Secunia

Fujitsu has reported two vulnerabilities in Sun Java Plug-in, which can be exploited by malicious people to bypass certain security restrictions or compromise a user's system.

1) An error in the Java Plug-in within the handling of JavaScript calling into Java code can e.g. be exploited by a malicious applet hosted on a web site to access and modify local files or execute local applications.

Successful exploitation requires the Microsoft Internet Explorer browser is used.

The vulnerability has been reported in SDK / JRE version 1.4.2, 1.4.1_06 and prior, all 1.4.0 releases, and 1.3.1_12 and prior for Windows.

2) An error in the way applets on the same web page can interfere with each other can be exploited to e.g. load files and web pages in another applet.

The vulnerability has been reported in SDK / JRE version 1.4.2_05 and prior, all 1.4.1 and 1.4.0 releases, and 1.3.1_12 and prior for Windows, Solaris and Linux.

Solution
JDK and JRE 5.0 is not affected.
Further details available in Customer Area

Provided and/or discovered by
Fujitsu

Original Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1

Deep Links
Links available in Customer Area