The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.
Open Enterprise Server openSUSE 10.3 openSUSE 11.0 openSUSE 11.1 sles10-ltss.i386 sles10-ltss.s390x sles10-ltss.x86_64 SUSE Linux Enterprise Desktop 11 GA SUSE Linux Enterprise SDK 11 GA SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 11 GA SUSE Linux Enterprise Server for SAP Applications 11