Nortel Response to Sun Java JDK / JRE Multiple Vulnerabilities
| Description: |
Sun Microsystems has recently issued multiple alerts dealing with potential security vulnerabilities in Java, JRE and JDK. These potential vulnerabilities can be exploited by malicious people to bypass certain security restrictions, disclose system information or potentially sensitive information, cause a DoS (Denial of Service), or compromise a vulnerable system. Some Nortel products contain this software as a component and therefore are potentially affected by these issues. This bulletin provides a multi-product consolidated response for the Nortel products which are potentially affected. Please refer to the Resolution section of this bulletin for per-product recommendations on what actions to take in response to these issues. Following is a summary of the alerts and their associated CVEs: 1) Sun Alert ID: 238628 http://sunsolve.sun.com/search/document.do?assetkey=1-66-238628-1 Title: Security Vulnerabilities in the Java Runtime Environment related to the processing of XML Data - CVE-2008-3105 Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application. - CVE-2008-3106 Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105. 2) Sun Alert ID: 238666 http://sunsolve.sun.com/search/document.do?assetkey=1-66-238666-1 Title: A Security Vulnerability with the processing of fonts in the Java Runtime Environment may allow Elevation of Privileges - CVE-2008-3108 Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_ |
| Type: |
Security Advisories |
| Number: |
2008008988, Rev 1 |
| Status: |
Retired |
| Date: |
2008-08-14 |
