| Package | Affected versions | Patched versions |
|---|---|---|
| jdk | = 5.0= 6≤ 5.0≤ 6 | |
| jre | = 1.4.2_1= 1.4.2_10= 1.4.2_11= 1.4.2_12= 1.4.2_13= 1.4.2_14= 1.4.2_15= 1.4.2_16= 1.4.2_17= 1.4.2_2= 1.4.2_3= 1.4.2_4= 1.4.2_5= 1.4.2_6= 1.4.2_7= 1.4.2_8= 1.4.2_9= 5.0= 6≤ 1.4.2_18≤ 5.0≤ 6 | |
| sdk | = 1.4.2_1= 1.4.2_10= 1.4.2_11= 1.4.2_12= 1.4.2_13= 1.4.2_14= 1.4.2_15= 1.4.2_16= 1.4.2_17= 1.4.2_2= 1.4.2_3= 1.4.2_4= 1.4.2_5= 1.4.2_6= 1.4.2_7= 1.4.2_8= 1.4.2_9≤ 1.4.2_18 |
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free