL9uYizDgYLpfIHAyDUTJy27yVb t6ggjZIfMMKEL2uQAKh/1WlLN7oMfyYyIJkdKmjb9ZYRIia3brlmlDsEzoIH7DSr fdOJ/zUDHn6qvrRktdNhNJWI6z6XY6EzDWe+HnCbZvifqK7oiAtRJo7BcFeMFQS8 wDFLGebzr2YRFV+5Oa3hxDmGzXvl2B0FQ/T2PSOUraUuj14LSA1H/ekD7MrSo+09 tNDK2C3VpVY5eK7gjxFX8+hWT1w/x3jyIPWA7fCOzG6BM27FnQBuroFTTLlEmsev yV1Mcnd+KBgS194yu29gzbApOAQBHLT5epps1n/omIfQoKAfjfN66KM+dgl9e7uB 6s3s4sRCzQX8XtYlnC0PRG050R2lkO16k9UddZ/0CqE4pegIiIcvWtt4MB3jxMxr lTEVodir4Ubn3QZQ0SK7 =J235 -----END PGP SIGNATURE----- . * S7143872, CVE-2012-1718: Improve certificate extension processing * S7143851, CVE-2012-1719: Improve IIOP stub and tie generation in RMIC * S7152811, CVE-2012-1723: Issues in client compiler * S7157609, CVE-2012-1724: Issues with loop * S7160757, CVE-2012-1725: Problem with hotspot/runtime_classfile * S7110720: Issue with vm config file loadingIssue with vm config file loading * S7145239: Finetune package definition restriction * S7160677: missing else in fix for 7152811 The updated packages provides icedtea6-1.11.3 which is not vulnerable to these issues. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFP3v0dmqjQ0CJFipgRApUEAKDuHyqURe7mAlzYzLRgK4SCCjmaxACgqxmR y5zs168WwioVV48Wj1lIeDQ= =9Eet -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.7.0-openjdk security and bug fix update Advisory ID: RHSA-2012:1009-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1009.html Issue date: 2012-06-20 CVE Names: CVE-2012-1711 CVE-2012-1713 CVE-2012-1716 CVE-2012-1717 CVE-2012-1718 CVE-2012-1719 CVE-2012-1723 CVE-2012-1724 CVE-2012-1725 CVE-2012-1726 ===================================================================== 1. Summary: Updated java-1.7.0-openjdk packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64 3. Description: These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit. Multiple flaws were discovered in the CORBA (Common Object Request Broker Architecture) implementation in Java. A malicious Java application or applet could use these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711, CVE-2012-1719) It was discovered that the SynthLookAndFeel class from Swing did not properly prevent access to certain UI elements from outside the current application context. A malicious Java application or applet could use this flaw to crash the Java Virtual Machine, or bypass Java sandbox restrictions. (CVE-2012-1716) Multiple flaws were discovered in the font manager's layout lookup implementation. A specially-crafted font file could cause the Java Virtual Machine to crash or, possibly, execute arbitrary code with the privileges of the user running the virtual machine. (CVE-2012-1713) Multiple flaws were found in the way the Java HotSpot Virtual Machine verified the bytecode of the class file to be executed. A specially-crafted Java application or applet could use these flaws to crash the Java Virtual Machine, or bypass Java sandbox restrictions. (CVE-2012-1723, CVE-2012-1725) It was discovered that java.lang.invoke.MethodHandles.Lookup did not properly honor access modes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2012-1726) It was discovered that the Java XML parser did not properly handle certain XML documents. An attacker able to make a Java application parse a specially-crafted XML file could use this flaw to make the XML parser enter an infinite loop. (CVE-2012-1724) It was discovered that the Java security classes did not properly handle Certificate Revocation Lists (CRL). CRL containing entries with duplicate certificate serial numbers could have been ignored. (CVE-2012-1718) It was discovered that various classes of the Java Runtime library could create temporary files with insecure permissions. A local attacker could use this flaw to gain access to the content of such temporary files. (CVE-2012-1717) This update also fixes the following bug: * Attempting to compile a SystemTap script using the jstack tapset could have failed with an error similar to the following: error: the frame size of 272 bytes is larger than 256 bytes This update corrects the jstack tapset and resolves this issue. (BZ#833035) This erratum also upgrades the OpenJDK package to IcedTea7 2.2.1. Refer to the NEWS file, linked to in the References, for further information. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 829354 - CVE-2012-1711 OpenJDK: improper protection of CORBA data models (CORBA, 7079902) 829358 - CVE-2012-1717 OpenJDK: insecure temporary file permissions (JRE, 7143606) 829360 - CVE-2012-1716 OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) 829361 - CVE-2012-1713 OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) 829371 - CVE-2012-1719 OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) 829372 - CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) 829373 - CVE-2012-1723 OpenJDK: insufficient field accessibility checks (HotSpot, 7152811) 829374 - CVE-2012-1724 OpenJDK: XML parsing infinite loop (JAXP, 7157609) 829376 - CVE-2012-1725 OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) 829377 - CVE-2012-1726 OpenJDK: java.lang.invoke.MethodHandles.Lookup does not honor access modes (Libraries, 7165628) 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm i386: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.i686.rpm x86_64: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm i386: java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.i686.rpm noarch: java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.noarch.rpm x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm noarch: java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.noarch.rpm x86_64: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm i386: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.i686.rpm x86_64: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm i386: java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.i686.rpm noarch: java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.noarch.rpm x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm i386: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.i686.rpm x86_64: java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/java-1.7.0-openjdk-1.7.0.5-2.2.1.el6_3.src.rpm i386: java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.i686.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.i686.rpm noarch: java-1.7.0-openjdk-javadoc-1.7.0.5-2.2.1.el6_3.noarch.rpm x86_64: java-1.7.0-openjdk-debuginfo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.5-2.2.1.el6_3.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.5-2.2.1.el6_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-1711.html https://www.redhat.com/security/data/cve/CVE-2012-1713.html https://www.redhat.com/security/data/cve/CVE-2012-1716.html https://www.redhat.com/security/data/cve/CVE-2012-1717.html https://www.redhat.com/security/data/cve/CVE-2012-1718.html https://www.redhat.com/security/data/cve/CVE-2012-1719.html https://www.redhat.com/security/data/cve/CVE-2012-1723.html https://www.redhat.com/security/data/cve/CVE-2012-1724.html https://www.redhat.com/security/data/cve/CVE-2012-1725.html https://www.redhat.com/security/data/cve/CVE-2012-1726.html https://access.redhat.com/security/updates/classification/#important http://icedtea.classpath.org/hg/release/icedtea7-2.2/file/icedtea-2.2.1/NEWS http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFP4bdMXlSAg2UNWIIRAgLZAJ4rVT0qeWA3N7RGN/RRjkpcTqtF4wCeNbiZ 7KUEsZqVLjXnfpCmLH3lpCM= =GGr3 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: uCosminexus Products Multiple Vulnerabilities SECUNIA ADVISORY ID: SA49578 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49578/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49578 RELEASE DATE: 2012-06-15 DISCUSS ADVISORY: http://secunia.com/advisories/49578/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49578/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49578 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Hitachi has acknowledged multiple vulnerabilities in uCosminexus products, which can be exploited by malicious, local users to disclose potentially sensitive information, manipulate certain data, and cause a DoS (Denial of Service) and by malicious people to conduct cross-site scripting attacks, disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system. The vulnerabilities are caused due to vulnerabilities in the bundled version of Cosminexus Developer's Kit for Java. For more information: SA49472 Please see the vendor's advisory for a list of affected products. ORIGINAL ADVISORY: HS12-015: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-015/index.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Content-Disposition: inline ============================================================================ Ubuntu Security Notice USN-1505-1 July 13, 2012 icedtea-web, openjdk-6 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS Summary: Several security issues were fixed in OpenJDK 6. (CVE-2012-1724) As part of this update, the IcedTea web browser applet plugin was updated for Ubuntu 10.04 LTS, Ubuntu 11.04, and Ubuntu 11.10. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: openjdk-6-jre 6b24-1.11.3-1ubuntu0.12.04.1 Ubuntu 11.10: icedtea-6-plugin 1.2-2ubuntu0.11.10.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.11.10.1 Ubuntu 11.04: icedtea-6-plugin 1.2-2ubuntu0.11.04.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.11.04.1 Ubuntu 10.04 LTS: icedtea-6-plugin 1.2-2ubuntu0.10.04.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.10.04.1 This update uses a new upstream release, which includes additional bug fixes. Further information about these flaws can be found on the Oracle Java SE Critical Patch page, listed in the References section

AFFECTED PRODUCTS