Note: This is an archival copy of Security Sun Alert 254608 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020228.1.
Date of Resolved Release
Security Vulnerabilities in the Java Runtime Environment (JRE) With Storing and Processing Font Files May Allow Denial of Service (DOS)
Two security vulnerabilities in the Java Runtime Environment (JRE) with storing and processing temporary font files may allow an untrusted applet or Java Web Start application to consume a disproportionate amount of disk space resulting in a Denial of Service (DoS) condition.
Sun acknowledges with thanks, Marc Schoenefeld for bringing the first issue to our attention.
2. Contributing Factors
These issues can occur in the following Java SE and Java SE for Business releases for Windows, Solaris, and Linux:
To determine the default version of the JRE that Internet Explorer uses, visit the URL:
To determine the default version of the JRE that Mozilla or Firefox browsers use, visit the URL "about:plugins".
The browser will display a page called "Installed plug-ins" which lists the version of the Java Plug-in, as in the following example:
Java(TM) Platform SE 6 U11
The above example indicates the version of the JRE that the browser uses is version 6 Update 11.
For both issues, the system may become unresponsive due to high disk space utilization.
There are no workarounds for these issues. Please see the "Resolution" section below.
These issues are addressed in the following Java SE and Java SE for Business releases for Windows, Solaris, and Linux:
SDK and JRE 1.4.2_20 or later
Java SE releases are available at:
JDK and JRE 6 Update 13:
JRE 6 Update 13:
Through the Java Update tool for Microsoft Windows users
JDK 6 Update 13 for Solaris is available in the following patches:
JDK 5.0 Update 18 for Solaris is available in the following patches:
1. Java SE releases SDK and JRE 1.4.2 have completed the Sun End of Service Life (EOSL) process. Sun recommends that users upgrade to the latest Java SE release. Customers interested in continuing to receive critical fixes on SDK and JRE 1.4.2 are encouraged to migrate to Java SE for Business.
2. When installing a new version of the product from a source other than a Solaris patch, it is recommended that the old affected versions be removed from your system. To remove old affected versions on the Windows platform, please see:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
Sun Java Standard Edition (Java SE)
This solution has no attachment