Some vulnerabilities have been reported and acknowledged in Java for Mac OS X, which can be exploited by malicious people to cause a DoS (Denial of Service), to bypass certain security restrictions, disclose system information or potentially sensitive information, or to compromise a vulnerable system.

1) An error leading to the use of an uninitialized variable exists in the hash-based Message Authentication Code (HMAC) provider. This can potentially be exploited to execute arbitrary code when a user visits a web page containing a specially crafted java applet.

2) An error in the Java plug-in within the handling of "file://" URLs can be exploited to launch local files when a user visits a web page containing a specially crafted java applet.

Mac OS X 10.4 is reportedly not affected.

3) Some vulnerabilities in Java 1.4.2_16 and Java 1.5.0_13 can be exploited by malicious people to cause a DoS (Denial of Service), to bypass certain security restrictions, disclose system information or potentially sensitive information, or to compromise a vulnerable system.

For more information:
SA29239
SA31010

Solution
-- Java for Mac OS X 10.4 --
Further details available to Secunia VIM customers

Provided and/or discovered by
1) The vendor credits Radim Marek.
2) The vendor credits Nitesh Dhanjani and Billy Rios.

Original Advisory
Apple:
http://support.apple.com/kb/HT3179
http://support.apple.com/kb/HT3178

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers