The Spring Framework provides a mechanism to use client provided data to update the properties of an object. This mechanism allows an attacker to modify the properties of the class loader used to load the object (via 'class.classloader'). This can lead to arbitrary command execution since, for example, an attacker can modify the URLs used by the class loader to point to locations controlled by the attacker. http://www.springsource.com/security/cve-2010-1622
spring2-0:2.5.6-alt2_6.SEC02jpp6 -> sisyphus: * Tue Sep 28 2010 Igor Vlasenko <viy@altlinux> 0:2.5.6-alt2_6.SEC02jpp6 - new bugfix release SEC02 (closes: #23690) * Tue Sep 28 2010 Igor Vlasenko <viy@altlinux> 0:2.5.6-alt2_6.SEC01jpp6 - new bugfix release SEC01
