CVE ID:	CVE-2009-1106
Description:	The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1106 BugTraq ID: 34240 http://www.securityfocus.com/bid/34240 Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search) http://www.securityfocus.com/archive/1/507985/100/0/threaded http://security.gentoo.org/glsa/glsa-200911-02.xml HPdes Security Advisory: HPSBMA02429 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 HPdes Security Advisory: HPSBUX02429 http://marc.info/?l=bugtraq&m=124344236532162&w=2 HPdes Security Advisory: SSRT090058 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619 RedHat Security Advisories: RHSA-2009:0392 http://www.redhat.com/support/errata/RHSA-2009-0392.html RedHat Security Advisories: RHSA-2009:1038 http://www.redhat.com/support/errata/RHSA-2009-1038.html RedHat Security Advisories: RHSA-2009:1198 https://rhn.redhat.com/errata/RHSA-2009-1198.html http://www.securitytracker.com/id?1021920 http://secunia.com/advisories/34496 http://secunia.com/advisories/35156 http://secunia.com/advisories/35255 http://secunia.com/advisories/36185 http://secunia.com/advisories/37386 http://secunia.com/advisories/37460 http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1 SuSE Security Announcement: SUSE-SA:2009:016 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html SuSE Security Announcement: SUSE-SA:2009:036 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://www.vupen.com/english/advisories/2009/1426 http://www.vupen.com/english/advisories/2009/3316 XForce ISS Database: jre-plugin-crossdomain-info-disclosure(49459) https://exchange.xforce.ibmcloud.com/vulnerabilities/49459