Sun Java Multiple Code Execution and Security Bypass Vulnerabilities

Multiple vulnerabilities have been identified in Sun Java, which could be exploited by attackers to bypass security restrictions, disclose sensitive information, cause a denial of service, or compromise an affected system.

1. An errors when decoding DER encoded data and parsing HTTP headers, which may allow a remote client to cause the JRE on the server to run out of memory, creating a denial of service condition.

2. An error when verifying HMAC digests, which may allow authentication to be bypassed via a forged digital signature.

3. An error in the Java Web Start Installer, which may be leveraged to allow an untrusted Java Web Start application to run as a trusted application and execute arbitrary code.

4. An error in the Java Runtime Environment Deployment Toolkit, which could be exploited by malicious web sites to execute arbitrary commands.

5. An error in the Java Runtime Environment Java Update mechanism, when running on non-English versions of the Windows operating system, not updating the JRE when a new version is available.

Various buffer and integer overflow errors exist within the processing of malformed audio and image files, which may allow an untrusted applet or Java Web Start application to escalate privileges and execute arbitrary code or read/write local files.