USN-1505-1 fixed vulnerabilities in OpenJDK 6. As part of the update, IcedTea-Web packages were upgraded to a new version. That upgrade introduced a regression which prevented the IcedTea-Web plugin from working with the Chromium web browser in Ubuntu 11.04 and Ubuntu 11.10. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that multiple flaws existed in the CORBA (Common Object Request Broker Architecture) implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711, CVE-2012-1719)

It was discovered that multiple flaws existed in the OpenJDK font manager's layout lookup implementation. A attacker could specially craft a font file that could cause a denial of service through crashing the JVM (Java Virtual Machine) or possibly execute arbitrary code. (CVE-2012-1713)

It was discovered that the SynthLookAndFeel class from Swing in OpenJDK did not properly prevent access to certain UI elements from outside the current application context. An attacker could create a Java application or applet that used this flaw to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1716)

It was discovered that OpenJDK runtime library classes could create temporary files with insecure permissions. A local attacker could use this to gain access to sensitive information. (CVE-2012-1717)

It was discovered that OpenJDK did not handle CRLs (Certificate Revocation Lists) properly. A remote attacker could use this to gain access to sensitive information.
(CVE-2012-1718)

It was discovered that the OpenJDK HotSpot Virtual Machine did not properly verify the bytecode of the class to be executed. A remote attacker could create a Java application or applet that used this to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1723, CVE-2012-1725)

It was discovered that the OpenJDK XML (Extensible Markup Language) parser did not properly handle some XML documents.
An attacker could create an XML document that caused a denial of service in a Java application or applet parsing the document. (CVE-2012-1724)

As part of this update, the IcedTea web browser applet plugin was updated for Ubuntu 10.04 LTS, Ubuntu 11.04, and Ubuntu 11.10.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0729 advisory.

    [1:1.6.0.0-1.48.1.11.3]
    - Access gnome bridge jar is forced to have 644 permissions
    - Resolves: rhbz#828751

    [1:1.6.0.0-1.47.1.11.3]
    - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch:
      - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.
      - packages added also to package.definition
    - Resolves: rhbz#828751

    [1:1.6.0.0-1.46.1.11.3]
    - Sync with 6.3:
    - Bump to IcedTea6 1.11.3
    - With removed patch8 - java-1.6.0-openjdk-jirafix_2820_2821.patch
    - Including patch7 - java-1.6.0-openjdk-jstack.patch
    - Including patch3, java-1.6.0-openjdk-java-access-bridge-security.patch modification
    - Resolves: rhbz#828751

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple flaws were discovered in the CORBA (Common Object Request Broker Architecture) implementation in Java. A malicious Java application or applet could use these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711 , CVE-2012-1719)

It was discovered that the SynthLookAndFeel class from Swing did not properly prevent access to certain UI elements from outside the current application context. A malicious Java application or applet could use this flaw to crash the Java Virtual Machine, or bypass Java sandbox restrictions. (CVE-2012-1716)

Multiple flaws were discovered in the font manager's layout lookup implementation. A specially crafted font file could cause the Java Virtual Machine to crash or, possibly, execute arbitrary code with the privileges of the user running the virtual machine. (CVE-2012-1713)

Multiple flaws were found in the way the Java HotSpot Virtual Machine verified the bytecode of the class file to be executed. A specially crafted Java application or applet could use these flaws to crash the Java Virtual Machine, or bypass Java sandbox restrictions.
(CVE-2012-1723 , CVE-2012-1725)

It was discovered that the Java XML parser did not properly handle certain XML documents. An attacker able to make a Java application parse a specially crafted XML file could use this flaw to make the XML parser enter an infinite loop. (CVE-2012-1724)

It was discovered that the Java security classes did not properly handle Certificate Revocation Lists (CRL). CRL containing entries with duplicate certificate serial numbers could have been ignored.
(CVE-2012-1718)

It was discovered that various classes of the Java Runtime library could create temporary files with insecure permissions. A local attacker could use this flaw to gain access to the content of such temporary files. (CVE-2012-1717)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-662:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2012-1711     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote     attackers to affect confidentiality, integrity, and availability, related to CORBA.
     CVE-2012-1713     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, 5 update 35 and earlier, 1.4.2_37 and earlier, and JavaFX 2.1 and     earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors     related to 2D.
     CVE-2012-1716     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to Swing.
     CVE-2012-1717     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to     affect confidentiality via unknown vectors related to printing on Solaris or Linux.
     CVE-2012-1718     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote     attackers to affect availability via unknown vectors related to Security.
     CVE-2012-1719     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote     attackers to affect integrity, related to CORBA.
     CVE-2012-1723     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
     CVE-2012-1724     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP.
     CVE-2012-1725     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and     earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to Hotspot.
    Fixed bugs:
     Starting with java-1.6.0-openjdk-1.6.0.0-1.42.1.10.4.AXS4, rmiregisty, the Java Remote Object Registry,     would only start if run with the java.rmi.server.codebase argument. This has been fixed and the registry     can started without argument.
     Fixed the implementation of channel binding for the Kerberos protocol: OpenJDK now process Kerberos     General Security Services contexts and handles unset channel binding correctly, fixing interopability     problems with Internet Explorer on Windows Server 2008.
     The SystemTap script translator sometimes crashed when used with jstack() systemtap support with an error     message similar to:
    ERROR: kernel read fault at 0x0000000000000018 (addr) near identifier '@cast' at     /usr/share/systemtap/tapset/x86_64/jstack.stp:362:29     The jstack code has been imprved and is now more reliable.
     Fixed many problems when using signed jar files.
    Enhancement:
     Added support for huge.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0734 advisory.

    The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and     the Sun Java 6 Software Development Kit.

    This update fixes several vulnerabilities in the Sun Java 6 Runtime     Environment and the Sun Java 6 Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE Critical     Patch page, listed in the References section. (CVE-2012-0551,     CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718,     CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724,     CVE-2012-1725)

    All users of java-1.6.0-sun are advised to upgrade to these updated     packages, which provide JDK and JRE 6 Update 33 and resolve these issues.
    All running instances of Sun Java must be restarted for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.

Multiple flaws were discovered in the CORBA (Common Object Request Broker Architecture) implementation in Java. A malicious Java application or applet could use these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711, CVE-2012-1719)

It was discovered that the SynthLookAndFeel class from Swing did not properly prevent access to certain UI elements from outside the current application context. A malicious Java application or applet could use this flaw to crash the Java Virtual Machine, or bypass Java sandbox restrictions. (CVE-2012-1716)

Multiple flaws were discovered in the font manager's layout lookup implementation. A specially crafted font file could cause the Java Virtual Machine to crash or, possibly, execute arbitrary code with the privileges of the user running the virtual machine. (CVE-2012-1713)

Multiple flaws were found in the way the Java HotSpot Virtual Machine verified the bytecode of the class file to be executed. A specially crafted Java application or applet could use these flaws to crash the Java Virtual Machine, or bypass Java sandbox restrictions.
(CVE-2012-1723, CVE-2012-1725)

It was discovered that the Java XML parser did not properly handle certain XML documents. An attacker able to make a Java application parse a specially crafted XML file could use this flaw to make the XML parser enter an infinite loop. (CVE-2012-1724)

It was discovered that the Java security classes did not properly handle Certificate Revocation Lists (CRL). CRL containing entries with duplicate certificate serial numbers could have been ignored.
(CVE-2012-1718)

It was discovered that various classes of the Java Runtime library could create temporary files with insecure permissions. A local attacker could use this flaw to gain access to the content of such temporary files. (CVE-2012-1717)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.3.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

java-1_6_0-openjdk was updated to the IcedTea 1.11.3 release, fixing multiple security issues :

  - S7079902, CVE-2012-1711: Refine CORBA data models

  - S7143606, CVE-2012-1717: File.createTempFile should be     improved for temporary files created by the platform.

  - S7143614, CVE-2012-1716: SynthLookAndFeel stability     improvement

  - S7143617, CVE-2012-1713: Improve fontmanager layout     lookup operations

  - S7143851, CVE-2012-1719: Improve IIOP stub and tie     generation in RMIC

  - S7143872, CVE-2012-1718: Improve certificate extension     processing

  - S7152811, CVE-2012-1723: Issues in client compiler

  - S7157609, CVE-2012-1724: Issues with loop

  - S7160757, CVE-2012-1725: Problem with     hotspot/runtime_classfile

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 5 / 6 Update 33 / 5.0 Update 36 / 1.4.2_38 and is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Deployment
  - Hotspot
  - Swing
  - CORBA
  - Libraries
  - JAXP
  - Security
  - Networking
  - Java Runtime Environment

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 9, which updates the Java version to 1.6.0_33.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

In addition, the Java browser plugin and Java Web Start are deactivated if they remain unused for 35 days or do not meet the criteria for minimum safe version.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0729 advisory.

  - OpenJDK: improper protection of CORBA data models (CORBA, 7079902) (CVE-2012-1711)

  - OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) (CVE-2012-1713)

  - OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) (CVE-2012-1716)

  - OpenJDK: insecure temporary file permissions (JRE, 7143606) (CVE-2012-1717)

  - OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) (CVE-2012-1718)

  - OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) (CVE-2012-1719)

  - OpenJDK: insufficient field accessibility checks (HotSpot, 7152811) (CVE-2012-1723)

  - OpenJDK: XML parsing infinite loop (JAXP, 7157609) (CVE-2012-1724)

  - OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) (CVE-2012-1725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1019 advisory.

    The Oracle Java 7 release includes the Oracle Java 7 Runtime Environment     and the Oracle Java 7 Software Development Kit.

    This update fixes several vulnerabilities in the Oracle Java 7 Runtime     Environment and the Oracle Java 7 Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE Critical     Patch page, listed in the References section. (CVE-2012-0551,     CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718,     CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724,     CVE-2012-1725, CVE-2012-1726)

    All users of java-1.7.0-oracle are advised to upgrade to these updated     packages, which provide Oracle Java 7 Update 5 and resolve these issues.
    All running instances of Oracle Java must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform.

  - CVE-2012-1711 CVE-2012-1719     Multiple errors in the CORBA implementation could lead     to breakouts of the Java sandbox.

  - CVE-2012-1713     Missing input sanitising in the font manager could lead     to the execution of arbitrary code.

  - CVE-2012-1716     The SynthLookAndFeel Swing class could be abused to     break out of the Java sandbox.

  - CVE-2012-1717     Several temporary files were created insecurely,     resulting in local information disclosure.

  - CVE-2012-1718     Certificate revocation lists were incorrectly     implemented.

  - CVE-2012-1723 CVE-2012-1725     Validation errors in the bytecode verifier of the     Hotspot VM could lead to breakouts of the Java sandbox.

  - CVE-2012-1724     Missing input sanitising in the XML parser could lead to     denial of service through an infinite loop.

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
61729	Ubuntu 11.04 / 11.10 : icedtea-web regression (USN-1505-2)	Nessus	Ubuntu Local Security Checks	2012/8/30	2022/3/8	critical
68541	Oracle Linux 6 : java-1.6.0-openjdk (ELSA-2012-0729)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
69695	Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2012-88)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2022/3/8	critical
284083	MiracleLinux 4 : java-1.6.0-openjdk-1.6.0.0-1.48.1.11.3.AXS4 (AXSA:2012-662:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/16	critical
59492	RHEL 6 : java-1.6.0-sun (RHSA-2012:0734)	Nessus	Red Hat Local Security Checks	2012/6/14	2025/4/15	critical
61329	Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64 (20120613)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2022/3/8	critical
64167	SuSE 11.1 Security Update : java-1_6_0-openjdk (SAT Patch Number 6437)	Nessus	SuSE Local Security Checks	2013/1/25	2022/3/8	critical
64848	Oracle Java SE Multiple Vulnerabilities (June 2012 CPU) (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	critical
59463	Mac OS X : Java for Mac OS X 10.6 Update 9	Nessus	MacOS X Local Security Checks	2012/6/13	2023/11/27	critical
59489	RHEL 6 : java-1.6.0-openjdk (RHSA-2012:0729)	Nessus	Red Hat Local Security Checks	2012/6/14	2024/4/27	medium
59638	RHEL 6 : java-1.7.0-oracle (RHSA-2012:1019)	Nessus	Red Hat Local Security Checks	2012/6/21	2024/11/4	critical
59839	Debian DSA-2507-1 : openjdk-6 - several vulnerabilities	Nessus	Debian Local Security Checks	2012/7/5	2022/3/8	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	2014/1/27	2026/5/22	critical
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	2014/6/30	2022/12/5	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical