News and Trends
SHARE
Facebook X Pinterest WhatsApp

Sun Fixes Critical Java Plug-In Flaws

A pair of vulnerabilities in the Sun Java Plug-In technology could put users at risk of system bypass attacks, Sun Microsystems Inc. confirmed Thursday. The Santa Clara, Calif.-based company said the more serious of the two vulnerabilities could allow an untrusted applet to elevate privileges through JavaScript calling into Java code. For example, an untrusted […]

Written By
thumbnail Ryan Naraine
Ryan Naraine
Jan 20, 2005
Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

A pair of vulnerabilities in the Sun Java Plug-In technology could put users at risk of system bypass attacks, Sun Microsystems Inc. confirmed Thursday.

The Santa Clara, Calif.-based company said the more serious of the two vulnerabilities could allow an untrusted applet to elevate privileges through JavaScript calling into Java code. For example, an untrusted applet may grant itself permissions to read and write local files, or may execute local applications that are accessible to the user running the untrusted applet.

A second bug may allow an untrusted applet to inappropriately interfere with another applet in the same Web page, the company said, noting that the interference may cause the applet to incorrectly load non-code resources such as files and Web pages.

The Java Plug-in technology is included as part of the Java 2 Runtime Environment, Standard Edition (JRE). It is used to establish a connection between popular browsers and the Java platform, allowing applets on Web sites to be run within a browser on the desktop.

Independent security research firm Secunia rates the flaws as “extremely critical,” and it is urging users to apply the vendor patches immediately.

Affected products include Sun Java JRE 1.3.x, Sun Java JRE 1.4.x, Sun Java SDK 1.3.x and Sun Java SDK 1.4.x.

Check out eWEEK.com’s for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.

thumbnail Ryan Naraine

Recommended for you...

thumbnail Cisco Targets Critical Infrastructure Needs for AI Era
Infrastructure
Cisco Targets Critical Infrastructure Needs for AI Era
Victoria Durgin
Nov 3, 2025
thumbnail Cork Marks Three Years Linking MSPs to SMB Cyber Resilience
Security
Cork Marks Three Years Linking MSPs to SMB Cyber Resilience
Victoria Durgin
Oct 31, 2025
thumbnail Amazon Cuts 14,000 Corporate Jobs Amid AI Push
Channel Analysis
Amazon Cuts 14,000 Corporate Jobs Amid AI Push
Allison Francis
Oct 29, 2025
thumbnail Caylent and Trek10 Join Forces in AWS Partner M&A Deal
Mergers & Acquisitions
Caylent and Trek10 Join Forces in AWS Partner M&A Deal
Allison Francis
Oct 27, 2025
Channel Insider Logo

Channel Insider combines news and technology recommendations to keep channel partners, value-added resellers, IT solution providers, MSPs, and SaaS providers informed on the changing IT landscape. These resources provide product comparisons, in-depth analysis of vendors, and interviews with subject matter experts to provide vendors with critical information for their operations.

facebook
linkedin
youtube
rss
spotify
x

Company

About us Contact us Advertise with us

Categories

Channel Business Security AI Infrastructure Lists & Awards Resources

Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

Terms of Service Privacy Policy California - Do Not Sell My Information