OpenJDK "IcedTea" plug-in JNLPSecurityManager Remote Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
OpenJDK 6
Description:
--------------------------------------------------------------------------------
Bugtraq id: 45894
Cve id: CVE-2010-4351

OpenJDK is a cooperation Platform for open source implementation of Java Platform, Standard Edition and related projects.

OpenJDK's IcedTea plug-in has a security vulnerability. Remote attackers can exploit this vulnerability to execute arbitrary code in applications.

The IcedTea. so component has a vulnerability. when processing a applet, the process cannot properly restrict the license code and may create and instantiate a subclass of ClassLoader.

<**>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

OpenJDK
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://openjdk.java.net/