----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

13 days left of beta period.

The 1st generation of the Secunia Network Software Inspector (NSI)
has been available for corporate users for almost 1 year and its been
a tremendous success.

The 2nd generation Secunia NSI is built on the same technology as the
award winning Secunia PSI, which has already been downloaded and
installed on more than 400,000 computers world wide.

Learn more / Download (instant access):
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
BEA JRockit Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA29841

VERIFY ADVISORY:
http://secunia.com/advisories/29841/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, DoS, System access

WHERE:
>From remote

SOFTWARE:
BEA JRockit 1.x
http://secunia.com/product/13274/

DESCRIPTION:
Some vulnerabilities have been reported in BEA JRockit, which can be
exploited by malicious people to bypass certain security
restrictions, cause a DoS (Denial of Service), or compromise a user's
system.  

1) An error in the processing of external XML entity references can
be exploited to access restricted URLs or trigger a crash.

For more information:
SA28746

2) Multiple unspecified errors in the handling of Java applets can be
exploited to read, write, or execute local files.

For more information:
SA28795

3) An unspecified error in the processing of XSLT transformations can
be exploited to access certain URLs and potentially execute arbitrary
code.  

For more information see vulnerability #2 in:
SA29239

4) An unspecified error in the Java Plug-in can be exploited to
execute local applications.

For more information see vulnerability #8 in:
SA29239

5) Multiple errors in the processing of ICC profiles can be exploited
to write local files and execute local applications.

For more information see vulnerability #9 in:
SA29239

The vulnerabilities are reported in BEA JRockit R27.5.0 and prior.

SOLUTION:
Apply vendor patches (please see the vendor's advisory for more
details).

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://dev2dev.bea.com/pub/advisory/277

OTHER REFERENCES:
SA28746:
http://secunia.com/advisories/28746/

SA28795:
http://secunia.com/advisories/28795/

SA29239:
http://secunia.com/advisories/29239/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------