|
|
|
|
| |
Credit:
The information has been provided by binaryproof.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-085/
|
| |
Vulnerable Systems:
* Oracle Java Runtime
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The flaw exists within jsound!XGetSamplePtrFromSnd. When extracting a sample from a soundbank stream user supplied data is used to calculate the bounds of a call to PV_Swap16BitSamples. By supplying a specially crafted sound file, a remote attacker can exploit this vulnerability to execute arbitrary code under the context of the process.
Patch Availability:
Oracle has issued an update to correct this vulnerability.
More details can be found at:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html
CVE Information:
CVE-2010-4462
Disclosure Timeline:
2010-09-23 - Vulnerability reported to vendor
2011-02-15 - Coordinated public release of advisory
|
|
|
|
|
