The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0322 advisory.

    [1.6.0.0-1.25.1.10.6.0.1.el5_8]
    - Add oracle-enterprise.patch

    [1:1.6.0.0-1.25.1.10.6]
    - Updated to IcedTea6 1.10.6
    - Resolves: rhbz#787142
    - Security fixes
      - S7082299: Fix in AtomicReferenceArray
      - S7088367: Fix issues in java sound
      - S7110683: Issues with some KeyboardFocusManager method
      - S7110687: Issues with TimeZone class
      - S7110700: Enhance exception throwing mechanism in ObjectStreamClass
      - S7110704: Issues with some method in corba
      - S7112642: Incorrect checking for graphics rendering object
      - S7118283: Better input parameter checking in zip file processing
      - S7126960: Add property to limit number of request headers to the HTTP Server
    - Bug fixes
      - RH580478: Desktop files should not use hardcoded path
    - Removed and deleted upstreamed  patch7 - name-rmi-fix.patch
    - Removed and deleted upstreamed Hugepages patches:
      - Source100: 7034464-hugepage.patch
      - Source101: 7037939-hugepage.patch
      - Source102: 7043564-hugepage.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0135 advisory.

    [1:1.6.0.0-1.43.1.10.6]
    - Updated to IcedTea6 1.10.6
    - Resolves: rhbz#787144
    - Security fixes
      - S7082299: Fix in AtomicReferenceArray
      - S7088367: Fix issues in java sound
      - S7110683: Issues with some KeyboardFocusManager method
      - S7110687: Issues with TimeZone class
      - S7110700: Enhance exception throwing mechanism in ObjectStreamClass
      - S7110704: Issues with some method in corba
      - S7112642: Incorrect checking for graphics rendering object
      - S7118283: Better input parameter checking in zip file processing
      - S7126960: Add property to limit number of request headers to the HTTP Server
    - Bug fixes
      - RH580478: Desktop files should not use hardcoded path
    - Removed upstreamed patch7 - java-1.6.0-openjdk-6_2-Z-rmi-fix.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Mac OS X host is running a version of Java for Mac OS X 10.7 that is missing update 2012-001, which updates the Java version to 1.6.0_31.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.

It was discovered that Java2D did not properly check graphics rendering objects before passing them to the native renderer.
Malicious input, or an untrusted Java application or applet could use this flaw to crash the Java Virtual Machine (JVM), or bypass Java sandbox restrictions. (CVE-2012-0497)

It was discovered that the exception thrown on deserialization failure did not always contain a proper identification of the cause of the failure. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2012-0505)

The AtomicReferenceArray class implementation did not properly check if the array was of the expected Object[] type. A malicious Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2011-3571)

It was discovered that the use of TimeZone.setDefault() was not restricted by the SecurityManager, allowing an untrusted Java application or applet to set a new default time zone, and hence bypass Java sandbox restrictions. (CVE-2012-0503)

The HttpServer class did not limit the number of headers read from HTTP requests. A remote attacker could use this flaw to make an application using HttpServer use an excessive amount of CPU time via a specially crafted request. This update introduces a header count limit controlled using the sun.net.httpserver.maxReqHeaders property. The default value is 200. (CVE-2011-5035)

The Java Sound component did not properly check buffer boundaries.
Malicious input, or an untrusted Java application or applet could use this flaw to cause the Java Virtual Machine (JVM) to crash or disclose a portion of its memory. (CVE-2011-3563)

A flaw was found in the AWT KeyboardFocusManager that could allow an untrusted Java application or applet to acquire keyboard focus and possibly steal sensitive information. (CVE-2012-0502)

It was discovered that the CORBA (Common Object Request Broker Architecture) implementation in Java did not properly protect repository identifiers on certain CORBA objects. This could have been used to modify immutable object data. (CVE-2012-0506)

An off-by-one flaw, causing a stack overflow, was found in the unpacker for ZIP files. A specially crafted ZIP archive could cause the Java Virtual Machine (JVM) to crash when opened. (CVE-2012-0501)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.10.6.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Multiple security issues were identified and fixed in OpenJDK (icedtea6) :

Fix issues in java sound (CVE-2011-3563).

Fix in AtomicReferenceArray (CVE-2011-3571).

Add property to limit number of request headers to the HTTP Server (CVE-2011-5035).

Incorect checking for graphics rendering object (CVE-2012-0497).

Multiple unspecified vulnerabilities allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors (CVE-2012-0498. CVE-2012-0499, CVE-2012-0500).

Better input parameter checking in zip file processing (CVE-2012-0501).

Issues with some KeyboardFocusManager method (CVE-2012-0502).

Issues with TimeZone class (CVE-2012-0503).

Enhance exception throwing mechanism in ObjectStreamClass (CVE-2012-0505).

Issues with some method in corba (CVE-2012-0506).

The updated packages provides icedtea6-1.10.6 which is not vulnerable to these issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0135 advisory.

    These packages provide the OpenJDK 6 Java Runtime Environment and the     OpenJDK 6 Software Development Kit.

    It was discovered that Java2D did not properly check graphics rendering     objects before passing them to the native renderer. Malicious input, or an     untrusted Java application or applet could use this flaw to crash the Java     Virtual Machine (JVM), or bypass Java sandbox restrictions. (CVE-2012-0497)

    It was discovered that the exception thrown on deserialization failure did     not always contain a proper identification of the cause of the failure. An     untrusted Java application or applet could use this flaw to bypass Java     sandbox restrictions. (CVE-2012-0505)

    The AtomicReferenceArray class implementation did not properly check if     the array was of the expected Object[] type. A malicious Java application     or applet could use this flaw to bypass Java sandbox restrictions.
    (CVE-2011-3571)

    It was discovered that the use of TimeZone.setDefault() was not restricted     by the SecurityManager, allowing an untrusted Java application or applet to     set a new default time zone, and hence bypass Java sandbox restrictions.
    (CVE-2012-0503)

    The HttpServer class did not limit the number of headers read from HTTP     requests. A remote attacker could use this flaw to make an application     using HttpServer use an excessive amount of CPU time via a     specially-crafted request. This update introduces a header count limit     controlled using the sun.net.httpserver.maxReqHeaders property. The default     value is 200. (CVE-2011-5035)

    The Java Sound component did not properly check buffer boundaries.
    Malicious input, or an untrusted Java application or applet could use this     flaw to cause the Java Virtual Machine (JVM) to crash or disclose a portion     of its memory. (CVE-2011-3563)

    A flaw was found in the AWT KeyboardFocusManager that could allow an     untrusted Java application or applet to acquire keyboard focus and possibly     steal sensitive information. (CVE-2012-0502)

    It was discovered that the CORBA (Common Object Request Broker     Architecture) implementation in Java did not properly protect repository     identifiers on certain CORBA objects. This could have been used to modify     immutable object data. (CVE-2012-0506)

    An off-by-one flaw, causing a stack overflow, was found in the unpacker for     ZIP files. A specially-crafted ZIP archive could cause the Java Virtual     Machine (JVM) to crash when opened. (CVE-2012-0501)

    Note: If the web browser plug-in provided by the icedtea-web package was     installed, the issues exposed via Java applets could have been exploited     without user interaction if a user visited a malicious website.

    This erratum also upgrades the OpenJDK package to IcedTea6 1.10.6. Refer to     the NEWS file, linked to in the References, for further information.

    All users of java-1.6.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.

It was discovered that Java2D did not properly check graphics rendering objects before passing them to the native renderer.
Malicious input, or an untrusted Java application or applet could use this flaw to crash the Java Virtual Machine (JVM), or bypass Java sandbox restrictions. (CVE-2012-0497)

It was discovered that the exception thrown on deserialization failure did not always contain a proper identification of the cause of the failure. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2012-0505)

The AtomicReferenceArray class implementation did not properly check if the array was of the expected Object[] type. A malicious Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2011-3571)

It was discovered that the use of TimeZone.setDefault() was not restricted by the SecurityManager, allowing an untrusted Java application or applet to set a new default time zone, and hence bypass Java sandbox restrictions. (CVE-2012-0503)

The HttpServer class did not limit the number of headers read from HTTP requests. A remote attacker could use this flaw to make an application using HttpServer use an excessive amount of CPU time via a specially crafted request. This update introduces a header count limit controlled using the sun.net.httpserver.maxReqHeaders property. The default value is 200. (CVE-2011-5035)

The Java Sound component did not properly check buffer boundaries.
Malicious input, or an untrusted Java application or applet could use this flaw to cause the Java Virtual Machine (JVM) to crash or disclose a portion of its memory. (CVE-2011-3563)

A flaw was found in the AWT KeyboardFocusManager that could allow an untrusted Java application or applet to acquire keyboard focus and possibly steal sensitive information. (CVE-2012-0502)

It was discovered that the CORBA (Common Object Request Broker Architecture) implementation in Java did not properly protect repository identifiers on certain CORBA objects. This could have been used to modify immutable object data. (CVE-2012-0506)

An off-by-one flaw, causing a stack overflow, was found in the unpacker for ZIP files. A specially crafted ZIP archive could cause the Java Virtual Machine (JVM) to crash when opened. (CVE-2012-0501)

This erratum also upgrades the OpenJDK package to IcedTea6 1.10.6.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform.

  - CVE-2011-3377     The IcedTea browser plugin included in the openjdk-6     package does not properly enforce the Same Origin Policy     on web content served under a domain name which has a     common suffix with the required domain name.

  - CVE-2011-3563     The Java Sound component did not properly check for     array boundaries. A malicious input or an untrusted Java     application or applet could use this flaw to cause Java     Virtual Machine to crash or disclose portion of its     memory.

  - CVE-2011-5035     The OpenJDK embedded web server did not guard against an     excessive number of a request parameters, leading to a     denial of service vulnerability involving hash     collisions.

  - CVE-2012-0497     It was discovered that Java2D did not properly check     graphics rendering objects before passing them to the     native renderer. This could lead to JVM crash or Java     sandbox bypass.

  - CVE-2012-0501     The ZIP central directory parser used by     java.util.zip.ZipFile entered an infinite recursion in     native code when processing a crafted ZIP file, leading     to a denial of service.

  - CVE-2012-0502     A flaw was found in the AWT KeyboardFocusManager class     that could allow untrusted Java applets to acquire     keyboard focus and possibly steal sensitive information.

  - CVE-2012-0503     The java.util.TimeZone.setDefault() method lacked a     security manager invocation, allowing an untrusted Java     application or applet to set a new default time zone.

  - CVE-2012-0505     The Java serialization code leaked references to     serialization exceptions, possibly leaking critical     objects to untrusted code in Java applets and     applications.

  - CVE-2012-0506     It was discovered that CORBA implementation in Java did     not properly protect repository identifiers (that can be     obtained using _ids() method) on certain Corba objects.
    This could have been used to perform modification of the     data that should have been immutable.

  - CVE-2012-0507     The AtomicReferenceArray class implementation did not     properly check if the array is of an expected Object[]     type. A malicious Java application or applet could use     this flaw to cause Java Virtual Machine to crash or     bypass Java sandbox restrictions.

IBM Java 1.6.0 was updated to SR10-FP1, fixing various security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
68487	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2012-0322)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
68459	Oracle Linux 6 : java-1.6.0-openjdk (ELSA-2012-0135)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
58606	Mac OS X : Java for OS X Lion 2012-001	Nessus	MacOS X Local Security Checks	2012/4/5	2023/11/27	critical
61248	Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64 (20120214)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
58026	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2012:021)	Nessus	Mandriva Local Security Checks	2012/2/20	2021/1/6	critical
57956	RHEL 6 : java-1.6.0-openjdk (RHSA-2012:0135)	Nessus	Red Hat Local Security Checks	2012/2/15	2025/4/15	critical
58084	RHEL 5 : java-1.6.0-openjdk (RHSA-2012:0322)	Nessus	Red Hat Local Security Checks	2012/2/22	2022/3/8	critical
58148	Debian DSA-2420-1 : openjdk-6 - several vulnerabilities	Nessus	Debian Local Security Checks	2012/2/29	2022/3/8	critical
64164	SuSE 11.1 Security Update : IBM Java 1.6.0 (SAT Patch Number 6225)	Nessus	SuSE Local Security Checks	2013/1/25	2022/3/8	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	2014/1/27	2025/6/10	critical
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	2014/6/30	2022/12/5	critical
78975	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)	Nessus	Red Hat Local Security Checks	2014/11/8	2022/12/5	critical

检测

插件搜索

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical