=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2011/VULN201
_____________________________________________________________________

DATE                      : 09/03/2011

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       :  Mac OS X version 10.6 running Java.

======================================================================
http://support.apple.com/kb/HT4562
http://support.apple.com/kb/HT4563
______________________________________________________________________

APPLE-SA-2011-03-08-1 Java for Mac OS X 10.6 Update 4

Java for Mac OS X 10.6 Update 4 is now available and addresses the
following:

Java
Available for:  Mac OS X v10.6.6, Mac OS X Server v10.6.6
Impact:  Multiple vulnerabilities in Java 1.6.0_22
Description:  Multiple vulnerabilities exist in Java 1.6.0_22, the
most serious of which may allow an untrusted Java applet to execute
arbitrary code outside the Java sandbox. Visiting a web page
containing a maliciously crafted untrusted Java applet may lead to
arbitrary code execution with the privileges of the current user.
These issues are addressed by updating to Java version 1.6.0_24.
Further information is available via the Java website at
http://java.sun.com/javase/6/webnotes/ReleaseNotes.html
CVE-ID
CVE-2010-4422
CVE-2010-4447
CVE-2010-4448
CVE-2010-4450
CVE-2010-4454
CVE-2010-4462
CVE-2010-4463
CVE-2010-4465
CVE-2010-4467
CVE-2010-4468
CVE-2010-4469
CVE-2010-4470
CVE-2010-4471
CVE-2010-4472
CVE-2010-4473
CVE-2010-4476


Java for Mac OS X 10.6 Update 4 may be obtained from the Software
Update pane in System Preferences, or Apple's Software Downloads
web site: http://www.apple.com/support/downloads/

The download file is named: JavaForMacOSX10.6Update4.dmg
Its SHA-1 digest is: 513d5c5b62fb1257b8bf582c1c11e02e944fa808

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

_________________________________________________________________



APPLE-SA-2011-03-08-2 Java for Mac OS X 10.5 Update 9

Java for Mac OS X 10.5 Update 9 is now available and addresses the
following:

Java
Available for:  Mac OS X v10.5.8, Mac OS X Server v10.5.8
Impact:  Multiple vulnerabilities in Java 1.6.0_22
Description:  Multiple vulnerabilities exist in Java 1.6.0_22, the
most serious of which may allow an untrusted Java applet to execute
arbitrary code outside the Java sandbox. Visiting a web page
containing a maliciously crafted untrusted Java applet may lead to
arbitrary code execution with the privileges of the current user.
These issues are addressed by updating to Java version 1.6.0_24.
Further information is available via the Java website at
http://java.sun.com/javase/6/webnotes/ReleaseNotes.html
CVE-ID
CVE-2010-4422
CVE-2010-4447
CVE-2010-4448
CVE-2010-4450
CVE-2010-4454
CVE-2010-4462
CVE-2010-4463
CVE-2010-4465
CVE-2010-4467
CVE-2010-4468
CVE-2010-4469
CVE-2010-4470
CVE-2010-4471
CVE-2010-4472
CVE-2010-4473
CVE-2010-4476

Java
Available for:  Mac OS X v10.5.8, Mac OS X Server v10.5.8
Impact:  Multiple vulnerabilities in Java 1.5.0_26
Description:  Multiple vulnerabilities exist in Java 1.5.0_26, the
most serious of which may allow an untrusted Java applet to execute
arbitrary code outside the Java sandbox. Visiting a web page
containing a maliciously crafted untrusted Java applet may lead to
arbitrary code execution with the privileges of the current user.
These issues are addressed by updating to Java version 1.5.0_28.
Further information is available via the Java website at http://www.o
racle.com/technetwork/java/javase/documentation/overview-137139.html
CVE-ID
CVE-2010-4447
CVE-2010-4448
CVE-2010-4450
CVE-2010-4454
CVE-2010-4462
CVE-2010-4465
CVE-2010-4468
CVE-2010-4469
CVE-2010-4471
CVE-2010-4473
CVE-2010-4476


Java for Mac OS X 10.5 Update 9 may be obtained from the Software
Update pane in System Preferences, or Apple's Software Downloads
web site: http://www.apple.com/support/downloads/

The download file is named: JavaForMacOSX10.5Update9.dmg
Its SHA-1 digest is: 65173cd19b5f4dd9b6b3bc396c364665eae23217

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/


======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================