Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Network Satellite Server 5.1.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the Sun Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.1. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the Sun Java 5 Runtime Environment.
(CVE-2006-2426, CVE-2008-2086, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1103, CVE-2009-1104, CVE-2009-1107, CVE-2009-2409, CVE-2009-2475, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676, CVE-2009-2689, CVE-2009-3728, CVE-2009-3873, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882, CVE-2009-3883, CVE-2009-3884)

Note: This is the final update for the java-1.5.0-sun packages, as the Sun Java SE Release family 5.0 has now reached End of Service Life. An alternative to Sun Java SE 5.0 is the Java 2 Technology Edition of the IBM Developer Kit for Linux, which is available from the Satellite 5.1 channels on the Red Hat Network.

For a long term solution, Red Hat advises users to switch from Sun Java SE 5.0 to the Java 2 Technology Edition of the IBM Developer Kit for Linux. Refer to the Solution section for instructions.

Users of Red Hat Network Satellite Server 5.1 are advised to upgrade to these updated java-1.5.0-sun packages, which resolve these issues.
All running instances of Sun Java must be restarted for the update to take effect.

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 6.

The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 1.

The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.

IBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues. It also contains a timezone update for the current Fiji change (timezone 1.6.9s).

The update fixes the following security issues : 

  - A vulnerability in the Java Runtime Environment with     decoding DER encoded data might allow a remote client to     cause the JRE to crash, resulting in a denial of service     condition. (CVE-2009-3876, CVE-2009-3877)

  - A buffer overflow vulnerability in the Java Runtime     Environment audio system might allow an untrusted applet     or Java Web Start application to escalate privileges.
    For example, an untrusted applet might grant itself     permissions to read and write local files, or run local     applications that are accessible to the user running the     untrusted applet. (CVE-2009-3867)

  - A buffer overflow vulnerability in the Java Runtime     Environment with parsing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3868)

  - An integer overflow vulnerability in the Java Runtime     Environment with reading JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3872)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3873)

  - A security vulnerability in the Java Runtime Environment     with verifying HMAC digests might allow authentication     to be bypassed. This action can allow a user to forge a     digital signature that would be accepted as valid.
    Applications that validate HMAC-based digital signatures     might be vulnerable to this type of attack.
    (CVE-2009-3875)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3869)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3871)

  - An integer overflow vulnerability in the Java Runtime     Environment with processing JPEG images might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3874)

  - The Java Runtime Environment includes the Java Web Start     technology that uses the Java Web Start ActiveX control     to launch Java Web Start in Internet Explorer. A     security vulnerability in the Active Template Library     (ATL) in various releases of Microsoft Visual Studio,     which is used by the Java Web Start ActiveX control,     might allow the Java Web Start ActiveX control to be     leveraged to run arbitrary code. This might occur as the     result of a user of the Java Runtime Environment viewing     a specially crafted web page that exploits this     vulnerability. (CVE-2009-2493)

Please also refer to http://www.ibm.com/developerworks/java/jdk/alerts for more information about this update.

IBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs and security issues.

The timezone update to 1.6.9s (with the latest Fiji change).

  - A vulnerability in the Java Runtime Environment with     decoding DER encoded data might allow a remote client to     cause the JRE to crash, resulting in a denial of service     condition. (CVE-2009-3876 / CVE-2009-3877)

  - A buffer overflow vulnerability in the Java Runtime     Environment audio system might allow an untrusted applet     or Java Web Start application to escalate privileges.
    For example, an untrusted applet might grant itself     permissions to read and write local files, or run local     applications that are accessible to the user running the     untrusted applet. (CVE-2009-3867)

  - A buffer overflow vulnerability in the Java Runtime     Environment with parsing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3868)

  - An integer overflow vulnerability in the Java Runtime     Environment with reading JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3872)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing JPEG files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files, or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3873)

  - A security vulnerability in the Java Runtime Environment     with verifying HMAC digests might allow authentication     to be bypassed. This action can allow a user to forge a     digital signature that would be accepted as valid.
    Applications that validate HMAC-based digital signatures     might be vulnerable to this type of attack.
    (CVE-2009-3875)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3869)

  - A buffer overflow vulnerability in the Java Runtime     Environment with processing image files might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3871)

  - An integer overflow vulnerability in the Java Runtime     Environment with processing JPEG images might allow an     untrusted applet or Java Web Start application to     escalate privileges. For example, an untrusted applet     might grant itself permissions to read and write local     files or run local applications that are accessible to     the user running the untrusted applet. (CVE-2009-3874)

  - The Java Runtime Environment includes the Java Web Start     technology that uses the Java Web Start ActiveX control     to launch Java Web Start in Internet Explorer. A     security vulnerability in the Active Template Library     (ATL) in various releases of Microsoft Visual Studio,     which is used by the Java Web Start ActiveX control,     might allow the Java Web Start ActiveX control to be     leveraged to run arbitrary code. This might occur as the     result of a user of the Java Runtime Environment viewing     a specially crafted web page that exploits this     vulnerability. (CVE-2009-2493)

Please also see http://www.ibm.com/developerworks/java/jdk/alerts/

Updated java-1.6.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. (CVE-2009-2409, CVE-2009-3728, CVE-2009-3729, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882, CVE-2009-3883, CVE-2009-3884, CVE-2009-3886)

Users of java-1.6.0-sun should upgrade to these updated packages, which correct these issues. All running instances of Sun Java must be restarted for the update to take effect.

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Sun 1.5.0 Java release includes the Sun Java 5 Runtime Environment and the Sun Java 5 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 5 Runtime Environment and the Sun Java 5 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. (CVE-2009-2409, CVE-2009-3728, CVE-2009-3873, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882, CVE-2009-3883, CVE-2009-3884)

Note: This is the final update for the java-1.5.0-sun packages, as the Sun Java SE Release family 5.0 has now reached End of Service Life.
The next update will remove the java-1.5.0-sun packages.

An alternative to Sun Java SE 5.0 is the Java 2 Technology Edition of the IBM Developer Kit for Linux, which is available from the Extras and Supplementary channels on the Red Hat Network. For users of applications that are capable of using the Java 6 runtime, the OpenJDK open source JDK is included in Red Hat Enterprise Linux 5 (since 5.3) and is supported by Red Hat.

Users of java-1.5.0-sun should upgrade to these updated packages, which correct these issues. All running instances of Sun Java must be restarted for the update to take effect.

java-1_5_0-sun u22 update fixes the following security bugs :

  - CVE-2009-3864: CVSS v2 Base Score: 7.5

  - CVE-2009-3867: CVSS v2 Base Score: 9.3

  - CVE-2009-3868: CVSS v2 Base Score: 9.3

  - CVE-2009-3869: CVSS v2 Base Score: 9.3

  - CVE-2009-3871: CVSS v2 Base Score: 9.3

  - CVE-2009-3872: CVSS v2 Base Score: 10.0

  - CVE-2009-3873: CVSS v2 Base Score: n/a

  - CVE-2009-3874: CVSS v2 Base Score: 9.3

  - CVE-2009-3875: CVSS v2 Base Score: 5.0

  - CVE-2009-3876: CVSS v2 Base Score: 5.0

  - CVE-2009-3877: CVSS v2 Base Score: 5.0 For bug details     use the CVE-ID to query the Mitre database at     http://cve.mitre.org/cve please.

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. These vulnerabilities are summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.5.0 SR11 Java release. All running instances of IBM Java must be restarted for this update to take effect.

The version of Sun Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 17 / 5.0 Update 22 / 1.4.2_24 / 1.3.1_27.  Such versions are potentially affected by the following security issues :

  - The Java update mechanism on non-English versions does     not update the JRE when a new version is available.
    (269868)

  - A command execution vulnerability exists in the Java     runtime environment deployment toolkit. (269869)

  - An issue in the Java web start installer may be     leveraged to allow an untrusted Java web start     application to run as a trusted application. (269870)

  - Multiple buffer and integer overflow vulnerabilities     exist. (270474)

  - A security vulnerability in the JRE with verifying HMAC     digests may allow authentication to be bypassed.
    (270475)

  - Two vulnerabilities in the JRE with decoding DER encoded     data and parsing HTTP headers may separately allow a     remote client to cause the JRE on the server to run out     of memory, resulting in a denial of service. (270476)

  - A directory traversal vulnerability in the     ICC_Profile.getInstance method allows a remote attacker     to determine the existence of local International Color     Consortium (ICC) profile files. (Bug #6631533)

  - A denial of service attack is possible via a BMP file     containing a link to a UNC share pathname for an     International Color Consortium (ICC) profile file.
    (Bug #6632445)

  - Resurrected classloaders can still have children,     which could allow a remote attacker to gain     privileges via unspecified vectors (Bug #6636650)

  - The Abstract Window Toolkit (AWT) does not properly     restrict the objects that may be sent to loggers, which     allows attackers to obtain sensitive information via     vectors related to the implementation of Component,     KeyboardFocusManager, and DefaultKeyboardFocusManager.
    (Bug #6664512)

  - An unspecified vulnerability in TrueType font parsing     functionality may lead to a denial of service. (Bug     #6815780)

  - The failure to clone arrays returned by the     getConfigurations function could lead to multiple,     unspecified vulnerabilities in the X11 and     Win32GraphicsDevice subsystems. (Bug #6822057)

  - The TimeZone.getTimeZone method can be used by a remote     attacker to determine the existence of local files via     its handling of zoneinfo (aka tz) files. (Bug #6824265)

  - Java Web Start does not properly handle the interaction     between a signed JAR file and a JNLP application or     applet. (Bug #6870531)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
53539	RHEL 4 : Sun Java Runtime in Satellite Server (RHSA-2009:1662)	Nessus	Red Hat Local Security Checks	2011/4/23	2021/1/14	critical
43002	Mac OS X : Java for Mac OS X 10.5 Update 6	Nessus	MacOS X Local Security Checks	2009/12/4	2024/7/24	high
43003	Mac OS X : Java for Mac OS X 10.6 Update 1	Nessus	MacOS X Local Security Checks	2009/12/4	2024/7/24	high
43599	SuSE9 Security Update : IBM Java 1.5.0 (YOU Patch Number 12564)	Nessus	SuSE Local Security Checks	2009/12/27	2021/1/14	high
49863	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 6741)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high
42431	RHEL 4 / 5 : java-1.6.0-sun (RHSA-2009:1560)	Nessus	Red Hat Local Security Checks	2009/11/10	2021/1/14	critical
42455	RHEL 4 / 5 : java-1.5.0-sun (RHSA-2009:1571)	Nessus	Red Hat Local Security Checks	2009/11/11	2021/1/14	critical
42460	openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1529)	Nessus	SuSE Local Security Checks	2009/11/11	2021/1/14	high
43079	RHEL 4 / 5 : java-1.5.0-ibm (RHSA-2009:1647)	Nessus	Red Hat Local Security Checks	2009/12/9	2021/1/14	critical
64831	Sun Java JRE Multiple Vulnerabilities (269868 / 269869 / 270476 ...) (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	high

检测

插件搜索

critical

high

high

high

high

critical

critical

high

critical

high