SuSE9 Security Update : IBM Java 1.5.0 (YOU Patch Number 12564)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 9 host is missing a security-related patch.

Description :

IBM Java 5 was updated to Service Refresh 11. It fixes lots of bugs
and security issues. It also contains a timezone update for the
current Fiji change (timezone 1.6.9s).

The update fixes the following security issues :

- A vulnerability in the Java Runtime Environment with
decoding DER encoded data might allow a remote client to
cause the JRE to crash, resulting in a denial of service
condition. (CVE-2009-3876, CVE-2009-3877)

- A buffer overflow vulnerability in the Java Runtime
Environment audio system might allow an untrusted applet
or Java Web Start application to escalate privileges.
For example, an untrusted applet might grant itself
permissions to read and write local files, or run local
applications that are accessible to the user running the
untrusted applet. (CVE-2009-3867)

- A buffer overflow vulnerability in the Java Runtime
Environment with parsing image files might allow an
untrusted applet or Java Web Start application to
escalate privileges. For example, an untrusted applet
might grant itself permissions to read and write local
files, or run local applications that are accessible to
the user running the untrusted applet. (CVE-2009-3868)

- An integer overflow vulnerability in the Java Runtime
Environment with reading JPEG files might allow an
untrusted applet or Java Web Start application to
escalate privileges. For example, an untrusted applet
might grant itself permissions to read and write local
files, or run local applications that are accessible to
the user running the untrusted applet. (CVE-2009-3872)

- A buffer overflow vulnerability in the Java Runtime
Environment with processing JPEG files might allow an
untrusted applet or Java Web Start application to
escalate privileges. For example, an untrusted applet
might grant itself permissions to read and write local
files, or run local applications that are accessible to
the user running the untrusted applet. (CVE-2009-3873)

- A security vulnerability in the Java Runtime Environment
with verifying HMAC digests might allow authentication
to be bypassed. This action can allow a user to forge a
digital signature that would be accepted as valid.
Applications that validate HMAC-based digital signatures
might be vulnerable to this type of attack.
(CVE-2009-3875)

- A buffer overflow vulnerability in the Java Runtime
Environment with processing image files might allow an
untrusted applet or Java Web Start application to
escalate privileges. For example, an untrusted applet
might grant itself permissions to read and write local
files or run local applications that are accessible to
the user running the untrusted applet. (CVE-2009-3869)

- A buffer overflow vulnerability in the Java Runtime
Environment with processing image files might allow an
untrusted applet or Java Web Start application to
escalate privileges. For example, an untrusted applet
might grant itself permissions to read and write local
files or run local applications that are accessible to
the user running the untrusted applet. (CVE-2009-3871)

- An integer overflow vulnerability in the Java Runtime
Environment with processing JPEG images might allow an
untrusted applet or Java Web Start application to
escalate privileges. For example, an untrusted applet
might grant itself permissions to read and write local
files or run local applications that are accessible to
the user running the untrusted applet. (CVE-2009-3874)

- The Java Runtime Environment includes the Java Web Start
technology that uses the Java Web Start ActiveX control
to launch Java Web Start in Internet Explorer. A
security vulnerability in the Active Template Library
(ATL) in various releases of Microsoft Visual Studio,
which is used by the Java Web Start ActiveX control,
might allow the Java Web Start ActiveX control to be
leveraged to run arbitrary code. This might occur as the
result of a user of the Java Runtime Environment viewing
a specially crafted web page that exploits this
vulnerability. (CVE-2009-2493)

Please also refer to http://www.ibm.com/developerworks/java/jdk/alerts
for more information about this update.

See also :

http://support.novell.com/security/cve/CVE-2009-2493.html
http://support.novell.com/security/cve/CVE-2009-3867.html
http://support.novell.com/security/cve/CVE-2009-3868.html
http://support.novell.com/security/cve/CVE-2009-3869.html
http://support.novell.com/security/cve/CVE-2009-3871.html
http://support.novell.com/security/cve/CVE-2009-3872.html
http://support.novell.com/security/cve/CVE-2009-3873.html
http://support.novell.com/security/cve/CVE-2009-3874.html
http://support.novell.com/security/cve/CVE-2009-3875.html
http://support.novell.com/security/cve/CVE-2009-3876.html
http://support.novell.com/security/cve/CVE-2009-3877.html

Solution :

Apply YOU patch number 12564.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now