The remote host has a version of IBM Domino (formerly Lotus Domino) 8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities mentioned in the Oracle Java Critical Patch Update advisories for October 2013 and January 2014.

- Fix a file conflict between -devel and -headless package 

  - Update to 2.4.4 (bnc#858818)

  - changed from xz to gzipped tarball as the first was not     available during update

  - changed a keyring file due release manager change new     one is signed by 66484681 from omajid@redhat.com, see     http://mail.openjdk.java.net/pipermail/distro-pkg-dev/20     14-January/025800.html

  - Security fixes

  - S6727821: Enhance JAAS Configuration

  - S7068126, CVE-2014-0373: Enhance SNMP statuses

  - S8010935: Better XML handling

  - S8011786, CVE-2014-0368: Better applet networking

  - S8021257, S8025022, CVE-2013-5896 : com.sun.corba.se.**     should be on restricted package list

  - S8021271, S8021266, CVE-2014-0408: Better buffering in     ObjC code

  - S8022904: Enhance JDBC Parsers

  - S8022927: Input validation for byte/endian conversions

  - S8022935: Enhance Apache resolver classes

  - S8022945: Enhance JNDI implementation classes

  - S8023057: Enhance start up image display

  - S8023069, CVE-2014-0411: Enhance TLS connections

  - S8023245, CVE-2014-0423: Enhance Beans decoding

  - S8023301: Enhance generic classes

  - S8023338: Update jarsigner to encourage timestamping

  - S8023672: Enhance jar file validation

  - S8024302: Clarify jar verifications

  - S8024306, CVE-2014-0416: Enhance Subject consistency

  - S8024530: Enhance font process resilience

  - S8024867: Enhance logging start up

  - S8025014: Enhance Security Policy

  - S8025018, CVE-2014-0376: Enhance JAX-P set up

  - S8025026, CVE-2013-5878: Enhance canonicalization

  - S8025034, CVE-2013-5907: Improve layout lookups

  - S8025448: Enhance listening events

  - S8025758, CVE-2014-0422: Enhance Naming management

  - S8025767, CVE-2014-0428: Enhance IIOP Streams

  - S8026172: Enhance UI Management

  - S8026176: Enhance document printing

  - S8026193, CVE-2013-5884: Enhance CORBA stub factories

  - S8026204: Enhance auth login contexts

  - S8026417, CVE-2013-5910: Enhance XML canonicalization

  - S8026502: java/lang/invoke/MethodHandleConstants.java     fails on all platforms

  - S8027201, CVE-2014-0376: Enhance JAX-P set up

  - S8029507, CVE-2013-5893: Enhance JVM method processing

  - S8029533: REGRESSION:
    closed/java/lang/invoke/8008140/Test8008140.java fails     against

  - Backports

  - S8025255: (tz) Support tzdata2013g

  - S8026826: JDK 7 fix for 8010935 broke the build

  - Bug fixes

  - PR1618: Include defs.make in vm.make so VM_LITTLE_ENDIAN     is defined on Zero builds

  - D729448: 32-bit alignment on mips and mipsel

  - PR1623: Collision between OpenJDK 6 & 7 classes when     bootstrapping with OpenJDK 6

  - Add update.py, helper script to download openjdk     tarballs from hg repo

  - Buildrequire quilt unconditionally as it's used     unconditionally.

  - Really disable tests on non-JIT architectures. (from     Ulrich Weigand)

  - Add headless subpackage wich does not require X and     pulse/alsa

  - Add accessibility to extra subpackage, which requires     new java-atk-wrapper package

  - removed java-1.7.0-openjdk-java-access-bridge-idlj.patch

  - removed java-1.7.0-openjdk-java-access-bridge-tck.patch

  - removed java-access-bridge-1.26.2.tar.bz2

  - Refreshed

  - java-1.7.0-openjdk-java-access-bridge-security.patch

  - Add a support for running tests using --with tests

  - this is ignored on non-jit architectures

  - Prefer global over define as bcond_with does use them

  - Forward declare aarch64 arch macro

  - Define archbuild/archinstall macros for arm and aarch64

  - remove a few ifarch conditions by using those macros in     filelist

  - Need ecj-bootstrap in bootstrap mode (noted by mmatz)

  - Don't install vim and quilt in bootstrap mode

  - A few enhancenments of bootstrap mode

  - usable wia --with bootstrap

  - disable docs, javadoc package

  - fix configure arguments on bootstrap

  - Add the unversioned SDK directory link to the files list     of -devel package (fixes update-alternatives from     %post).

  - Add support for bootstrapping with just gcj (using     included ecj directly). Increase stacksize for powerpc     (amends java-1.7.0-openjdk-ppc-zero-jdk.patch). Add     support for ppc64le.

  - fix stackoverflow for powerpc     (java-1_7_0-openjdk-ppc-stackoverflow.patch)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-3829, CVE-2013-5783, CVE-2013-5804, CVE-2014-0411)

Several vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2013-4002, CVE-2013-5803, CVE-2013-5823, CVE-2013-5825, CVE-2013-5896, CVE-2013-5910)

Several vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2013-5772, CVE-2013-5774, CVE-2013-5784, CVE-2013-5797, CVE-2013-5820, CVE-2014-0376, CVE-2014-0416)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-5778, CVE-2013-5780, CVE-2013-5790, CVE-2013-5800, CVE-2013-5840, CVE-2013-5849, CVE-2013-5851, CVE-2013-5884, CVE-2014-0368)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2013-5782, CVE-2013-5802, CVE-2013-5809, CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5830, CVE-2013-5842, CVE-2013-5850, CVE-2013-5878, CVE-2013-5893, CVE-2013-5907, CVE-2014-0373, CVE-2014-0408, CVE-2014-0422, CVE-2014-0428)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure and availability. An attacker could exploit this to expose sensitive data over the network or cause a denial of service. (CVE-2014-0423).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2013-5907)

Multiple improper permission check issues were discovered in the CORBA and JNDI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2014-0428 , CVE-2014-0422)

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-0373 , CVE-2013-5878 , CVE-2013-5910 , CVE-2013-5896 , CVE-2013-5884 , CVE-2014-0416 , CVE-2014-0376 , CVE-2014-0368)

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability. (CVE-2014-0423)

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to a disclosure of information about the used encryption keys.
(CVE-2014-0411)

This openjdk update fixes several security issues. For a complete list of fixed vulnerabilities and their description please refer to :

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025 800.html

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities :

  - Vulnerabilities in Oracle Java allow a remote attacker     to bypass security features through flaws in XML     document parsing. (CVE-2013-5878, CVE-2013-5910)

  - An information disclosure flaw in Oracle Java allows a     remote attacker access to sensitive information through     a flaw in the COBRA component. (CVE-2013-5884)

  - A vulnerability in Oracle Java allows a remote attacker     to conduct a denial of service attack through a flaw in     the Deployment component. (CVE-2013-5887)

  - Unspecified vulnerabilities exist in Oracle Java due     to flaws in the Deployment component. (CVE-2013-5888,     CVE-2013-5898, CVE-2013-5899, CVE-2014-0375,     CVE-2014-0403, CVE-2014-0424)

  - Vulnerabilities in Oracle Java allow remote code     execution through a flaw in the Deployment component.
    (CVE-2013-5889, CVE-2014-0387, CVE-2014-0410,     CVE-2014-0415)

  - A vulnerability in Oracle Java allows a remote attacker     to conduct a denial of service attack through a flaw in     the COBRA component. (CVE-2013-5896)

  - A vulnerability in Oracle Java allows remote code     execution through a flaw in the 2D component.
    (CVE-2013-5907)

  - An information disclosure and security bypass flaw exist     in Oracle Java's Networking component. (CVE-2014-0368)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the     Serviceability component. (CVE-2014-0373)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the JAXP     component. (CVE-2014-0376)

  - An information disclosure flaw in Oracle Java allows a     remote attacker access to information about encryption     keys through a flaw in the JSSE component.
    (CVE-2014-0411)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the JAAS     component. (CVE-2014-0416)

  - An unspecified vulnerability exists in Oracle Java due     to flaws in the 2D component. (CVE-2014-0417)

  - A vulnerability in Oracle Java allows remote code     execution through a flaw in the JNDI component.
    (CVE-2014-0422)

  - An information disclosure and denial of service flaw     exist in Oracle Java's Beans component when XML data is     read. (CVE-2014-0423)

  - A vulnerability in Oracle Java allows remote code     execution through a flaw in the COBRA component.
    (CVE-2014-0428)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0982 advisory.

    This update corrects several security vulnerabilities in the IBM Java     Runtime Environment shipped as part of Red Hat Network Satellite Server     5.4, 5.5, and 5.6. In a typical operating environment, these are of low     security risk as the runtime is not used on untrusted applets.

    Several flaws were fixed in the IBM Java 2 Runtime Environment.
    (CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889,     CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5907, CVE-2013-5910,     CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375,     CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411,     CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423,     CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449,     CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0457, CVE-2014-0458,     CVE-2014-0460, CVE-2014-0461, CVE-2014-0878, CVE-2014-1876, CVE-2014-2398,     CVE-2014-2401, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420,     CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428)

    Users of Red Hat Network Satellite Server 5.4, 5.5, and 5.6 are advised to     upgrade to these updated packages, which contain the IBM Java SE 6 SR16     release. For this update to take effect, Red Hat Network Satellite Server     must be restarted (/usr/sbin/rhn-satellite restart), as well as all     running instances of IBM Java.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Junos Space version is prior to 14.1R1. It is, therefore, affected by multiple vulnerabilities in bundled third party software components :

  - Multiple vulnerabilities in the bundled OpenSSL CentOS     package. (CVE-2011-4109, CVE-2011-4576, CVE-2011-4619,     CVE-2012-0884, CVE-2012-2110, CVE-2012-2333,     CVE-2013-0166, CVE-2013-0169, CVE-2014-0224)

  - Multiple vulnerabilities in Oracle MySQL.
    (CVE-2013-5908)

  - Multiple vulnerabilities in the Oracle Java runtime.
    (CVE-2014-0411, CVE-2014-0423, CVE-2014-4244,     CVE-2014-0453, CVE-2014-0460, CVE-2014-4263,     CVE-2014-4264)

Updated java-1.6.0-sun packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 12th May 2014] The package list in this erratum has been updated to make the packages available in the Oracle Java for Red Hat Enterprise Linux 6 Workstation x86_64 channels on the Red Hat Network.

Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory pages, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2461, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5852, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428)

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 75 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
73969	IBM Domino 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	2014/5/12	2019/11/26	critical
75413	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2014:0174-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
75414	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2014:0180-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
72117	Ubuntu 12.10 / 13.04 / 13.10 : openjdk-7 vulnerabilities (USN-2089-1)	Nessus	Ubuntu Local Security Checks	2014/1/24	2021/1/19	critical
72301	Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2014-283)	Nessus	Amazon Linux Local Security Checks	2014/2/5	2018/4/18	critical
72423	SuSE 11.3 Security Update : openjdk (SAT Patch Number 8874)	Nessus	SuSE Local Security Checks	2014/2/11	2021/1/19	critical
76871	AIX Java Advisory : java_jan2014_advisory.asc	Nessus	AIX Local Security Checks	2014/7/28	2023/4/21	critical
79039	RHEL 5 / 6 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2014:0982)	Nessus	Red Hat Local Security Checks	2014/11/8	2024/11/4	critical
80197	Juniper Junos Space < 14.1R1 Multiple Vulnerabilities (JSA10659)	Nessus	Junos Local Security Checks	2014/12/22	2022/12/5	high
79011	RHEL 5 / 6 : java-1.6.0-sun (RHSA-2014:0414)	Nessus	Red Hat Local Security Checks	2014/11/8	2023/4/25	medium

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

high

medium