IBM Java 1.7.0 was updated to SR2 which fixes critical security issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 7 and is, therefore, potentially affected the following vulnerabilities :

  - The 'getField' method in the 'sun.awt.SunToolkit class'     provided by the bundled SunToolkit can be used to     obtain any field of a class - even private fields.
    This error can allow privilege escalation.
    (CVE-2012-0547)

  - Two unspecified remote code execution vulnerabilities     exist related to the     'com.sun.beans.finder.ConstructorFinder' and     'com.sun.beans.finder.FieldFinder' methods. No further     details have been provided. (CVE-2012-1682,     CVE-2012-3136)

  - The 'setField' method provided by the bundled SunToolkit     can be used to execute a privileged operation and calls     'setAccessible(true)' on the returned field reference,     allowing an attacker to disable any 'final' or 'private'     directives and gain full control to run code in the Java     virtual machine. (CVE-2012-4681)

Note that at least one of these vulnerabilities is currently being exploited in the wild.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1223 advisory.

    [1.7.0.5-2.2.1.0.1.el6_3.3]
    - Modify DISTRO_NAME for Oracle

    [1.7.0.5-2.2.1.el6.3]
    - Removed patch 304 java-1.7.0-openjdk-beans-isPackageAccessible.patch
    - Applied upstream patches for same issue:
       patch 1001 sec-webrevs-openjdk7-29_aug_2012-7162473.patch        patch 1002 sec-webrevs-openjdk7-29_aug_2012-7162476.patch        patch 1003 sec-webrevs-openjdk7-29_aug_2012-7163201.patch        patch 1004 sec-webrevs-openjdk7-29_aug_2012-7194567.patch        patch 1005 sec-webrevs-openjdk7-29_aug_2012-78e01a6ca8d3.patch
    - Resolves: rhbz#852299

    [1.7.0.5-2.2.1.1.el6]
    - Added patch 304 java-1.7.0-openjdk-beans-isPackageAccessible.patch       to fix vulnerability until it is fixed in upstream sources.
    - Resolves: rhbz#852299

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-4681, CVE-2012-1682, CVE-2012-3136)

A hardening fix was applied to the AWT component in OpenJDK, removing functionality from the restricted SunToolkit class that was used in combination with other flaws to bypass Java sandbox restrictions.
(CVE-2012-0547)

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and     earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors     related to Beans, a different vulnerability than CVE-2012-1682. (CVE-2012-3136)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Oracle Java 7 release includes the Oracle Java 7 Runtime Environment and the Oracle Java 7 Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java 7 Runtime Environment and the Oracle Java 7 Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Security Alert page, listed in the References section. (CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, CVE-2012-0547)

Red Hat is aware that a public exploit for CVE-2012-4681 is available that executes code without user interaction when a user visits a malicious web page using a browser with the Oracle Java 7 web browser plug-in enabled.

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 7 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
64170	SuSE 11.2 Security Update : IBM Java (SAT Patch Number 6839)	Nessus	SuSE Local Security Checks	2013/1/25	2022/3/8	critical
64841	Oracle Java SE 7 < Update 7 Multiple Vulnerabilities (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	critical
68611	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2012-1223)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
61789	CentOS 6 : java-1.7.0-openjdk (CESA-2012:1223)	Nessus	CentOS Local Security Checks	2012/9/6	2022/3/8	critical
217704	Linux Distros Unpatched Vulnerability : CVE-2012-3136	Nessus	Misc.	2025/3/4	2025/8/19	high
61770	RHEL 6 : java-1.7.0-oracle (RHSA-2012:1225)	Nessus	Red Hat Local Security Checks	2012/9/4	2022/3/8	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	2014/1/27	2025/6/10	critical

检测

插件搜索

critical

critical

critical

critical

high

critical

critical