Hello All, On Jun 30, 2015 Security Explorations reported a security vulnerability (Issue 42 assigned CVE-2015-4871) to Oracle affecting Java SE 7 [1]. In our original report [2], we indicated that the vulnerability had its origin in klassItable::initialize_itable_for_interface method's implementation of Java SE 7 HotSpot VM. We have recently learned that our initial analysis regarding the root cause of Issue 42 was incorrect. As a result, we have published an errata document that is available for download from the following address: http://ift.tt/1PWgrJs It contains more detailed information about the actual cause of Issue 42, the reasoning that has mislead us into concluding it was caused by an improper initialization of non-public interface method slots and some additional findings regarding this issue. The case of incorrect analysis regarding the root cause of Issue 42 has reminded us that in the world of security vulnerabilities, incorrect or unverified assumptions can easily lead to wrong conclusions. These are usually the software vendors that fall victim of it. As it turns out, the very same can happen to security researchers. Thank you. Best Regards, Adam Gowdiak
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment