Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jre | Sun | 1.3.1 | 1.3.1 |
| Jre | Sun | 1.3.1_2 | 1.3.1_2 |
| Jre | Sun | 1.3.1_03 | 1.3.1_03 |
| Jre | Sun | 1.3.1_04 | 1.3.1_04 |
| Jre | Sun | 1.3.1_05 | 1.3.1_05 |
| Jre | Sun | 1.3.1_06 | 1.3.1_06 |
| Jre | Sun | 1.3.1_07 | 1.3.1_07 |
| Jre | Sun | 1.3.1_08 | 1.3.1_08 |
| Jre | Sun | 1.3.1_09 | 1.3.1_09 |
| Jre | Sun | 1.3.1_10 | 1.3.1_10 |
| Jre | Sun | 1.3.1_11 | 1.3.1_11 |
| Jre | Sun | 1.3.1_12 | 1.3.1_12 |
| Jre | Sun | 1.3.1_13 | 1.3.1_13 |
| Jre | Sun | 1.3.1_14 | 1.3.1_14 |
| Jre | Sun | 1.3.1_15 | 1.3.1_15 |
| Jre | Sun | 1.3.1_16 | 1.3.1_16 |
| Jre | Sun | 1.3.1_17 | 1.3.1_17 |
| Jre | Sun | 1.3.1_18 | 1.3.1_18 |
| Jre | Sun | 1.3.1_19 | 1.3.1_19 |
| Jre | Sun | 1.3.1_20 | 1.3.1_20 |
| Jre | Sun | 1.3.1_21 | 1.3.1_21 |
| Jre | Sun | 1.3.1_22 | 1.3.1_22 |
| Jre | Sun | 1.3.1_23 | 1.3.1_23 |
| Jre | Sun | 1.4.2 | 1.4.2 |
| Jre | Sun | 1.4.2_1 | 1.4.2_1 |
| Jre | Sun | 1.4.2_2 | 1.4.2_2 |
| Jre | Sun | 1.4.2_3 | 1.4.2_3 |
| Jre | Sun | 1.4.2_4 | 1.4.2_4 |
| Jre | Sun | 1.4.2_5 | 1.4.2_5 |
| Jre | Sun | 1.4.2_6 | 1.4.2_6 |
| Jre | Sun | 1.4.2_7 | 1.4.2_7 |
| Jre | Sun | 1.4.2_8 | 1.4.2_8 |
| Jre | Sun | 1.4.2_9 | 1.4.2_9 |
| Jre | Sun | 1.4.2_10 | 1.4.2_10 |
| Jre | Sun | 1.4.2_11 | 1.4.2_11 |
| Jre | Sun | 1.4.2_12 | 1.4.2_12 |
| Jre | Sun | 1.4.2_13 | 1.4.2_13 |
| Jre | Sun | 1.4.2_14 | 1.4.2_14 |
| Jre | Sun | 1.4.2_15 | 1.4.2_15 |
| Jre | Sun | 1.4.2_16 | 1.4.2_16 |
| Jre | Sun | 1.4.2_17 | 1.4.2_17 |
| Jre | Sun | 1.4.2_18 | 1.4.2_18 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.5.0 | 1.5.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Jre | Sun | 1.6.0 | 1.6.0 |
| Extras for RHEL 4 | RedHat | java-1.6.0-sun-1:1.6.0.11-1jpp.1.el4 | * |
| Extras for RHEL 4 | RedHat | java-1.5.0-sun-0:1.5.0.17-1jpp.2.el4 | * |
| Extras for RHEL 4 | RedHat | java-1.5.0-ibm-1:1.5.0.9-1jpp.4.el4 | * |
| Extras for RHEL 4 | RedHat | java-1.6.0-ibm-1:1.6.0.4-1jpp.1.el4 | * |
| Red Hat Network Satellite Server v 5.2 | RedHat | java-1.5.0-ibm-1:1.5.0.9-1jpp.4.el4 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.6.0-sun-1:1.6.0.11-1jpp.1.el5 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.5.0-sun-0:1.5.0.17-1jpp.2.el5 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.5.0-ibm-1:1.5.0.9-1jpp.2.el5 | * |
| Supplementary for Red Hat Enterprise Linux 5 | RedHat | java-1.6.0-ibm-1:1.6.0.4-1jpp.1.el5 | * |
| Sun-java5 | Ubuntu | dapper | * |
| Sun-java5 | Ubuntu | gutsy | * |
| Sun-java5 | Ubuntu | hardy | * |
| Sun-java5 | Ubuntu | intrepid | * |
| Sun-java5 | Ubuntu | jaunty | * |
| Sun-java6 | Ubuntu | devel | * |
| Sun-java6 | Ubuntu | gutsy | * |
| Sun-java6 | Ubuntu | hardy | * |
| Sun-java6 | Ubuntu | intrepid | * |
| Sun-java6 | Ubuntu | jaunty | * |
| Sun-java6 | Ubuntu | karmic | * |