Security Bulletin: Potential security vulnerability for the Oracle June 2012 CPU (CVE-2012-1713) shipped with Rational Developer for System z

Summary

IBM Rational Developer for System z is shipped with an IBM Java that is based on the Oracle Java. Oracle has released a June 2012 critical patch updates (CPU) which contain security vulnerability fixes and the IBM Java is affected.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID:CVE-2012-1713
**
Description: **This issue involves a buffer overrun in the Java platform’s Font parsing code. An attacker can potentially place arbitrary data into any location on the host machine using a maliciously crafted font file.

This issue involves an internal cache in the Java platform’s font scaling code, which may incorrectly be freed from memory by one part of the code (on an error condition) while it is still in use by another. This scenario will usually lead to a crash.

An attacker may access arbitrary data within the process address space by crafting a malicious font with invalid character map (CMAP) data. Specifically, an attacker can inject an offset which points to a location outside the CMAP data block.

An attacker is potentially be able to pass execution to arbitrary code under certain circumstances via a malicious font file containing a specially crafted hinting program.
** **CVSS Base Score: 10 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/76239&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: Undefined

Remediation/Fixes

Upgrade to Rational Developer for System z 8.5.1 which includes an updated IBM Java version which addresses these security issues.

Workarounds and Mitigations

None