The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 9 / 6 Update 37 / 5.0 Update 38 / 1.4.2_40 and is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Beans
  - Concurrency
  - Deployment
  - Hotspot
  - JAX-WS
  - JMX
  - JSSE
  - Libraries
  - Networking
  - Security
  - Swing

Updated java-1.7.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Update 13 November 2012] The file list of this advisory was updated to move java-1.7.0-openjdk-devel from the optional repositories to the base repositories. Additionally, java-1.7.0-openjdk for the HPC Node variant was also moved (this package was already in the base repositories for other product variants). No changes have been made to the packages themselves.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans, Libraries, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5084, CVE-2012-5089)

The default Java security properties configuration did not restrict access to certain com.sun.org.glassfish packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. This update lists those packages as restricted.
(CVE-2012-5076, CVE-2012-5074)

Multiple improper permission check issues were discovered in the Scripting, JMX, Concurrency, Libraries, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071, CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of an incompatible class while performing provider lookup. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS implementation did not properly handle handshake records containing an overly large data length value. An unauthenticated, remote attacker could possibly use this flaw to cause an SSL/TLS server to terminate with an exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain actions in an insecure manner. An untrusted Java application or applet could possibly use these flaws to disclose sensitive information. (CVE-2012-5070, CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it to not perform array initialization in certain cases. An untrusted Java application or applet could use this flaw to disclose portions of the virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect against the creation of multiple seeders. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash code of the canonicalized path name. An untrusted Java application or applet could possibly use this flaw to determine certain system paths, such as the current working directory.
(CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by default. Gopher support can be enabled by setting the newly introduced property, 'jdk.net.registerGopherProtocol', to true.
(CVE-2012-5085)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.3.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1386 advisory.

  - OpenJDK: java.io.FilePermission information leak (Libraries, 6631398) (CVE-2012-3216)

  - OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606) (CVE-2012-4416)

  - OpenJDK: RhinoScriptEngine security bypass (Scripting, 7143535) (CVE-2012-5068)

  - OpenJDK: Executors state handling issues (Concurrency, 7189103) (CVE-2012-5069)

  - OpenJDK: EnvHelp information disclosure (JMX, 7158796) (CVE-2012-5070)

  - OpenJDK: DescriptorSupport insufficient package access checks (JMX, 7192975) (CVE-2012-5071)

  - OpenJDK: AccessController.doPrivilegedWithCombiner() information disclosure (Security, 7172522)     (CVE-2012-5072)

  - OpenJDK: LogManager security bypass (Libraries, 7169884) (CVE-2012-5073)

  - OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7169887) (CVE-2012-5074)

  - OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888) (CVE-2012-5075)

  - OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7163198) (CVE-2012-5076)

  - OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656) (CVE-2012-5077)

  - OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)     (CVE-2012-5079)

  - OpenJDK: JSSE denial of service (JSSE, 7186286) (CVE-2012-5081)

  - OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194) (CVE-2012-5084)

  - OpenJDK: disable Gopher support by default (Gopher, 7189567) (CVE-2012-5085)

  - OpenJDK: XMLDecoder sandbox restriction bypass (Beans, 7195917) (CVE-2012-5086)

  - OpenJDK: PropertyElementHandler insufficient access checks (Beans, 7195549) (CVE-2012-5087)

  - OpenJDK: MethodHandle insufficient access control checks (Libraries, 7196190) (CVE-2012-5088)

  - OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296) (CVE-2012-5089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality and integrity via unknown vectors related to Concurrency. (CVE-2012-5069)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.

Multiple improper permission check issues were discovered in the Beans, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-5086, CVE-2012-5084, CVE-2012-5089)

Multiple improper permission check issues were discovered in the Scripting, JMX, Concurrency, Libraries, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071, CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of an incompatible class while performing provider lookup. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS implementation did not properly handle handshake records containing an overly large data length value. An unauthenticated, remote attacker could possibly use this flaw to cause an SSL/TLS server to terminate with an exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain actions in an insecure manner. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it to not perform array initialization in certain cases. An untrusted Java application or applet could use this flaw to disclose portions of the virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect against the creation of multiple seeders. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash code of the canonicalized path name. An untrusted Java application or applet could possibly use this flaw to determine certain system paths, such as the current working directory.
(CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by default. Gopher support can be enabled by setting the newly introduced property, 'jdk.net.registerGopherProtocol', to true.
(CVE-2012-5085)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.5.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1465 advisory.

    IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2012-1531, CVE-2012-3143,     CVE-2012-3216, CVE-2012-4820, CVE-2012-4822, CVE-2012-5069, CVE-2012-5071,     CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083,     CVE-2012-5084, CVE-2012-5089)

    All users of java-1.5.0-ibm are advised to upgrade to these updated     packages, containing the IBM J2SE 5.0 SR15 release. All running instances     of IBM Java must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

IBM Java 1.5.0 has been updated to SR15 which fixes bugs and security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

CVE-2012-3216 / CVE-2012-3143 / CVE-2012-5073 / CVE-2012-5075 / CVE-2012-5083 / CVE-2012-5083 / CVE-2012-1531 / CVE-2012-5081 / CVE-2012-5069 / CVE-2012-5071 / CVE-2012-5084 / CVE-2012-5079 / CVE-2012-5089

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1467 advisory.

    IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2012-1531, CVE-2012-1532,     CVE-2012-1533, CVE-2012-1718, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216,     CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823, CVE-2012-5067,     CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073,     CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5079,     CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5086, CVE-2012-5087,     CVE-2012-5088, CVE-2012-5089)

    All users of java-1.7.0-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 7 SR3 release. All running instances     of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.5. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.5 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The remote Mac OS X host has a version of Java for Mac OS X 10.6 that is missing Update 11, which updates the Java version to 1.6.0_37.  It is, therefore, affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-967:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2012-3216     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect confidentiality via unknown vectors related to Libraries.
     CVE-2012-4416     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via     unknown vectors related to Hotspot.
     CVE-2012-5068     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and     availability via unknown vectors related to Libraries.
     CVE-2012-5069     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality and integrity via unknown vectors related to Concurrency.
     CVE-2012-5070     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, related to JMX.
     CVE-2012-5071     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality and integrity, related to JMX.
     CVE-2012-5072     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality via unknown     vectors related to Security.
     CVE-2012-5073     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect integrity via unknown vectors related to Libraries.
     CVE-2012-5074     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality and integrity, related to JAX-WS.
     CVE-2012-5075     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality, related to JMX.
     CVE-2012-5076     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
     CVE-2012-5077     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect confidentiality via unknown vectors related to Security.
     CVE-2012-5079     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect integrity via unknown vectors related to Libraries.
     CVE-2012-5081     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect availability, related to JSSE.
     CVE-2012-5084     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.
     CVE-2012-5085     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote     authenticated users to have an unspecified impact via unknown vectors related to Networking. NOTE: the     Oracle CPU states that this issue has a 0.0 CVSS score. If so, then this is not a vulnerability and this     issue should not be included in CVE.
     CVE-2012-5086     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and     availability via unknown vectors related to Beans.
     CVE-2012-5087     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors     related to Beans.
     CVE-2012-5088     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors     related to Libraries.
     CVE-2012-5089     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and     earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect     confidentiality, integrity, and availability, related to JMX.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1386 advisory.

    [1.7.0.9-2.3.3.0.1.el6_3.1]
    - Update DISTRO_NAME in specfile

    [1.7.0.9-2.3.3.el6.1]
    - Changed permissions of sa-jdi.jar to correct 644
    - Resolves: rhbz#865050

    [1.7.0.9-2.3.3.el6]
    - Updated to 2.3.3
    - Updated java-1.7.0-openjdk-java-access-bridge-security.patch
    - Resolves rhbz#s 856124, 865346, 865348, 865350, 865352, 865354, 865357,       865359, 865363, 865365, 865370, 865428, 865471, 865434, 865511, 865514,       865519, 865531, 865541, 865568

    [1.7.0.5-2.3.2.el6.1]
    - Cleanup before security release
    - Updated to latest IcedTea7-forest 2.3
    - Resolves: rhbz#852299

    [1.7.0.5-2.2.1.1.el6.4]
    - Cleanup before security release
    - Removed patches:
       patch 1001 sec-webrevs-openjdk7-29_aug_2012-7162473.patch        patch 1002 sec-webrevs-openjdk7-29_aug_2012-7162476.patch        patch 1003 sec-webrevs-openjdk7-29_aug_2012-7163201.patch        patch 1004 sec-webrevs-openjdk7-29_aug_2012-7194567.patch        patch 1005 sec-webrevs-openjdk7-29_aug_2012-78e01a6ca8d3.patch
    - Resolves: rhbz#852299

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

java-1_7_0-opendjk was updated to icedtea-2.3.3 (bnc#785814)

  - Security fixes

  - S6631398, CVE-2012-3216: FilePermission improved path     checking

  - S7093490: adjust package access in rmiregistry

  - S7143535, CVE-2012-5068: ScriptEngine corrected     permissions

  - S7158796, CVE-2012-5070: Tighten properties checking in     EnvHelp

  - S7158807: Revise stack management with volatile call     sites

  - S7163198, CVE-2012-5076: Tightened package accessibility

  - S7167656, CVE-2012-5077: Multiple Seeders are being     created

  - S7169884, CVE-2012-5073: LogManager checks do not work     correctly for sub-types

  - S7169887, CVE-2012-5074: Tightened package accessibility

  - S7169888, CVE-2012-5075: Narrowing resource definitions     in JMX RMI connector

  - S7172522, CVE-2012-5072: Improve DomainCombiner checking

  - S7186286, CVE-2012-5081: TLS implementation to better     adhere to RFC

  - S7189103, CVE-2012-5069: Executors needs to maintain     state

  - S7189490: More improvements to DomainCombiner checking

  - S7189567, CVE-2012-5085: java net obselete protocol

  - S7192975, CVE-2012-5071: Issue with JMX reflection

  - S7195194, CVE-2012-5084: Better data validation for     Swing

  - S7195549, CVE-2012-5087: Better bean object persistence

  - S7195917, CVE-2012-5086: XMLDecoder parsing at     close-time should be improved

  - S7195919, CVE-2012-5079: (sl) ServiceLoader can throw     CCE without needing to create instance

  - S7196190, CVE-2012-5088: Improve method of handling     MethodHandles

  - S7198296, CVE-2012-5089: Refactor classloader usage

  - S7158800: Improve storage of symbol tables

  - S7158801: Improve VM CompileOnly option

  - S7158804: Improve config file parsing

  - S7198606, CVE-2012-4416: Improve VM optimization

  - Bug fixes

  - Remove merge artefact.

Multiple improper permission check issues were discovered in the Beans, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2012-5086, CVE-2012-5084, CVE-2012-5089)

Multiple improper permission check issues were discovered in the Scripting, JMX, Concurrency, Libraries, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2012-5068, CVE-2012-5071, CVE-2012-5069, CVE-2012-5073, CVE-2012-5072)

It was discovered that java.util.ServiceLoader could create an instance of an incompatible class while performing provider lookup. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2012-5079)

It was discovered that the Java Secure Socket Extension (JSSE) SSL/TLS implementation did not properly handle handshake records containing an overly large data length value. An unauthenticated, remote attacker could possibly use this flaw to cause an SSL/TLS server to terminate with an exception. (CVE-2012-5081)

It was discovered that the JMX component in OpenJDK could perform certain actions in an insecure manner. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5075)

A bug in the Java HotSpot Virtual Machine optimization code could cause it to not perform array initialization in certain cases. An untrusted Java application or applet could use this flaw to disclose portions of the virtual machine's memory. (CVE-2012-4416)

It was discovered that the SecureRandom class did not properly protect against the creation of multiple seeders. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information. (CVE-2012-5077)

It was discovered that the java.io.FilePermission class exposed the hash code of the canonicalized path name. An untrusted Java application or applet could possibly use this flaw to determine certain system paths, such as the current working directory.
(CVE-2012-3216)

This update disables Gopher protocol support in the java.net package by default. Gopher support can be enabled by setting the newly introduced property, 'jdk.net.registerGopherProtocol', to true.
(CVE-2012-5085)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.5.

All running instances of OpenJDK Java must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
64849	Oracle Java SE Multiple Vulnerabilities (October 2012 CPU) (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	critical
62598	CentOS 6 : java-1.7.0-openjdk (CESA-2012:1386) (ROBOT)	Nessus	CentOS Local Security Checks	2012/10/18	2022/3/29	critical
62615	RHEL 6 : java-1.7.0-openjdk (RHSA-2012:1386)	Nessus	Red Hat Local Security Checks	2012/10/18	2024/4/27	medium
217707	Linux Distros Unpatched Vulnerability : CVE-2012-5069	Nessus	Misc.	2025/3/4	2025/8/19	high
62597	CentOS 6 : java-1.6.0-openjdk (CESA-2012:1384) (ROBOT)	Nessus	CentOS Local Security Checks	2012/10/18	2021/1/4	critical
62930	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2012:1465)	Nessus	Red Hat Local Security Checks	2012/11/16	2024/11/4	medium
62962	SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 8362) (ROBOT)	Nessus	SuSE Local Security Checks	2012/11/19	2021/1/19	critical
62932	RHEL 6 : java-1.7.0-ibm (RHSA-2012:1467)	Nessus	Red Hat Local Security Checks	2012/11/16	2024/11/4	critical
78976	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1456) (ROBOT)	Nessus	Red Hat Local Security Checks	2014/11/8	2022/12/5	critical
62594	Mac OS X : Java for Mac OS X 10.6 Update 11	Nessus	MacOS X Local Security Checks	2012/10/17	2023/11/27	critical
283938	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.9-2.3.3.AXS4.1 (AXSA:2012-967:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/16	critical
68646	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2012-1386)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
74793	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2012:1419-1) (ROBOT)	Nessus	SuSE Local Security Checks	2014/6/13	2022/3/29	critical
62618	Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64 (20121017) (ROBOT)	Nessus	Scientific Linux Local Security Checks	2012/10/18	2021/1/14	critical

检测

插件搜索

critical

critical

medium

high

critical

medium

critical

critical

critical

critical

critical

medium

critical

critical