The Java XML Digital Signature implementation that is included in the JDK and JRE 6 release does not securely process XSLT stylesheets contained in XSLT Transforms in XML Signatures. This could lead to the execution of arbitrary code with the permissions of the application processing XML signatures that include these XSLT stylesheets.

Sun acknowledges with thanks, Brad Hill of iSEC Partners, for bringing this issue to our attention.