Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs)

[Florian Weimer <fweimer () redhat com>]

On 09/11/2012 11:37 PM, Steven M. Christey wrote:

> I wonder about the severity of the issue, but given the possibility that
> applications might access an array before a fill, and applications may
> depend on there being "empty" elements after initialization, this seems
> reasonable for a CVE.

My main concern is that untrusted code (in an applet or application 
server) could use this issue to access private data which was previously 
stored at the same location.


--
Florian Weimer / Red Hat Product Security Team