Sun patches flaw vulnerable to malicious image files

A flaw has been reported in Sun Microsystems Java Runtime Environment that can be exploited by a malicious user to compromise an affected system. The flaw is caused by an error when processing GIF image files. Attackers can exploit the vulnerability to cause a heap-based buffer overflow through a specially-created malicious image file.

Vulnerability tracking firm Secunia has rated the flaw "highly critical," meaning it can be exploited without user interaction, but there are no known exploits in the wild.

The flaw exists in DJK and JRE Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier and SDK and JRE 1.3.1_18 and earlier, and was first reported to Sun in June, according to 3Com's Zero Day Initiative.