The Sun Java 6 SDK/JRE was updated to u17 update fixing bugs and various security issues :

  - The Java Web Start Installer in Sun Java SE in JDK and     JRE 6 before Update 17 does not properly use security     model permissions when removing installer extensions,     which allows remote attackers to execute arbitrary code     by modifying a certain JNLP file to have a URL field     that poi nts to an unintended trusted application, aka     Bug Id 6872824. (CVE-2009-3866)

  - Stack-based buffer overflow in the     HsbParser.getSoundBank function in Sun Java SE in JDK     and JRE 5.0 before Update 22, JDK and JRE 6 before     Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK     and JRE 1.4.x before 1.4.2_24 allows remote attackers to     execute arbitrary code via a long file: URL in an     argument, aka Bug Id 6854303. (CVE-2009-3867)

  - Stack-based buffer overflow in the setDiffICM function     in the Abstract Window Toolkit (AWT) in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 before Update 17, SDK     and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x     before 1.4.2_ 24 allows remote attackers to execute     arbitrary code via a crafted argument, aka Bug Id     6872357. (CVE-2009-3869)

  - Heap-based buffer overflow in the setBytePixels function     in the Abstract Window Toolkit (AWT) in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 before Update 17, SDK     and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x     before 1.4. 2_24 allows remote attackers to execute     arbitrary code via crafted arguments, aka Bug Id     6872358. (CVE-2009-3871)

  - Integer overflow in the JPEGImageReader implementation     in the ImageI/O component in Sun Java SE in JDK and JRE     5.0 before Update 22, JDK and JRE 6 before Update 17,     and SDK and JRE 1.4.x before 1.4.2_24 allows remote     attackers to execute arbitrary code via large subsample     dimensi ons in a JPEG file that triggers a heap-based     buffer overflow, aka Bug Id 6874643. (CVE-2009-3874)

  - The MessageDigest.isEqual function in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 befor e Update 17, SDK     and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x     before 1.4.2_24 allows remote attackers to spoof     HMAC-based digital si gnatures, and possibly bypass     authentication, via unspecified vectors related to     'timing attack vulnerabilities,' aka Bug Id 6863503.
    (CVE-2009-3875)

  - Unspecified vulnerability in Sun Java SE in JDK and JRE     5.0 before Update 22, JDK and JRE 6 before Update 17,     SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE     1.4.x before 1.4.2_24 allows remote attackers to cause a     denial of service (memory consumption) via crafted DER     encoded data, which is not properly decoded by the ASN.1     DER input stream parser, aka Bug Id 6864911.
    (CVE-2009-3876)

  - Unspecified vulnerability in Sun Java SE in JDK and JRE     5.0 before Update 22, JDK and JRE 6 before Update 17,     SDK and JRE 1.3.x before 1.3.1 _27, and SDK and JRE     1.4.x before 1.4.2_24 allows remote attackers to cause a     denial of service (memory consumption) via crafted HTTP     header s, which are not properly parsed by the ASN.1 DER     input stream parser, aka Bug Id 6864911. (CVE-2009-3877)

  - The Java Update functionality in Java Runtime     Environment (JRE) in Sun Java SE in JDK and JRE 5.0     before Update 22 and JDK and JRE 6 before Update 17,     when a non-English version of Windows is used, does not     retrieve available new JRE versions, which allows remote     attackers to lev erage vulnerabilities in older releases     of this software, aka Bug Id 6869694. (CVE-2009-3864)

  - The launch method in the Deployment Toolkit plugin in     Java Runtime Environment (JRE) in Sun Java SE in JDK and     JRE 6 before Update 17 allows remote attackers to     execute arbitrary commands via a crafted web page, aka     Bug Id 6869752. (CVE-2009-3865)

  - Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and     JRE 6 before Update 17, SDK and JRE 1.3.x before     1.3.1_27, and SDK and JRE 1.4.x be fore 1.4.2_24 does     not properly parse color profiles, which allows remote     attackers to gain privileges via a crafted image file,     aka Bug Id 6862970. (CVE-2009-3868)

  - Unspecified vulnerability in the JPEG JFIF Decoder in     Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and     JRE 6 before Update 17, SDK a nd JRE 1.3.x before     1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows     remote attackers to gain privileges via a crafted image     file, aka Bug Id 6862969. (CVE-2009-3872)

  - The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0     before Update 22, JDK and JRE 6 before Update 17, and     SDK and JRE 1.4.x before 1.4.2 _24 allows remote     attackers to gain privileges via a crafted image file,     related to a 'quanization problem,' aka Bug Id 6862968.
    (CVE-2009-3873)

Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.4.2 SR13-FP3 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. These vulnerabilities are summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

All users of java-1.4.2-ibm are advised to upgrade to these updated packages, which contain the IBM 1.4.2 SR13-FP3 Java release. All running instances of IBM Java must be restarted for this update to take effect.

a. Java JRE Security Update

  JRE update to version 1.5.0_22, which addresses multiple security   issues that existed in earlier releases of JRE.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,   CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,   CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,   CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,   CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676,   CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720,   CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the following names to the security issues fixed in   JRE 1.5.0_22: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864,   CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868,   CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873,   CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877,   CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,   CVE-2009-3883, CVE-2009-3884, CVE-2009-3886, CVE-2009-3885.

java-1_5_0-sun u22 update fixes the following security bugs :

  - CVE-2009-3864: CVSS v2 Base Score: 7.5

  - CVE-2009-3867: CVSS v2 Base Score: 9.3

  - CVE-2009-3868: CVSS v2 Base Score: 9.3

  - CVE-2009-3869: CVSS v2 Base Score: 9.3

  - CVE-2009-3871: CVSS v2 Base Score: 9.3

  - CVE-2009-3872: CVSS v2 Base Score: 10.0

  - CVE-2009-3873: CVSS v2 Base Score: n/a

  - CVE-2009-3874: CVSS v2 Base Score: 9.3

  - CVE-2009-3875: CVSS v2 Base Score: 5.0

  - CVE-2009-3876: CVSS v2 Base Score: 5.0

  - CVE-2009-3877: CVSS v2 Base Score: 5.0 For bug details     use the CVE-ID to query the Mitre database at     http://cve.mitre.org/cve please.

Dan Kaminsky discovered that SSL certificates signed with MD2 could be spoofed given enough time. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site.
This update handles this issue by completely disabling MD2 for certificate validation in OpenJDK. (CVE-2009-2409)

It was discovered that ICC profiles could be identified with '..' pathnames. If a user were tricked into running a specially crafted applet, a remote attacker could gain information about a local system.
(CVE-2009-3728)

Peter Vreugdenhil discovered multiple flaws in the processing of graphics in the AWT library. If a user were tricked into running a specially crafted applet, a remote attacker could crash the application or run arbitrary code with user privileges.
(CVE-2009-3869, CVE-2009-3871)

Multiple flaws were discovered in JPEG and BMP image handling. If a user were tricked into loading a specially crafted image, a remote attacker could crash the application or run arbitrary code with user privileges. (CVE-2009-3873, CVE-2009-3874, CVE-2009-3885)

Coda Hale discovered that HMAC-based signatures were not correctly validated. Remote attackers could bypass certain forms of authentication, granting unexpected access. (CVE-2009-3875)

Multiple flaws were discovered in ASN.1 parsing. A remote attacker could send a specially crafted HTTP stream that would exhaust system memory and lead to a denial of service. (CVE-2009-3876, CVE-2009-3877)

It was discovered that the graphics configuration subsystem did not correctly handle arrays. If a user were tricked into running a specially crafted applet, a remote attacker could exploit this to crash the application or execute arbitrary code with user privileges.
(CVE-2009-3879)

It was discovered that loggers and Swing did not correctly handle certain sensitive objects. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy. (CVE-2009-3880, CVE-2009-3882, CVE-2009-3883)

It was discovered that the ClassLoader did not correctly handle certain options. If a user were tricked into running a specially crafted applet, a remote attacker could execute arbitrary code with user privileges. (CVE-2009-3881)

It was discovered that time zone file loading could be used to determine the existence of files on the local system. If a user were tricked into running a specially crafted applet, private information could be leaked to a remote attacker, leading to a loss of privacy.
(CVE-2009-3884).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New icedtea update to fix :

  - ICC_Profile file existence detection information leak;
    CVE-2009-3728: CVSS v2 Base Score: 5.0

  - BMP parsing DoS with UNC ICC links; CVE-2009-3885: CVSS     v2 Base Score: 5.0

  - resurrected classloaders can still have children;
    CVE-2009-3881: CVSS v2 Base Score: 7.5

  - Numerous static security flaws in Swing; CVE-2009-3882:
    CVSS v2 Base Score: 7.5

  - Mutable statics in Windows PL&F; CVE-2009-3883: CVSS v2     Base Score: 7.5

  - UI logging information leakage; CVE-2009-3880: CVSS v2     Base Score: 5.0

  - GraphicsConfiguration information leak; CVE-2009-3879:
    CVSS v2 Base Score: 7.5

  - zoneinfo file existence information leak; CVE-2009-3884:
    CVSS v2 Base Score: 5.0

  - deprecate MD2 in SSL cert validation; CVE-2009-2409:
    CVSS v2 Base Score: 6.4

  - JPEG Image Writer quantization problem; CVE-2009-3873:
    CVSS v2 Base Score: 9.3

  - MessageDigest.isEqual introduces timing attack     vulnerabilities; CVE-2009-3875: CVSS v2 Base Score: 5.0

  - OpenJDK ASN.1/DER input stream parser denial of service;
    CVE-2009-3876,CVE-2009-3877: CVSS v2 Base Score: 5.0

  - JRE AWT setDifflCM stack overflow; CVE-2009-3869: CVSS     v2 Base Score: 9.3

  - ImageI/O JPEG heap overflow; CVE-2009-3874: CVSS v2 Base     Score: 9.3

  - JRE AWT setBytePixels heap overflow; CVE-2009-3871: CVSS     v2 Base Score: 9.3

The remote host is affected by the vulnerability described in GLSA-200911-02 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Sun Java     implementation. Please review the CVE identifiers referenced below and     the associated Sun Alerts for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JAR     archive, applet, or Java Web Start application, possibly resulting in     the execution of arbitrary code with the privileges of the user running     the application. Furthermore, a remote attacker could cause a Denial of     Service affecting multiple services via several vectors, disclose     information and memory contents, write or execute local files, conduct     session hijacking attacks via GIFAR files, steal cookies, bypass the     same-origin policy, load untrusted JAR files, establish network     connections to arbitrary hosts and posts via several vectors, modify     the list of supported graphics configurations, bypass HMAC-based     authentication systems, escalate privileges via several vectors and     cause applet code to be executed with older, possibly vulnerable     versions of the JRE.
    NOTE: Some vulnerabilities require a trusted environment, user     interaction, a DNS Man-in-the-Middle or Cross-Site-Scripting attack.
  Workaround :

    There is no known workaround at this time.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. These vulnerabilities are summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2009-0217, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR7 Java release. All running instances of IBM Java must be restarted for the update to take effect.

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. These vulnerabilities are summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.5.0 SR11 Java release. All running instances of IBM Java must be restarted for this update to take effect.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42857	SuSE 11 Security Update : Sun Java 1.6.0 (SAT Patch Number 1542)	Nessus	SuSE Local Security Checks	2009/11/19	2021/1/14	high
43048	RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2009:1643)	Nessus	Red Hat Local Security Checks	2009/12/8	2021/1/14	critical
45386	VMSA-2010-0002 : VMware vCenter update release addresses multiple security issues in Java JRE	Nessus	VMware ESX Local Security Checks	2010/3/31	2021/1/6	critical
42457	openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1529)	Nessus	SuSE Local Security Checks	2009/11/11	2021/1/14	high
42817	Ubuntu 8.10 / 9.04 / 9.10 : openjdk-6 vulnerabilities (USN-859-1)	Nessus	Ubuntu Local Security Checks	2009/11/16	2021/1/19	critical
42921	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1613)	Nessus	SuSE Local Security Checks	2009/11/30	2021/1/14	high
42834	GLSA-200911-02 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/11/18	2021/1/6	critical
43597	RHEL 4 / 5 : java-1.6.0-ibm (RHSA-2009:1694)	Nessus	Red Hat Local Security Checks	2009/12/27	2021/1/14	critical
43079	RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2009:1647)	Nessus	Red Hat Local Security Checks	2009/12/9	2021/1/14	critical
44029	RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)	Nessus	Red Hat Local Security Checks	2010/1/15	2021/1/14	critical

检测

插件搜索

high

critical

critical

high

critical

high

critical

critical

critical

critical