Security updates from Sun and VMware make it a busy day for patching on Thursday.
Sun Java 6.0 Update 11 addresses multiple security and performance bugs in Java Runtime Environment and Java SE Development software, as explained in release notes from Sun here. The one-line descriptions of the 18 bugs addressed by the update, published on Wednesday, make drawing too many conclusions about their seriousness tricky.
Some of the descriptions link to more details which show that the most severe "high-risk" flaws involve "serious rendering issues on Nvidia boards with driver version 178.13 on Vista", as well as bugs in JTree, JFileChooser and IM Candidate, among other components. Multiple bugs in Java plugins also earn the high-risk badge.
The release notes from Sun make for a dense read but are the best reference point on the update. Summaries from US-CERT and the Internet Storm Centre published thus far simply link back to Sun's advisory.
VMWare separately published a security advisory on Tuesday that addresses two potentially serious security vulnerabilities affecting a range of products from the virtualisation vendor. The first bug involves a critical memory corruption flaw in virtual device hardware, while the other concerns flaws in bzip2, a service console package. Bugs in the package mean applications that use it are liable to crash when decompressing malformed archives. The two flaws affect various versions of VMware Workstation, Player, Server, ESX and ESX(i). Patches for affected versions are largely available, with a couple of exceptions. The patching matrix is fairly complicated and best explained by reference to VMWare's advisory here.
VMWare also, on Tuesday, revised a security advisory first published in October. Updated ESX packages for libxml2, ucd-snmp, libtiff are now available for version 3.5 of the enterprise virtualisation product, it said. ®