Re: Java security issue vs. struts?

2013-01-18 Thread Emi Lu
Thank you Chris. Moreover, if I call jfreechart to generate reports through web applications, it will not be affected, I believe? As long as you do not use Applets to output JFreechart data you should be fine (saying: if you generate images with JFreechart) (1) My jsp: img

Re: Java security issue vs. struts?

2013-01-18 Thread Emi Lu
Subject: Re: Java security issue vs. struts? Date: Fri, 18 Jan 2013 12:00:31 -0500 From: Emi Lu em...@encs.concordia.ca Reply-To: em...@encs.concordia.ca To: Christian Grobmeier grobme...@gmail.com CC: Struts Users Mailing List user@struts.apache.org, Chris Pratt thechrispr...@gmail.com Thank

RE: Java security issue vs. struts?

2013-01-18 Thread Martin Gainty
; thechrispr...@gmail.com Subject: Re: Java security issue vs. struts? Hello Martin, I did not find bug report under struts JIRA related to jfreechart. More details about how I use jfreechart: (1) jsp img src=.action (2) JAVA Action class, generated jsp (3) struts.xml specify img size

Java security issue vs. struts?

2013-01-16 Thread Emi Lu
Hello, Does someone know how this java security issue related to struts framework? http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html Thanks a lot! Emi - To unsubscribe, e-mail:

Re: Java security issue vs. struts?

2013-01-16 Thread Chris Pratt
I believe the description says it all. This Security Alert addresses security issues CVE-2013-0422 (US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass Vulnerability) and another vulnerability affecting Java running in web browsers. *These vulnerabilities are not applicable to Java

Re: Java security issue vs. struts?

2013-01-16 Thread Emi Lu
On 01/16/2013 04:54 PM, Emi Lu wrote: Hello, Does someone know how this java security issue related to struts framework? http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html One more link:

Re: Java security issue vs. struts?

2013-01-16 Thread Emi Lu
On 01/16/2013 05:02 PM, Chris Pratt wrote: I believe the description says it all. This Security Alert addresses security issues CVE-2013-0422 (US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass Vulnerability) and another vulnerability affecting Java running in web browsers. *These

RE: Java security issue vs. struts?

2013-01-16 Thread Martin Gainty
To: thechrispr...@gmail.com CC: user@struts.apache.org Subject: Re: Java security issue vs. struts? On 01/16/2013 05:02 PM, Chris Pratt wrote: I believe the description says it all. This Security Alert addresses security issues CVE-2013-0422 (US-CERT Alert TA13-010A - Oracle Java 7 Security

Re: Java security issue vs. struts?

2013-01-16 Thread Dave Newton
... Where does Struts 2 run? In the browser, or on a server? Dave On Wed, Jan 16, 2013 at 5:06 PM, Emi Lu em...@encs.concordia.ca wrote: On 01/16/2013 04:54 PM, Emi Lu wrote: Hello, Does someone know how this java security issue related to struts framework?

Re: Java security issue vs. struts?

2013-01-16 Thread Christian Grobmeier
On Wed, Jan 16, 2013 at 11:12 PM, Emi Lu em...@encs.concordia.ca wrote: On 01/16/2013 05:02 PM, Chris Pratt wrote: I believe the description says it all. This Security Alert addresses security issues CVE-2013-0422 (US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass