The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0982 advisory.

    This update corrects several security vulnerabilities in the IBM Java     Runtime Environment shipped as part of Red Hat Network Satellite Server     5.4, 5.5, and 5.6. In a typical operating environment, these are of low     security risk as the runtime is not used on untrusted applets.

    Several flaws were fixed in the IBM Java 2 Runtime Environment.
    (CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889,     CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5907, CVE-2013-5910,     CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375,     CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411,     CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423,     CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449,     CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0457, CVE-2014-0458,     CVE-2014-0460, CVE-2014-0461, CVE-2014-0878, CVE-2014-1876, CVE-2014-2398,     CVE-2014-2401, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420,     CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428)

    Users of Red Hat Network Satellite Server 5.4, 5.5, and 5.6 are advised to     upgrade to these updated packages, which contain the IBM Java SE 6 SR16     release. For this update to take effect, Red Hat Network Satellite Server     must be restarted (/usr/sbin/rhn-satellite restart), as well as all     running instances of IBM Java.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Junos Space version is prior to 14.1R1. It is, therefore, affected by multiple vulnerabilities in bundled third party software components :

  - Multiple vulnerabilities in the bundled OpenSSL CentOS     package. (CVE-2011-4109, CVE-2011-4576, CVE-2011-4619,     CVE-2012-0884, CVE-2012-2110, CVE-2012-2333,     CVE-2013-0166, CVE-2013-0169, CVE-2014-0224)

  - Multiple vulnerabilities in Oracle MySQL.
    (CVE-2013-5908)

  - Multiple vulnerabilities in the Oracle Java runtime.
    (CVE-2014-0411, CVE-2014-0423, CVE-2014-4244,     CVE-2014-0453, CVE-2014-0460, CVE-2014-4263,     CVE-2014-4264)

Updated java-1.6.0-sun packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 12th May 2014] The package list in this erratum has been updated to make the packages available in the Oracle Java for Red Hat Enterprise Linux 6 Workstation x86_64 channels on the Red Hat Network.

Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory pages, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2461, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5852, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428)

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 75 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-244:01 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2013-5878     Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows     remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to     Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-     party claims that the the Security component does not properly handle null XML namespace (xmlns)     attributes during XML document canonicalization, which allows attackers to escape the sandbox.
     CVE-2013-5884      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7     allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous     information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is     related to an incorrect check for code permissions by CORBA stub factories.
     CVE-2013-5896      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7     allows remote attackers to affect availability via vectors related to CORBA. NOTE: the previous     information is from the January 2014 CPU. Oracle has not commented on third-party claims that     com.sun.corba.se and its sub-packages are not included on the restricted package list.
     CVE-2013-5907      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE     Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and     availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014     CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in     LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash)     or possibly execute arbitrary code via a crafted font file.
     CVE-2013-5910      Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows     remote attackers to affect integrity via unknown vectors related to Security. NOTE: the previous     information is from the January 2014 CPU. Oracle has not commented on third-party claims that     CanonicalizerBase.java in the XML canonicalizer allows untrusted code to access mutable byte arrays.
     CVE-2014-0368      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows     remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous     information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is     related to incorrect permission checks when listening on a socket, which allows attackers to escape the     sandbox.
     CVE-2014-0373      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to     Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on     third-party claims that the issue is related to throwing of an incorrect exception when     SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the     sandbox.
     CVE-2014-0376      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7     allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is     from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an     improper check for code permissions when creating document builder factories.
     CVE-2014-0411      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE     Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors     related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on     third-party claims that this issue allows remote attackers to obtain sensitive information about     encryption keys via a timing discrepancy during the TLS/SSL handshake.
     CVE-2014-0416      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7     allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is     from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how     principals are set for the Subject class, which allows attackers to escape the sandbox using     deserialization of a crafted Subject instance.
     CVE-2014-0422      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7     allows remote attackers to affect confidentiality, integrity, and availability via vectors related to     JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party     claims that the issue is related to missing package access checks in the Naming / JNDI component, which     allows attackers to escape the sandbox.
     CVE-2014-0423      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE     Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability     via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle     has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in     DocumentHandler.java, related to Beans decoding.
     CVE-2014-0428      Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7     allows remote attackers to affect confidentiality, integrity, and availability via vectors related to     CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-     party claims that the issue is related to insufficient security checks in IIOP streams, which allows     attackers to escape the sandbox.
    Enhancement:
     Updated an expired GlobalSign Certification Authority certificate in the     /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0[.x86_64]/jre/lib/security/cacerts file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428, CVE-2014-0422, CVE-2013-5893)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys.
(CVE-2014-0411)

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0030 advisory.

    Oracle Java SE version 7 includes the Oracle Java Runtime Environment and     the Oracle Java Software Development Kit.

    This update fixes several vulnerabilities in the Oracle Java Runtime     Environment and the Oracle Java Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE Critical     Patch Update Advisory page, listed in the References section.
    (CVE-2013-5870, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888,     CVE-2013-5889, CVE-2013-5893, CVE-2013-5895, CVE-2013-5896, CVE-2013-5898,     CVE-2013-5899, CVE-2013-5902, CVE-2013-5904, CVE-2013-5905, CVE-2013-5906,     CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375,     CVE-2014-0376, CVE-2014-0382, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410,     CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418,     CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428)

    All users of java-1.7.0-oracle are advised to upgrade to these updated     packages, which provide Oracle Java 7 Update 51 and resolve these issues.
    All running instances of Oracle Java must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428, CVE-2014-0422, CVE-2013-5893)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys.
(CVE-2014-0411)

Note: The java-1.7.0-openjdk package shipped with Scientific Linux 6.5 via SLBA-2013:1611 replaced 'java7' with 'java' in the provides list.
This update re-adds 'java7' to the provides list to maintain backwards compatibility with releases prior to Scientific Linux 6.5.

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

All running instances of OpenJDK Java must be restarted for the update to take effect.

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0428 , CVE-2014-0422 , CVE-2013-5893)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373 , CVE-2013-5878 , CVE-2013-5910 , CVE-2013-5896 , CVE-2013-5884 , CVE-2014-0416 , CVE-2014-0376 , CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys.
(CVE-2014-0411)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0134 advisory.

    IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts     page, listed in the References section. (CVE-2013-5878, CVE-2013-5884,     CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898,     CVE-2013-5899, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373,     CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410,     CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422,     CVE-2014-0423, CVE-2014-0424, CVE-2014-0428)

    All users of java-1.7.0-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 7 SR6-FP1 release. All running     instances of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update contains the Oracle January 14 2014 CPU for java-1_7_0-ibm.

Find more information at:
http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_January_14_2 014_CPU

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79039	RHEL 5 / 6 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2014:0982)	Nessus	Red Hat Local Security Checks	2014/11/8	2024/11/4	critical
80197	Juniper Junos Space < 14.1R1 Multiple Vulnerabilities (JSA10659)	Nessus	Junos Local Security Checks	2014/12/22	2022/12/5	high
79011	RHEL 5 / 6 : java-1.6.0-sun (RHSA-2014:0414)	Nessus	Red Hat Local Security Checks	2014/11/8	2023/4/25	medium
289735	MiracleLinux 3 : java-1.6.0-openjdk-1.6.0.0-4.1.13.1.AXS3.0.1 (AXSA:2014-244:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
71979	CentOS 5 : java-1.7.0-openjdk (CESA-2014:0027)	Nessus	CentOS Local Security Checks	2014/1/16	2021/1/4	medium
71987	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0030)	Nessus	Red Hat Local Security Checks	2014/1/16	2025/3/20	medium
71989	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20140115)	Nessus	Scientific Linux Local Security Checks	2014/1/16	2021/1/14	critical
72298	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2014-280)	Nessus	Amazon Linux Local Security Checks	2014/2/5	2018/4/18	critical
72319	RHEL 6 : java-1.7.0-ibm (RHSA-2014:0134)	Nessus	Red Hat Local Security Checks	2014/2/5	2025/4/15	medium
72555	SuSE 11.3 Security Update : IBM Java (SAT Patch Number 8878)	Nessus	SuSE Local Security Checks	2014/2/18	2021/1/19	critical

检测

插件搜索

critical

high

medium

high

medium

medium

critical

critical

medium

critical