The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0027 advisory.

    [1.7.0.51-2.4.4.1.0.1.el5_10]
    - Add oracle-enterprise.patch
    - Fix DISTRO_NAME to 'Enterprise Linux'

    [1.7.0.51-2.4.4.1.el5]
    - updated to security icedtea 2.4.4
     - icedtea_version set to 2.4.4
     - updatever bumped to       51
     - release reset to 1
    - build requires: java-devel >= 1:1.6.0 changed java7-devel
    - Resolves: rhbz#1050192

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428, CVE-2014-0422, CVE-2013-5893)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys.
(CVE-2014-0411)

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0097 advisory.

    [1:1.6.0.1-3.1.13.0]
    - updated to icedtea 1.13.1
     - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/
    - updated to jdk6, b30,  21_jan_2014
     - https://openjdk6.java.net/OpenJDK6-B30-Changes.html
    - adapted patch7 1.13_fixes.patch
    - pre 2011 changelog moved to (till now  wrong) pre-2009-spec-changelog (rh1043611)
    - added --disable-system-lcms to configure options to pass build
    - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
    - Resolves: rhbz#1050190

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA and JNDI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2014-0428, CVE-2014-0422)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to a disclosure of information about the used encryption keys.
(CVE-2014-0411)

All running instances of OpenJDK Java must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
71985	Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2014-0027)	Nessus	Oracle Linux Local Security Checks	2014/1/16	2025/4/29	high
71988	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x i386/x86_64 (20140115)	Nessus	Scientific Linux Local Security Checks	2014/1/16	2021/1/14	critical
72160	Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2014-0097)	Nessus	Oracle Linux Local Security Checks	2014/1/28	2024/10/22	critical
72162	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x i386/x86_64 (20140127)	Nessus	Scientific Linux Local Security Checks	2014/1/28	2021/1/14	critical

检测

插件搜索

high

critical

critical

critical