Secunia

Some vulnerabilities have been reported in BEA JRockit, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), or compromise a user's system.

1) An error in the processing of external XML entity references can be exploited to access restricted URLs or trigger a crash.

For more information:
SA28746

2) Multiple unspecified errors in the handling of Java applets can be exploited to read, write, or execute local files.

For more information:
SA28795

3) An unspecified error in the processing of XSLT transformations can be exploited to access certain URLs and potentially execute arbitrary code.

For more information see vulnerability #2 in:
SA29239

4) An unspecified error in the Java Plug-in can be exploited to execute local applications.

For more information see vulnerability #8 in:
SA29239

5) Multiple errors in the processing of ICC profiles can be exploited to write local files and execute local applications.

For more information see vulnerability #9 in:
SA29239

The vulnerabilities are reported in BEA JRockit R27.5.0 and prior.

Solution
Apply vendor patches (please see the vendor's advisory for more details).

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://dev2dev.bea.com/pub/advisory/277

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area