Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0679
A number of vulnerabilities have been identified in Java for Mac OS X
29 June 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Java
Publisher: Apple
Operating System: Mac OS X
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2011-0873 CVE-2011-0871 CVE-2011-0869
CVE-2011-0868 CVE-2011-0867 CVE-2011-0865
CVE-2011-0864 CVE-2011-0863 CVE-2011-0862
CVE-2011-0814 CVE-2011-0802
Reference: ASB-2011.0047
Original Bulletin:
http://support.apple.com/kb/HT4738
http://support.apple.com/kb/HT4739
Comment: This bulletin contains two (2) Apple security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2011-06-28-1 Java for Mac OS X 10.6 Update 5
Java for Mac OS X 10.6 Update 5 is now available and addresses the
following:
Java
Available for: Mac OS X v10.6.6 and later,
Mac OS X Server v10.6.6 and later
Impact: Multiple vulnerabilities in Java 1.6.0_24
Description: Multiple vulnerabilities exist in Java 1.6.0_24, the
most serious of which may allow an untrusted Java applet to execute
arbitrary code outside the Java sandbox. Visiting a web page
containing a maliciously crafted untrusted Java applet may lead to
arbitrary code execution with the privileges of the current user.
These issues are addressed by updating to Java version 1.6.0_26.
Further information is available via the Java website at
http://java.sun.com/javase/6/webnotes/ReleaseNotes.html
CVE-ID
CVE-2011-0802
CVE-2011-0814
CVE-2011-0862
CVE-2011-0863
CVE-2011-0864
CVE-2011-0865
CVE-2011-0867
CVE-2011-0868
CVE-2011-0869
CVE-2011-0871
CVE-2011-0873
Java for Mac OS X 10.6 Update 5 may be obtained from the Software
Update pane in System Preferences, or Apple's Software Downloads
web site: http://www.apple.com/support/downloads/
The download file is named: JavaForMacOSX10.6Update5.dmg
Its SHA-1 digest is: 242a3af116c381e091ebee1ddd28beb36c1b4b62
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJOChyJAAoJEGnF2JsdZQeeI0MH/jH3W2A/Q+MFlMlS/rcmDyWo
7DU1E6vjEQru6X+AbsxVBXZPYgNfdWLJ/O7AQ++P8G3xEX+yCGTlSmwxSQ5w94dl
yCXh85b4lGa9x8CCDt4FP3SnQFZ80cn/8kfnh8qS5qapiCNX7mC+H9B3sePuo1/g
0Br0lZWLKMvmRGToM1LFAor7blrKCM2N4ETFcG4O2V5g4AY+p73IZruXgzbElZlU
H0l7xgpc0a+d3QFM/LrZCVkxNbBaooCCHlEgqhwRwAGmBDcVqyTEg2DQBneThQLH
y7PnUZ+JXO1BC81VUFuTX59AHSXX329ixBsFbhgOlf2dYBNZOLbmuM2mw8smUI8=
=fAgH
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2011-06-28-2 Java for Mac OS X 10.5 Update 10
Java for Mac OS X 10.5 Update 10 is now available and addresses the
following:
Java
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8
Impact: Multiple vulnerabilities in Java 1.6.0_24
Description: Multiple vulnerabilities exist in Java 1.6.0_24, the
most serious of which may allow an untrusted Java applet to execute
arbitrary code outside the Java sandbox. Visiting a web page
containing a maliciously crafted untrusted Java applet may lead to
arbitrary code execution with the privileges of the current user.
These issues are addressed by updating to Java version 1.6.0_26.
Further information is available via the Java website at
http://java.sun.com/javase/6/webnotes/ReleaseNotes.html
CVE-ID
CVE-2011-0802
CVE-2011-0814
CVE-2011-0862
CVE-2011-0863
CVE-2011-0864
CVE-2011-0865
CVE-2011-0867
CVE-2011-0868
CVE-2011-0869
CVE-2011-0871
CVE-2011-0873
Java
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8
Impact: Multiple vulnerabilities in Java 1.5.0_28
Description: Multiple vulnerabilities exist in Java 1.5.0_28, the
most serious of which may allow an untrusted Java applet to execute
arbitrary code outside the Java sandbox. Visiting a web page
containing a maliciously crafted untrusted Java applet may lead to
arbitrary code execution with the privileges of the current user.
These issues are addressed by updating to Java version 1.5.0_30.
Further information is available via the Java website at http://www.o
racle.com/technetwork/java/javase/documentation/overview-137139.html
CVE-ID
CVE-2011-0802
CVE-2011-0814
CVE-2011-0862
CVE-2011-0864
CVE-2011-0865
CVE-2011-0867
CVE-2011-0871
CVE-2011-0873
Java for Mac OS X 10.5 Update 10 may be obtained from the Software
Update pane in System Preferences, or Apple's Software Downloads
web site: http://www.apple.com/support/downloads/
The download file is named: JavaForMacOSX10.5Update10.dmg
Its SHA-1 digest is: a4b5fd6d753d83b8798ce8482301647ffd19a629
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJOChxIAAoJEGnF2JsdZQeeNfsIAK8nsutClzYraD6mDmaj8ehj
PjkSOm+5XGCGMCP+oykHu2mZPJgCJW6tnBffVSayj3qPomk1JT4djkmwP+iRgxLU
cfTdwTpRfldhqm8+VND9GBRI6jjD1wGvVWSbai1z3HQ3UuQMosEOatMmIvE3rYtL
jBtLU9dA0uVzSG9SiCBWMls+sme+Oy8n285MAQKKjbkiOgN/lhAA1W430lhuE0HG
+ghDwUA6oWWJskV3irK7l4af6u7jrO9ga9Zqr9PJ5Md0lcKuVAwFSIZxDxiPDKUi
4p+wAqsRK9FsOrimw5+Y2FVdX20GYRbs2wk/hpcETU7NhlpXMpNeeOO4fdQAd+c=
=u6A8
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTgqBAO4yVqjM2NGpAQL78Q//eC1t48fk8e3GFiVm+3sytLh8yKtXzqJk
b38nTUpddyY0bh0oKIkBjYh62cO2LlUaxD3xss8ge3cmAkBkk+Sr3T9ayQI/zuu1
qid+A46re/IONsxt2sZuCOhg29uGkVuyFlIrlU1feRPoywS484GA2qIcsuw1NICz
+QbYE6UERMpSyvEN8aAANnoLYiO9nq/J5QnAuURYM/Am8J0Yg5iDraCADTZpIxUc
kviSRqsoW/cegEkBTS++VHKD9VaRSwSTe5SiytgODkNLeFtvUONCdeX331belSAF
ja4AbhKCr26Pgo8zPivfLorOJdYaIWdZPVlPDSi116ER6TO1PuvUupKOn9xOMF5y
PQvH5Ot4hHZ3afEC6qL4tWjsvGbzCAxkC/2e/xQQvp+wqSqa8FuLUln3gxHUIs4b
YWO4WtXcaBTBWILx/YYLBZzBU5MxmfuNvh2e9EIOR9VMWCvUR3yDoPG9WFpVasvd
pVl5aAYuiqnAEuBl5XHjx2zmvMQJuKXTGXesefJ9PTJgjeuLov7YeyK8jR1DYCvm
+ZF4DzkbfcooanN4HKUCxwo7m+j/S8diUjVnbfgP/HKbuL4m+yn0HQUh5ldqnjnG
jIHrRfGL+6oNz4nGEBWKH65+92O9f0W2rfr56kwyB76Dth4xFIuEwN3DfuobLQhc
jEp+AXU96kI=
=S9MU
-----END PGP SIGNATURE-----