The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 24 / 5.0 Update 28 / 1.4.2_30. Such versions are potentially affected by security issue in the following components :

  - Deployment
  - HotSpot
  - Install
  - JAXP
  - Java Language
  - JDBC
  - Launcher
  - Networking
  - Security
  - Sound
  - Swing
  - XML Digital Signature
  - 2D

This update fixes several vulnerabilities in the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Java Runtime Environment (JRE)
  - libuser
  - Netscape Portable Runtime (NSPR) 
  - Network Security Services (NSS)
  - OpenSSL

A flaw was found in the Swing library. Forged TimerEvents could be used to bypass SecurityManager checks, allowing access to otherwise blocked files and directories. (CVE-2010-4465)

A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management within the Java Virtual Machine (JVM), which could lead to heap corruption. (CVE-2010-4469)

A flaw was found in the way JAXP (Java API for XML Processing) components were handled, allowing them to be manipulated by untrusted applets. This could be used to elevate privileges and bypass secure XML processing restrictions. (CVE-2010-4470)

It was found that untrusted applets could create and place cache entries in the name resolution cache. This could allow an attacker targeted manipulation over name resolution until the OpenJDK VM is restarted. (CVE-2010-4448)

It was found that the Java launcher provided by OpenJDK did not check the LD_LIBRARY_PATH environment variable for insecure empty path elements. A local attacker able to trick a user into running the Java launcher while working from an attacker-writable directory could use this flaw to load an untrusted library, subverting the Java security model. (CVE-2010-4450)

A flaw was found in the XML Digital Signature component in OpenJDK.
Untrusted code could use this flaw to replace the Java Runtime Environment (JRE) XML Digital Signature Transform or C14N algorithm implementations to intercept digital signature operations.
(CVE-2010-4472)

Note: All of the above flaws can only be remotely triggered in OpenJDK by calling the 'appletviewer' application.

This update also provides one defense in depth patch. (BZ#676019)

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0281 advisory.

    [1.6.0.0-1.39.b17]
    - respin of  IcedTea6 1.7.10
    - Resolves: rhbz#676276

    [1.6.0.0-1.37.b17]
    - Updated to IcedTea6 1.7.10
    - Resolves: rhbz#676276

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

The following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

Following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

Multiple vulnerabilities were fixed in java-1_6_0-openjdk :

  - CVE-2010-4448: CVSS v2 Base Score: 2.6     (AV:N/AC:H/Au:N/C:N/I:P/A:N): DNS cache poisoning by     untrusted applets

  - CVE-2010-4450: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Launcher incorrect     processing of empty library path entries

  - CVE-2010-4465: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P): Swing timer-based security     manager bypass

  - CVE-2010-4469: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P): Hotspot backward jsr heap     corruption

  - CVE-2010-4470: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): JAXP untrusted component     state manipulation

  - CVE-2010-4471: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Java2D font-related system     property leak

  - CVE-2010-4472: CVSS v2 Base Score: 2.6     (AV:N/AC:H/Au:N/C:P/I:N/A:N): Untrusted code allowed to     replace DSIG/C14N implementation

  - CVE-2011-0706: CVSS v2 Base Score: 7.5     (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges,     and Access Control (CWE-264)

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 9.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 4.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.

A flaw was found in the Swing library. Forged TimerEvents could be used to bypass SecurityManager checks, allowing access to otherwise blocked files and directories. (CVE-2010-4465)

A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management within the Java Virtual Machine (JVM), which could lead to heap corruption. (CVE-2010-4469)

A flaw was found in the way JAXP (Java API for XML Processing) components were handled, allowing them to be manipulated by untrusted applets. This could be used to elevate privileges and bypass secure XML processing restrictions. (CVE-2010-4470)

It was found that untrusted applets could create and place cache entries in the name resolution cache. This could allow an attacker targeted manipulation over name resolution until the OpenJDK VM is restarted. (CVE-2010-4448)

It was found that the Java launcher provided by OpenJDK did not check the LD_LIBRARY_PATH environment variable for insecure empty path elements. A local attacker able to trick a user into running the Java launcher while working from an attacker-writable directory could use this flaw to load an untrusted library, subverting the Java security model. (CVE-2010-4450)

A flaw was found in the XML Digital Signature component in OpenJDK.
Untrusted code could use this flaw to replace the Java Runtime Environment (JRE) XML Digital Signature Transform or C14N algorithm implementations to intercept digital signature operations.
(CVE-2010-4472)

Note: All of the above flaws can only be remotely triggered in OpenJDK by calling the 'appletviewer' application.

This update also provides one defense in depth patch. (BZ#676019)

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel (ARM) architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes vulnerabilities in OpenJDK 6 for armel (ARM) architectures for Ubuntu 10.10.

It was discovered that untrusted Java applets could create domain name resolution cache entries, allowing an attacker to manipulate name resolution within the JVM. (CVE-2010-4448)

It was discovered that the Java launcher did not did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. (CVE-2010-4450)

It was discovered that within the Swing library, forged timer events could allow bypass of SecurityManager checks.
This could allow an attacker to access restricted resources.
(CVE-2010-4465)

It was discovered that certain bytecode combinations confused memory management within the HotSpot JVM. This could allow an attacker to cause a denial of service through an application crash or possibly inject code.
(CVE-2010-4469)

It was discovered that the way JAXP components were handled allowed them to be manipulated by untrusted applets. An attacker could use this to bypass XML processing restrictions and elevate privileges. (CVE-2010-4470)

It was discovered that the Java2D subcomponent, when processing broken CFF fonts could leak system properties.
(CVE-2010-4471)

It was discovered that a flaw in the XML Digital Signature component could allow an attacker to cause untrusted code to replace the XML Digital Signature Transform or C14N algorithm implementations. (CVE-2010-4472)

Konstantin Preisser and others discovered that specific double literals were improperly handled, allowing a remote attacker to cause a denial of service. (CVE-2010-4476)

It was discovered that the JNLPClassLoader class when handling multiple signatures allowed remote attackers to gain privileges due to the assignment of an inappropriate security descriptor. (CVE-2011-0706).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201111-02 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below and       the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause       unspecified impact, possibly including remote execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

Following CVEs were addressed: CVE-2010-4452 CVE-2010-4454 CVE-2010-4462 CVE-2010-4463 CVE-2010-4465 CVE-2010-4467 CVE-2010-4469 CVE-2010-4473 CVE-2010-4422 CVE-2010-4451 CVE-2010-4466 CVE-2010-4470 CVE-2010-4471 CVE-2010-4476 CVE-2010-4447 CVE-2010-4475 CVE-2010-4468 CVE-2010-4450 CVE-2010-4448 CVE-2010-4472 CVE-2010-4474

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
52002	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU)	Nessus	Windows	2011/2/16	2022/4/11	critical
60964	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
89681	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)	Nessus	Misc.	2016/3/4	2021/1/6	critical
60963	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
68205	Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2011-0281)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	2014/6/30	2022/12/5	critical
52067	SuSE 11.1 Security Update : Sun Java 1.6 (SAT Patch Number 3976)	Nessus	SuSE Local Security Checks	2011/2/23	2021/1/19	critical
52068	SuSE 10 Security Update : IBM Java 1.6 (ZYPP Patch Number 7342)	Nessus	SuSE Local Security Checks	2011/2/23	2021/1/19	critical
53735	openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2011:0155-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	critical
52587	Mac OS X : Java for Mac OS X 10.5 Update 9	Nessus	MacOS X Local Security Checks	2011/3/9	2024/7/24	high
52588	Mac OS X : Java for Mac OS X 10.6 Update 4	Nessus	MacOS X Local Security Checks	2011/3/9	2024/7/24	high
52020	RHEL 5 / 6 : java-1.6.0-openjdk (RHSA-2011:0281)	Nessus	Red Hat Local Security Checks	2011/2/18	2021/1/14	critical
53421	CentOS 5 : java-1.6.0-openjdk (CESA-2011:0281)	Nessus	CentOS Local Security Checks	2011/4/15	2021/1/4	critical
65100	Ubuntu 10.10 : openjdk-6b18 vulnerabilities (USN-1079-3)	Nessus	Ubuntu Local Security Checks	2013/3/9	2019/9/19	critical
56724	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2011/11/7	2022/12/5	critical
75872	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-4147)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical