CVE-2008-5355

Name	CVE-2008-5355
Description	The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
openjdk-6	source	(unstable)	(not affected)
sun-java5	source	(unstable)	(not affected)
sun-java6	source	(unstable)	(not affected)

Notes

- sun-java5 <not-affected> (Java update not used in Debian)
- sun-java6 <not-affected> (Java update not used in Debian)
- openjdk-6 <not-affected> (Java update not used in Debian)