The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 4.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

IBM Java 6 SR9 FP1 was updated to fix a critical security bug in float number handling :

  - The Java Runtime Environment hangs forever when     converting '2.2250738585072012e-308' to a binary     floating-point number. (CVE-2010-4476)

IBM Java 5 was updated to SR 12 FP 4 fixing various security issues.

For more details, please check the IBM JDK Alerts page :

http://www.ibm.com/developerworks/java/jdk/alerts/

The remote host is affected by the vulnerability described in GLSA-201111-02 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below and       the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause       unspecified impact, possibly including remote execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0880 advisory.

  - TLS: MITM attacks via session renegotiation (CVE-2009-3555)

  - krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) (CVE-2010-1321)

  - OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004) (CVE-2010-3541,     CVE-2010-3573)

  - OpenJDK DNS server IP address information leak (6957564) (CVE-2010-3548)

  - OpenJDK HttpURLConnection request splitting (6952017) (CVE-2010-3549)

  - JDK unspecified vulnerability in Java Web Start component (CVE-2010-3550, CVE-2010-3558)

  - OpenJDK local network address disclosure (6952603) (CVE-2010-3551)

  - OpenJDK Swing unsafe reflection usage (6622002) (CVE-2010-3553)

  - JDK unspecified vulnerability in Deployment component (CVE-2010-3555, CVE-2010-4422, CVE-2010-4447,     CVE-2010-4452, CVE-2010-4463, CVE-2010-4466, CVE-2010-4467, CVE-2010-4475)

  - JDK unspecified vulnerability in 2D component (CVE-2010-3556, CVE-2010-3571)

  - OpenJDK Swing mutable static (6938813) (CVE-2010-3557)

  - JDK unspecified vulnerability in Networking component (CVE-2010-3560)

  - OpenJDK IndexColorModel double-free (6925710) (CVE-2010-3562)

  - OpenJDK: unspecified vulnerability in Deployment component (CVE-2010-3563)

  - OpenJDK JPEG writeImage remote code execution (6963023) (CVE-2010-3565)

  - OpenJDK ICC Profile remote code execution (6963489) (CVE-2010-3566)

  - OpenJDK Deserialization Race condition (6559775) (CVE-2010-3568)

  - OpenJDK Serialization inconsistencies (6966692) (CVE-2010-3569)

  - JDK unspecified vulnerability in Sound component (CVE-2010-3572, CVE-2010-4454, CVE-2010-4462,     CVE-2010-4473)

  - OpenJDK HttpURLConnection incomplete TRACE permission check (6981426) (CVE-2010-3574)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

  - JDK Double.parseDouble Denial-Of-Service (CVE-2010-4476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several vulnerabilities in the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 24 / 5.0 Update 28 / 1.4.2_30. Such versions are potentially affected by security issue in the following components :

  - Deployment
  - HotSpot
  - Install
  - JAXP
  - Java Language
  - JDBC
  - Launcher
  - Networking
  - Security
  - Sound
  - Swing
  - XML Digital Signature
  - 2D

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0357 advisory.

    The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and     the IBM Java 2 Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java 2 Runtime     Environment and the IBM Java 2 Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2010-4422, CVE-2010-4447,     CVE-2010-4448, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463,     CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4471,     CVE-2010-4473, CVE-2010-4475)

    Note: The RHSA-2010:0987 and RHSA-2011:0290 java-1.6.0-ibm errata were     missing 64-bit PowerPC packages for Red Hat Enterprise Linux 4 Extras. This     erratum provides 64-bit PowerPC packages for Red Hat Enterprise Linux 4     Extras as expected.

    All users of java-1.6.0-ibm are advised to upgrade to these updated     packages, containing the IBM 1.6.0 SR9-FP1 Java release. All running     instances of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0364 advisory.

  - JDK unspecified vulnerability in Deployment component (CVE-2010-4447, CVE-2010-4466, CVE-2010-4475)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Launcher incorrect processing of empty library path entries  (6983554) (CVE-2010-4450)

  - JDK unspecified vulnerability in Sound component (CVE-2010-4454, CVE-2010-4462, CVE-2010-4473)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

IBM Java 1.4.2 was updated to SR13 FP9, fixing bugs and security issues.

More information can be found on the IBM JDK Alerts page :

http://www.ibm.com/developerworks/java/jdk/alerts/

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Java Runtime Environment (JRE)
  - libuser
  - Netscape Portable Runtime (NSPR) 
  - Network Security Services (NSS)
  - OpenSSL

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
52588	Mac OS X : Java for Mac OS X 10.6 Update 4	Nessus	MacOS X Local Security Checks	2011/3/9	2024/7/24	high
52751	SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4109)	Nessus	SuSE Local Security Checks	2011/3/22	2021/1/19	critical
52752	SuSE 10 Security Update : java-1_6_0-ibm, java-1_6_0-ibm-32bit, java-1_6_0-ibm-64bit, java-1_6_0-ibm-alsa, java-1_6_0-ibm-alsa-32bit, java-1_6_0-ibm-demo, java-1_6_0-ibm-devel, java-1_6_0-ibm-devel-32bit, java-1_6_0-ibm-fonts, java-1_6_0-ibm-jdbc, java-1_6_0-ibm-jdbc-32bit, java-1_6_0-ibm-jdbc-64bit, java-1_6_0-ibm-plugin, java-1_6_0-ibm-plugin-32bit, java-1_6_0-ibm-src (ZYPP Patch Number 7369)	Nessus	SuSE Local Security Checks	2011/3/22	2021/1/19	critical
53235	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7388)	Nessus	SuSE Local Security Checks	2011/3/31	2021/1/19	critical
56724	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2011/11/7	2022/12/5	critical
63983	RHEL 5 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2011:0880)	Nessus	Red Hat Local Security Checks	2013/1/24	2024/4/21	critical
60964	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
52002	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU)	Nessus	Windows	2011/2/16	2022/4/11	critical
52701	RHEL 6 : java-1.6.0-ibm (RHSA-2011:0357)	Nessus	Red Hat Local Security Checks	2011/3/17	2025/4/14	critical
52709	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2011:0364)	Nessus	Red Hat Local Security Checks	2011/3/18	2024/4/21	critical
53883	SuSE9 Security Update : IBM Java JRE and SDK (YOU Patch Number 12706)	Nessus	SuSE Local Security Checks	2011/5/13	2021/1/14	critical
89681	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)	Nessus	Misc.	2016/3/4	2021/1/6	critical

检测

插件搜索

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical