(1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.2_08 1.4.2_09 and 1.5.0_05 and possibly other versions allow remote attackers to cause a denial of service (JVM unresponsive) via a crafted serialized object such as a font object as demonstrated on JBoss.