These packages provide the OpenJDK 6 Java Runtime Environment and theOpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE)contains the software and tools that users need to run applications writtenusing the Java programming language.An integer overflow flaw and buffer overflow flaws were found in the waythe JRE processed image files. An untrusted applet or application could usethese flaws to extend its privileges, allowing it to read and write localfiles, as well as to execute local applications with the privileges of theuser running the applet or application. (CVE-2009-3869, CVE-2009-3871,CVE-2009-3873, CVE-2009-3874)An information leak was found in the JRE. An untrusted applet orapplication could use this flaw to extend its privileges, allowing it toread and write local files, as well as to execute local applications withthe privileges of the user running the applet or application. (CVE-2009-3881)It was discovered that the JRE still accepts certificates with MD2 hashsignatures, even though MD2 is no longer considered a cryptographicallystrong algorithm. This could make it easier for an attacker to create amalicious certificate that would be treated as trusted by the JRE. Withthis update, the JRE disables the use of the MD2 algorithm insidesignatures by default. (CVE-2009-2409)A timing attack flaw was found in the way the JRE processed HMAC digests.This flaw could aid an attacker using forged digital signatures to bypassauthentication checks. (CVE-2009-3875)Two denial of service flaws were found in the JRE. These could be exploitedin server-side application scenarios that process DER-encoded(Distinguished Encoding Rules) data. (CVE-2009-3876, CVE-2009-3877)An information leak was found in the way the JRE handled color profiles. Anattacker could use this flaw to discover the existence of files outside ofthe color profiles directory. (CVE-2009-3728)A flaw in the JRE with passing arrays to the X11GraphicsDevice API wasfound. An untrusted applet or application could use this flaw to access andmodify the list of supported graphics configurations. This flaw could alsolead to sensitive information being leaked to unprivileged code.(CVE-2009-3879)It was discovered that the JRE passed entire objects to the logging API.This could lead to sensitive information being leaked to either untrustedor lower-privileged code from an attacker-controlled applet which hasaccess to the logging API and is therefore able to manipulate (read and/orcall) the passed objects. (CVE-2009-3880)Potential information leaks were found in various mutable static variables.These could be exploited in application scenarios that execute untrustedscripting code. (CVE-2009-3882, CVE-2009-3883)An information leak was found in the way the TimeZone.getTimeZone methodwas handled. This method could load time zone files that are outside of the[JRE_HOME]/lib/zi/ directory, allowing a remote attacker to probe the localfile system. (CVE-2009-3884)Note: The flaws concerning applets in this advisory, CVE-2009-3869,CVE-2009-3871, CVE-2009-3873, CVE-2009-3874, CVE-2009-3879, CVE-2009-3880,CVE-2009-3881 and CVE-2009-3884, can only be triggered injava-1.6.0-openjdk by calling the "appletviewer" application.All users of java-1.6.0-openjdk are advised to upgrade to these updatedpackages, which resolve these issues. All running instances of OpenJDK Javamust be restarted for the update to take effect.