[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

gcjwebplugin runs untrusted code without sandbox



gcjwebplugin is a Java plugin for web browsers.  It does not include the
security manager which is a crucial part of the "sandboxing" of Java
applets.  The maintainers have "fixed" this bug (#267040) merely by
adding a warning prompt before running applets, which is well known to
be an insufficient means of protecting users from malware.  Please do
not include it in lenny.  (Unfortunately it is built from the classpath
source package, so that will have to be modified to remove it.)

Ben.

-- 
Ben Hutchings
Design a system any fool can use, and only a fool will want to use it.

Attachment: signature.asc
Description: Digital signature


Reply to: