The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs conduct a denial of service and obtain sensitive information via a crafted SQL statement related to \inadequate security settings and library bugs in sun.* and org.apache.* packages.\