a. ESX third-party update for Service Console openssl RPM

   The Service Console openssl RPM is updated to    openssl-0.9.8e.12.el5_5.7 resolving two security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-7270 and CVE-2010-4180 to these    issues.
   b. ESX third-party update for Service Console libuser RPM     The Service Console libuser RPM is updated to version    0.54.7-2.1.el5_5.2 to resolve a security issue.
     The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2011-0002 to this issue.
  c. ESX third-party update for Service Console nss and nspr RPMs     The Service Console Network Security Services (NSS) and Netscape    Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1    and nss-3.12.8-4 resolving multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3170 and CVE-2010-3173 to these    issues.
  d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24

   Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454,    CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466,    CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470,    CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474,    CVE-2010-4475 and CVE-2010-4476.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548,    CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552,    CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556,    CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560,    CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565,    CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569,    CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and    CVE-2010-3574.
  e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30

   Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873,    CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814,    CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465,    CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473,    CVE-2010-4475, CVE-2010-4476.

f. Integer overflow in VMware third-party component sfcb

   This release resolves an integer overflow issue present in the    third-party library SFCB when the httpMaxContentLength has been    changed from its default value to 0 in in /etc/sfcb/sfcb.cfg.
   The integer overflow could allow remote attackers to cause a    denial of service (heap memory corruption) or possibly execute    arbitrary code via a large integer in the Content-Length HTTP    header.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2054 to this issue.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 24 / 5.0 Update 28 / 1.4.2_30.  Such versions are potentially affected by security issues in the following components :

  - Deployment
  - HotSpot
  - Install
  - JAXP
  - Java Language
  - JDBC
  - Launcher
  - Networking
  - Security
  - Sound
  - Swing
  - XML Digital Signature
  - 2D

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

Following CVEs were addressed: CVE-2010-4452 CVE-2010-4454 CVE-2010-4462 CVE-2010-4463 CVE-2010-4465 CVE-2010-4467 CVE-2010-4469 CVE-2010-4473 CVE-2010-4422 CVE-2010-4451 CVE-2010-4466 CVE-2010-4470 CVE-2010-4471 CVE-2010-4476 CVE-2010-4447 CVE-2010-4475 CVE-2010-4468 CVE-2010-4450 CVE-2010-4448 CVE-2010-4472 CVE-2010-4474

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0364 advisory.

  - JDK unspecified vulnerability in Deployment component (CVE-2010-4447, CVE-2010-4466, CVE-2010-4475)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Launcher incorrect processing of empty library path entries  (6983554) (CVE-2010-4450)

  - JDK unspecified vulnerability in Sound component (CVE-2010-4454, CVE-2010-4462, CVE-2010-4473)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

IBM Java 1.4.2 was updated to SR13 FP9, fixing bugs and security issues.

More information can be found on the IBM JDK Alerts page :

http://www.ibm.com/developerworks/java/jdk/alerts/

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 24 / 5.0 Update 28 / 1.4.2_30. Such versions are potentially affected by security issue in the following components :

  - Deployment
  - HotSpot
  - Install
  - JAXP
  - Java Language
  - JDBC
  - Launcher
  - Networking
  - Security
  - Sound
  - Swing
  - XML Digital Signature
  - 2D

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0357 advisory.

    The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and     the IBM Java 2 Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java 2 Runtime     Environment and the IBM Java 2 Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2010-4422, CVE-2010-4447,     CVE-2010-4448, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463,     CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4471,     CVE-2010-4473, CVE-2010-4475)

    Note: The RHSA-2010:0987 and RHSA-2011:0290 java-1.6.0-ibm errata were     missing 64-bit PowerPC packages for Red Hat Enterprise Linux 4 Extras. This     erratum provides 64-bit PowerPC packages for Red Hat Enterprise Linux 4     Extras as expected.

    All users of java-1.6.0-ibm are advised to upgrade to these updated     packages, containing the IBM 1.6.0 SR9-FP1 Java release. All running     instances of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several vulnerabilities in the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Java Runtime Environment (JRE)
  - libuser
  - Netscape Portable Runtime (NSPR) 
  - Network Security Services (NSS)
  - OpenSSL

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0870 advisory.

  - JDK unspecified vulnerability in Deployment component (CVE-2010-4447, CVE-2010-4466, CVE-2010-4475)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - JDK unspecified vulnerability in Sound component (CVE-2010-4454, CVE-2010-4462, CVE-2010-4473)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

The following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

Following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
56665	VMSA-2011-0013 : VMware third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2011/10/28	2021/1/6	critical
64844	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU) (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	critical
75541	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0126-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
52709	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2011:0364)	Nessus	Red Hat Local Security Checks	2011/3/18	2024/4/21	critical
53883	SuSE9 Security Update : IBM Java JRE and SDK (YOU Patch Number 12706)	Nessus	SuSE Local Security Checks	2011/5/13	2021/1/14	critical
52002	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU)	Nessus	Windows	2011/2/16	2022/4/11	critical
52701	RHEL 6 : java-1.6.0-ibm (RHSA-2011:0357)	Nessus	Red Hat Local Security Checks	2011/3/17	2025/4/14	critical
60964	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
89681	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)	Nessus	Misc.	2016/3/4	2021/1/6	critical
193982	RHEL 5 : java-1.4.2-ibm-sap (RHSA-2011:0870)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/4/29	critical
52067	SuSE 11.1 Security Update : Sun Java 1.6 (SAT Patch Number 3976)	Nessus	SuSE Local Security Checks	2011/2/23	2021/1/19	critical
52068	SuSE 10 Security Update : IBM Java 1.6 (ZYPP Patch Number 7342)	Nessus	SuSE Local Security Checks	2011/2/23	2021/1/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical