A security vulnerability in the Java Runtime Environment (JRE) related to deserializing calendar objects may allow an untrusted applet or application to escalate privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet.
Classification
Location:
Local / Remote
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Public,
Exploit Commercial
Disclosure:
Vendor Verified
Solution
Upgrade to version JDK/JRE 5.0 Update 17, JDK/JRE 6 Update 11, SDK/JRE 1.4.2_19, SDK/JRE 1.3.1_24 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
