iDefense Security Advisory 12.02.08 – Remote exploitation of a heap overflow vulnerability in Sun Microsystems Inc.’s Java JRE could allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability exists within the font parsing code in the JRE. Various types of fonts are supported, one of which is the TrueType format font. The vulnerability occurs when processing TrueType font files. During parsing, improper bounds checking is performed, which can lead to a heap based buffer overflow. iDefense has confirmed the existence of this vulnerability in Sun Microsystem Inc.’s Java JRE version 1.6.0_07 for Windows. Previous versions and versions for other platforms may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/72625/12.02.08-1.txt
Source: https://packetstormsecurity.com/files/72625/iDEFENSE-Security-Advisory-2008-12-02.1.html