The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment andthe IBM Java 2 Software Development Kit.A flaw was found in the Java Management Extensions (JMX) management agent.When local monitoring is enabled, remote attackers could use this flaw toperform illegal operations. (CVE-2008-3103) Several flaws involving the handling of unsigned applets were found. Aremote attacker could misuse an unsigned applet in order to connect toservices on the host running the applet. (CVE-2008-3104)Several flaws in the Java API for XML Web Services (JAX-WS) client and theJAX-WS service implementation were found. A remote attacker who could causemalicious XML to be processed by an application could access URLs, or causea denial of service. (CVE-2008-3105, CVE-2008-3106)Several flaws within the Java Runtime Environment (JRE) scripting supportwere found. A remote attacker could grant an untrusted applet extendedprivileges, such as reading and writing local files, executinglocal programs, or querying the sensitive data of other applets.(CVE-2008-3109, CVE-2008-3110)A flaw in Java Web Start was found. Using an untrusted Java WebStart application, a remote attacker could create or delete arbitraryfiles with the permissions of the user running the untrusted application.(CVE-2008-3112)A flaw in Java Web Start when processing untrusted applications was found.An attacker could use this flaw to acquire sensitive information, such asthe location of the cache. (CVE-2008-3114)All users of java-1.6.0-ibm are advised to upgrade to these updatedpackages, containing the IBM 1.6.0 SR2 Java release, which resolves theseissues.