site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2006-04-18 J2SE 5.0 Release 4 J2SE 5.0 Release 4 is now available for Mac OS X v10.4.5 and provides fixes for the following security issues: CVE-ID: CVE-2006-0613 Available for: Mac OS X v10.4.5, Mac OS X Server v10.4.5 Impact: Untrusted Java applications may obtain elevated privileges. Description: A security vulnerability in Java Web Start may allow an untrusted application to elevate its privileges. This update addresses the issue by providing J2SE version 1.5.0_06, which is not susceptible to this vulnerability. For additional information on this issue see Sun Alert 102170 (http:// sunsolve.sun.com/search/document.do?assetkey=1-26-102170-1) CVE-ID: CVE-2006-0614, CVE-2006-0615, CVE-2006-0616, CVE-2006-0617 Available for: Mac OS X v10.4.5, Mac OS X Server v10.4.5 Impact: Untrusted Java applets may obtain elevated privileges. Description: Security vulnerabilites related to the use of "reflection" APIs in the Java Runtime Environment may allow an untrusted applet to elevate its privileges. This update addresses these issues by providing J2SE version 1.5.0_06, which is not susceptible to these vulnerabilities. For additional information on these issues see Sun Alert 102171 (http:// sunsolve.sun.com/search/document.do?assetkey=1-26-102171-1) Additionally, a minor security-related fix for Java InputMethods is included in this update. Due to an issue handling input method events, it is possible that key events intended for a secure field such as a password field may be sent to a normal text field in the same window. This could result in accidental password disclosure to others physically present when the password is entered. This update addresses the problem by properly handling input method events. J2SE 5.0 Release 4 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: For Mac OS X v10.4.5 (PowerPC) and Mac OS X Server v10.4.5: http://www.apple.com/support/downloads/j2se50release4ppc.html The download file is named: "J2SE50Release4.dmg" Its SHA-1 digest is: db3d87ead4adab3e8435bad442b93663bbb54b40 For Mac OS X v10.4.5 (Intel): http://www.apple.com/support/downloads/j2se50release4intel.html The download file is named: "J2SE50Release4.dmg" Its SHA-1 digest is: 12f0fba2946121a8414fea58526841e0903d4204 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.5 (Build 5050) iQEVAwUBREVjfYHaV5ucd/HdAQLO8gf/VxqnYvmFT8mEMvpRV5bNFTpzJNSLAYXT SgHbNe5leLjdy2L4cYJEl4ueDFn0lm89Me3uRbl9Wx3YP1urFVBVlpda7oTMRMxF jCLAIu20uUDbe/yGeD7hKarVSZ3V8MzpmzODphL3zTx7oZ4gCLVBA/nYoIutter/ K6W8YsUGjx8nkwsk/AewuXTKvWOdVpyTAUQyGp1+K8hxx+JOBzSYEbc6LqIm/BxC CWpOXUi7jFOLrVOQQ9H7FC9uTz+cHVS1e7sTMZ4vAOLrg/OzSNWTrUNcKH8Mo5/H g7VOCDHyag5//kjHvl+91bPHQuAX9gu7dPuK4zohpZPNCtOWvKcKRg== =+JLi -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40lis... This email sent to site_archiver@lists.apple.com