A buffer overflow vulnerability in the Java Web Start URL parsing code may allow an untrusted application to elevate its privileges. For example, an application may grant itself permissions to read and write local files or execute local applications with the privileges of the user running the Java Web Start application.

Sun acknowledges with thanks, Brett Moore of Security-Assessment.com for discovering and reporting this issue.

Sun also acknowledges eEye Digital Security for bringing this issue to our attention.