Multiple fixes. (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481)

As a reminder, the closed source Java6 packages are not present in Scientific Linux 5.9. Public updates to the closed source package are being discontinued by upstream. Scientific Linux 6 has never included the closed source Java packages.

http://www.oracle.com/technetwork/java/eol-135779.html

All running instances of Java must be restarted for the update to take effect.

IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs.

Please see the IBM JDK Alert page for more information :

http://www.ibm.com/developerworks/java/jdk/alerts/

Security issues fixed :

  - / CVE-2013-0443. (CVE-2013-1487 / CVE-2013-1486 /     CVE-2013-1478 / CVE-2013-0445 / CVE-2013-1480 /     CVE-2013-0441 / CVE-2013-1476 / CVE-2012-1541 /     CVE-2013-0446 / CVE-2012-3342 / CVE-2013-0442 /     CVE-2013-0450 / CVE-2013-0425 / CVE-2013-0426 /     CVE-2013-0428 / CVE-2012-3213 / CVE-2013-1481 /     CVE-2013-0419 / CVE-2013-0423 / CVE-2013-0351 /     CVE-2013-0432 / CVE-2013-1473 / CVE-2013-0435 /     CVE-2013-0434 / CVE-2013-0409 / CVE-2013-0427 /     CVE-2013-0433 / CVE-2013-0424 / CVE-2013-0440 /     CVE-2013-0438)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0246 advisory.

    [ 1:1.6.0.0-1.33.1.11.6.0.1.el5_9]
    - Add oracle-enterprise.patch

    [1:1.6.0.0-1.33.1.11.6]
    - removed patch9 revertTwoWrongSecurityPatches2013-02-06.patch
    - added patch9:   7201064.patch to be reverted
    - added patch10:   8005615.patch to fix the 6664509.patch
    - Resolves: rhbz#906705

    [1:1.6.0.0-1.32.1.11.6]
    - added patch9 revertTwoWrongSecurityPatches2013-02-06.patch       to remove   6664509 and 7201064 from 1.11.6 tarball
    - Resolves: rhbz#906705

    [1:1.6.0.0-1.31.1.11.6]
    - Updated to icedtea6 1.11.6
    - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch
    - Resolves: rhbz#906705

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-0444)

Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges.
(CVE-2013-1478, CVE-2013-1480)

A flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)

The default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted. (CVE-2013-0435)

Multiple improper permission check issues were discovered in the JMX, Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-0431, CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)

It was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack.
(CVE-2013-0424)

It was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake.
(CVE-2013-0440)

It was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack. (CVE-2013-0443)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.5.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-0444)

Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges.
(CVE-2013-1478, CVE-2013-1480)

A flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)

The default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted. (CVE-2013-0435)

Multiple improper permission check issues were discovered in the JMX, Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-0431, CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)

It was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack.
(CVE-2013-0424)

It was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake.
(CVE-2013-0440)

It was discovered that the JSSE component did not properly validate Diffie- Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack. (CVE-2013-0443)

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.5.

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0247 advisory.

    [1.7.0.9-2.3.5.3.0.1.el6_3]
    - Update DISTRO_NAME in specfile

    [1.7.0.9-2.3.5.3.el6_3]
    - Sync logging fixes with upstream (icedtea7-forest and jdk7u)

    [1.7.0.9-2.3.5.1.el6_3]
    - Removed 6664509 backout and added 8005615 to fix the issue

    [1.7.0.9-2.3.5.el6_3.1]
    - Backed out 6664509 and 7201064.patch which cause regressions

    [1.7.0.9-2.3.5.el6_3]
    - Bumped to 2.3.5
    - Changed BR to java7-devel >= 1:1.7.0 as required by CORBA changes in 2.3.5
    - Resolves: rhbz#906707

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

java-1_7_0-openjdk was updated to icedtea-2.3.6 (bnc#803379) containing various security and bugfixes :

  - Security fixes

  - S6563318, CVE-2013-0424: RMI data sanitization

  - S6664509, CVE-2013-0425: Add logging context

  - S6664528, CVE-2013-0426: Find log level matching its     name or value given at construction time

  - S6776941: CVE-2013-0427: Improve thread pool shutdown

  - S7141694, CVE-2013-0429: Improving CORBA internals

  - S7173145: Improve in-memory representation of     splashscreens

  - S7186945: Unpack200 improvement

  - S7186946: Refine unpacker resource usage

  - S7186948: Improve Swing data validation

  - S7186952, CVE-2013-0432: Improve clipboard access

  - S7186954: Improve connection performance

  - S7186957: Improve Pack200 data validation

  - S7192392, CVE-2013-0443: Better validation of client     keys

  - S7192393, CVE-2013-0440: Better Checking of order of TLS     Messages

  - S7192977, CVE-2013-0442: Issue in toolkit thread

  - S7197546, CVE-2013-0428: (proxy) Reflect about creating     reflective proxies

  - S7200491: Tighten up JTable layout code

  - S7200493, CVE-2013-0444: Improve cache handling

  - S7200499: Better data validation for options

  - S7200500: Launcher better input validation

  - S7201064: Better dialogue checking

  - S7201066, CVE-2013-0441: Change modifiers on unused     fields

  - S7201068, CVE-2013-0435: Better handling of UI elements

  - S7201070: Serialization to conform to protocol

  - S7201071, CVE-2013-0433: InetSocketAddress serialization     issue

  - S8000210: Improve JarFile code quality

  - S8000537, CVE-2013-0450: Contextualize     RequiredModelMBean class

  - S8000539, CVE-2013-0431: Introspect JMX data handling

  - S8000540, CVE-2013-1475: Improve IIOP type reuse     management

  - S8000631, CVE-2013-1476: Restrict access to class     constructor

  - S8001235, CVE-2013-0434: Improve JAXP HTTP handling

  - S8001242: Improve RMI HTTP conformance

  - S8001307: Modify ACC_SUPER behavior

  - S8001972, CVE-2013-1478: Improve image processing

  - S8002325, CVE-2013-1480: Improve management of images

  - Backports

  - S7057320:
    test/java/util/concurrent/Executors/AutoShutdown.java     failing intermittently

  - S7083664: TEST_BUG: test hard code of using c:/temp but     this dir might not exist

  - S7107613: scalability blocker in     javax.crypto.CryptoPermissions

  - S7107616: scalability blocker in     javax.crypto.JceSecurityManager

  - S7146424: Wildcard expansion for single entry classpath

  - S7160609: [macosx] JDK crash in libjvm.dylib ( C     [GeForceGLDriver+0x675a] gldAttachDrawable+0x941)

  - S7160951: [macosx] ActionListener called twice for     JMenuItem using ScreenMenuBar

  - S7162488: VM not printing unknown -XX options

  - S7169395: Exception throws due to the changes in JDK 7     object tranversal and break backward compatibility

  - S7175616: Port fix for TimeZone from JDK 8 to JDK 7

  - S7176485: (bf) Allow temporary buffer cache to grow to     IOV_MAX

  - S7179908: Fork hs23.3 hsx from hs22.2 for jdk7u7 and     reinitialize build number

  - S7184326: TEST_BUG:
    java/awt/Frame/7024749/bug7024749.java has a typo

  - S7185245: Licensee source bundle tries to compile JFR

  - S7185471: Avoid key expansion when AES cipher is re-init     w/ the same key

  - S7186371: [macosx] Main menu shortcuts not displayed     (7u6 regression)

  - S7187834: [macosx] Usage of private API in macosx 2d     implementation causes Apple Store rejection

  - S7188114: (launcher) need an alternate command line     parser for Windows

  - S7189136: Fork hs23.5 hsx from hs23.4 for jdk7u9 and     reinitialize build number

  - S7189350: Fix failed for CR 7162144

  - S7190550: REGRESSION: Some closed/com/oracle/jfr/api     tests fail to compile because of fix 7185245

  - S7193219: JComboBox serialization fails in JDK 1.7

  - S7193977: REGRESSION:Java 7's JavaBeans persistence     ignoring the 'transient' flag on properties

  - S7195106: REGRESSION : There is no way to get Icon inf,     once Softreference is released

  - S7195301: XML Signature DOM implementation should not     use instanceof to determine type of Node

  - S7195931: UnsatisfiedLinkError on     PKCS11.C_GetOperationState while using NSS from jre7u6+

  - S7197071: Makefiles for various security providers     aren't including the default manifest.

  - S7197652: Impossible to run any signed JNLP applications     or applets, OCSP off by default

  - S7198146: Another new regression test does not compile     on windows-amd64

  - S7198570: (tz) Support tzdata2012f

  - S7198640: new hotspot build - hs23.6-b04

  - S7199488: [TEST] runtime/7158800/InternTest.java failed     due to false-positive on PID match.

  - S7199645: Increment build # of hs23.5 to b02

  - S7199669: Update tags in .hgtags file for CPU release     rename

  - S7200720: crash in net.dll during NTLM authentication

  - S7200742: (se) Selector.select does not block when     starting Coherence (sol11u1)

  - S7200762: [macosx] Stuck in     sun.java2d.opengl.CGLGraphicsConfig.getMaxTextureSize(Na     tive Method)

  - S8000285: Deadlock between PostEventQueue.noEvents,     EventQueue.isDispatchThread and     SwingUtilities.invokeLater

  - S8000286: [macosx] Views keep scrolling back to the drag     position after DnD

  - S8000297: REGRESSION:
    closed/java/awt/EventQueue/PostEventOrderingTest.java     fails

  - S8000307: Jre7cert: focusgained does not get called for     all focus req when do alt + tab

  - S8000822: Fork hs23.7 hsx from hs23.6 for jdk7u11 and     reinitialize build number

  - S8001124: jdk7u ProblemList.txt updates (10/2012)

  - S8001242: Improve RMI HTTP conformance

  - S8001808: Create a test for 8000327

  - S8001876: Create regtest for 8000283

  - S8002068: Build broken: corba code changes unable to use     new JDK 7 classes

  - S8002091: tools/launcher/ToolsOpts.java test started to     fail since 7u11 b01 on Windows

  - S8002114: fix failed for JDK-7160951: [macosx]     ActionListener called twice for JMenuItem using     ScreenMenuBar

  - S8002225: (tz) Support tzdata2012i

  - S8003402: (dc)     test/java/nio/channels/DatagramChannel/SendToUnresovled.
    java failing after 7u11 cleanup issues

  - S8003403: Test ShortRSAKeyWithinTLS and     ClientJSSEServerJSSE failing after 7u11 cleanup

  - S8003948: NTLM/Negotiate authentication problem

  - S8004175: Restricted packages added in java.security are     missing in java.security-(macosx, solaris, windows)

  - S8004302: javax/xml/soap/Test7013971.java fails since     jdk6u39b01

  - S8004341: Two JCK tests fails with 7u11 b06

  - S8005615: Java Logger fails to load tomcat logger     implementation (JULI)

  - Bug fixes

  - Fix build using Zero's HotSpot so all patches apply     again.

  - PR1295: jamvm parallel unpack failure

  - removed icedtea-2.3.2-fix-extract-jamvm-dependency.patch

  - removed     icedtea-2.3.3-refresh-6924259-string_offset.patch

  - few missing /openjdk/%(origin)/ changes

The remote host has a version of IBM Notes (formerly Lotus Notes) 8.5.x prior to 8.5.3 Fix Pack 5 installed.  It is, therefore, reportedly affected by the following vulnerabilities :

  - The included version of the IBM Java SDK contains a     version of the IBM JRE that contains numerous security     issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436,     CVE-2013-2455, CVE-2013-3006, CVE-2013-3007,     CVE-2013-3008, CVE-2013-3009, CVE-2013-3010,     CVE-2013-3011, CVE-2013-3012)

  - Note also that fixes in the Oracle Java CPUs for     February, April and June 2013 are included in the     fixed IBM Java release, which is included in the     fixed IBM Notes release.
    (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342,     CVE-2013-0351, CVE-2013-0401, CVE-2013-0402,     CVE-2013-0409, CVE-2013-0419, CVE-2013-0423,     CVE-2013-0424, CVE-2013-0425, CVE-2013-0426,     CVE-2013-0427, CVE-2013-0428, CVE-2013-0429,     CVE-2013-0430, CVE-2013-0431, CVE-2013-0432,     CVE-2013-0433, CVE-2013-0434, CVE-2013-0435,     CVE-2013-0437, CVE-2013-0438, CVE-2013-0440,     CVE-2013-0441, CVE-2013-0442, CVE-2013-0443,     CVE-2013-0444, CVE-2013-0445, CVE-2013-0446,     CVE-2013-0448, CVE-2013-0449, CVE-2013-0450,     CVE-2013-1473, CVE-2013-1475, CVE-2013-1476,     CVE-2013-1478, CVE-2013-1479, CVE-2013-1480,     CVE-2013-1481, CVE-2013-1488, CVE-2013-1489,     CVE-2013-1491, CVE-2013-1500, CVE-2013-1518,     CVE-2013-1537, CVE-2013-1540, CVE-2013-1557,     CVE-2013-1558, CVE-2013-1561, CVE-2013-1563,     CVE-2013-1564, CVE-2013-1569, CVE-2013-1571,     CVE-2013-2383, CVE-2013-2384, CVE-2013-2394,     CVE-2013-2400, CVE-2013-2407, CVE-2013-2412,     CVE-2013-2414, CVE-2013-2415, CVE-2013-2416,     CVE-2013-2417, CVE-2013-2418, CVE-2013-2419,     CVE-2013-2420, CVE-2013-2421, CVE-2013-2422,     CVE-2013-2423, CVE-2013-2424, CVE-2013-2425,     CVE-2013-2426, CVE-2013-2427, CVE-2013-2428,     CVE-2013-2429, CVE-2013-2430, CVE-2013-2431,     CVE-2013-2432, CVE-2013-2433, CVE-2013-2434,     CVE-2013-2435, CVE-2013-2437, CVE-2013-2438,     CVE-2013-2439, CVE-2013-2440, CVE-2013-2442,     CVE-2013-2443, CVE-2013-2444, CVE-2013-2445,     CVE-2013-2446, CVE-2013-2447, CVE-2013-2448,     CVE-2013-2449, CVE-2013-2450, CVE-2013-2451,     CVE-2013-2452, CVE-2013-2453, CVE-2013-2454,     CVE-2013-2456, CVE-2013-2457, CVE-2013-2458,     CVE-2013-2459, CVE-2013-2460, CVE-2013-2461,     CVE-2013-2462, CVE-2013-2463, CVE-2013-2464,     CVE-2013-2465, CVE-2013-2466, CVE-2013-2467,     CVE-2013-2468, CVE-2013-2469, CVE-2013-2470,     CVE-2013-2471, CVE-2013-2472, CVE-2013-2473,     CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.5. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.5 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0236 advisory.

    Oracle Java SE version 6 includes the Oracle Java Runtime Environment and     the Oracle Java Software Development Kit.

    This update fixes several vulnerabilities in the Oracle Java Runtime     Environment and the Oracle Java Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE Critical     Patch Update Advisory page, listed in the References section.
    (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0409,     CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426,     CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0432,     CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440,     CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446,     CVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478,     CVE-2013-1480, CVE-2013-1481)

    All users of java-1.6.0-sun are advised to upgrade to these updated     packages, which provide Oracle Java 6 Update 39. All running instances of     Oracle Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Mac OS X host has a version of Java for Mac OS X 10.6 that is missing Update 12, which updates the Java version to 1.6.0_39.  It is, therefore, affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

java-1_6_0-openjdk based on Icedtea6-1.12.2 was released, fixing various security issues :

New in release 1.12.2 (2012-02-03) :

  - Security fixes

  - S6563318, CVE-2013-0424: RMI data sanitization

  - S6664509, CVE-2013-0425: Add logging context

  - S6664528, CVE-2013-0426: Find log level matching its     name or value given at construction time

  - S6776941: CVE-2013-0427: Improve thread pool shutdown

  - S7141694, CVE-2013-0429: Improving CORBA internals

  - S7173145: Improve in-memory representation of     splashscreens

  - S7186945: Unpack200 improvement

  - S7186946: Refine unpacker resource usage

  - S7186948: Improve Swing data validation

  - S7186952, CVE-2013-0432: Improve clipboard access

  - S7186954: Improve connection performance

  - S7186957: Improve Pack200 data validation

  - S7192392, CVE-2013-0443: Better validation of client     keys

  - S7192393, CVE-2013-0440: Better Checking of order of TLS     Messages

  - S7192977, CVE-2013-0442: Issue in toolkit thread

  - S7197546, CVE-2013-0428: (proxy) Reflect about creating     reflective proxies

  - S7200491: Tighten up JTable layout code

  - S7200500: Launcher better input validation

  - S7201064: Better dialogue checking

  - S7201066, CVE-2013-0441: Change modifiers on unused     fields

  - S7201068, CVE-2013-0435: Better handling of UI elements

  - S7201070: Serialization to conform to protocol

  - S7201071, CVE-2013-0433: InetSocketAddress serialization     issue

  - S8000210: Improve JarFile code quality

  - S8000537, CVE-2013-0450: Contextualize     RequiredModelMBean class

  - S8000540, CVE-2013-1475: Improve IIOP type reuse     management

  - S8000631, CVE-2013-1476: Restrict access to class     constructor

  - S8001235, CVE-2013-0434: Improve JAXP HTTP handling

  - S8001242: Improve RMI HTTP conformance

  - S8001307: Modify ACC_SUPER behavior

  - S8001972, CVE-2013-1478: Improve image processing

  - S8002325, CVE-2013-1480: Improve management of images

  - Backports

  - S7010849: 5/5 Extraneous javac source/target options     when building sa-jdi

  - S8004341: Two JCK tests fails with 7u11 b06

  - S8005615: Java Logger fails to load tomcat logger     implementation (JULI)

  - Bug fixes

  - PR1297: cacao and jamvm parallel unpack failures

  - PR1301: PR1171 causes builds of Zero to fail

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0245 advisory.

    [1:1.6.0.0-1.54.1.11.6]
    - removed patch8 revertTwoWrongSecurityPatches2013-02-06.patch
    - added patch8:   7201064.patch to be reverted
    - added patch9:   8005615.patch to fix the 6664509.patch
    - Resolves: rhbz#906707

    [1:1.6.0.0-1.53.1.11.6]
    - added patch8 revertTwoWrongSecurityPatches2013-02-06.patch       to remove   6664509 and 7201064 from 1.11.6 tarball
    - Resolves: rhbz#906707

    [1:1.6.0.0-1.51.1.11.6]
    - Updated to icedtea6 1.11.6
    - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch
    - Resolves: rhbz#906707

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0448, CVE-2013-0449, CVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478, CVE-2013-1479, CVE-2013-1480, CVE-2013-1489)

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 13 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
64605	Scientific Linux Security Update : jdk-1.6.0 on SL 5.0 - 5.8 (i386 x86_64) (20130205)	Nessus	Scientific Linux Local Security Checks	2013/2/13	2021/1/14	critical
65570	SuSE 10 Security Update : Java (ZYPP Patch Number 8495)	Nessus	SuSE Local Security Checks	2013/3/15	2021/1/19	critical
68727	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2013-0246)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
64520	RHEL 5 / 6 : java-1.7.0-openjdk (RHSA-2013:0247)	Nessus	Red Hat Local Security Checks	2013/2/10	2022/5/25	critical
64523	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x, SL6.x i386/x86_64 (20130208)	Nessus	Scientific Linux Local Security Checks	2013/2/10	2022/5/25	critical
64537	CentOS 5 / 6 : java-1.7.0-openjdk (CESA-2013:0247)	Nessus	CentOS Local Security Checks	2013/2/11	2022/5/25	critical
68728	Oracle Linux 5 / 6 : java-1.7.0-openjdk (ELSA-2013-0247)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
74907	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0377-1)	Nessus	SuSE Local Security Checks	2014/6/13	2022/5/25	critical
70744	IBM Notes 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities	Nessus	Windows	2013/11/4	2022/5/25	critical
78976	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1456) (ROBOT)	Nessus	Red Hat Local Security Checks	2014/11/8	2022/12/5	critical
64467	RHEL 5 / 6 : java-1.6.0-sun (RHSA-2013:0236)	Nessus	Red Hat Local Security Checks	2013/2/5	2024/11/4	high
64472	Mac OS X : Java for Mac OS X 10.6 Update 12	Nessus	MacOS X Local Security Checks	2013/2/5	2023/11/27	critical
64780	SuSE 11.2 Security Update : Java 1.6.0 (SAT Patch Number 7332)	Nessus	SuSE Local Security Checks	2013/2/21	2021/1/19	critical
68726	Oracle Linux 6 : java-1.6.0-openjdk (ELSA-2013-0245)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
64468	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0237)	Nessus	Red Hat Local Security Checks	2013/2/5	2022/5/25	critical

检测

插件搜索

critical

critical

high

critical

critical

critical

high

critical

critical

critical

high

critical

critical

medium

critical