Update to version 1.1.4 of icedtea-web to fix the following issues :

  - CVE-2011-3377: IcedTea-Web: second-level domain     subdomains and suffix domain SOP bypass

  - PR778: Jar download and server certificate verification     deadlock

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1424 advisory.

    - 731246 (CVE-2011-2939)CVE-2011-2939 heap overflow - decoding Unicode string

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201401-11 (Perl, Locale Maketext Perl module: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl and       Locale::Maketext Perl module. Please review the CVE identifiers       referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1424 advisory.

    Perl is a high-level programming language commonly used for system     administration utilities and web programming.

    A heap-based buffer overflow flaw was found in the way Perl decoded Unicode     strings. An attacker could create a malicious Unicode string that, when     decoded by a Perl program, would cause the program to crash or,     potentially, execute arbitrary code with the permissions of the user     running the program. (CVE-2011-2939)

    It was found that the new constructor of the Digest module used its     argument as part of the string expression passed to the eval() function. An     attacker could possibly use this flaw to execute arbitrary Perl code with     the privileges of a Perl program that uses untrusted input as an argument     to the constructor. (CVE-2011-3597)

    All Perl users should upgrade to these updated packages, which contain     backported patches to correct these issues. All running Perl programs must     be restarted for this update to take effect.

    Note: An error in the corresponding spec file resulted in an incorrect version     number being cited for the perl-Compress-Raw-Zlib package in the original     RHSA-2011:1424 advisory. For more information please review     https://access.redhat.com/solutions/239773.



Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-353:01 advisory.

    Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at     handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality     and efficiency. While it is used to do a lot of different things, Perl's most common applications are     system administration utilities and web programming. A large proportion of the CGI scripts on the web are     written in Perl. You need the perl package installed on your system so that your system can handle Perl     scripts.
    Install this package if you want to program in Perl or enable your system to handle Perl scripts.
    Security issues fixed with this release:
    CVE-2011-2939     Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used     in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory     corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
    CVE-2011-3597     Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute     arbitrary commands via the new constructor.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of Perl fixes a heap based buffer overflow in the decode_xs() function (CVE-2011-2939, bnc#728662).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75529	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:1251-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
68383	Oracle Linux 6 : perl (ELSA-2011-1424)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
72033	GLSA-201401-11 : Perl, Locale Maketext Perl module: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/1/20	2021/1/6	high
56709	RHEL 6 : perl (RHSA-2011:1424)	Nessus	Red Hat Local Security Checks	2011/11/4	2025/12/12	critical
283947	MiracleLinux 4 : perl-5.10.1-119.AXS4.1 (AXSA:2012-353:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
75707	openSUSE Security Update : perl (openSUSE-SU-2011:1278-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium

检测

插件搜索

medium

critical

high

critical

critical

medium