The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0963 advisory.

  - OpenJDK: Insecure shared memory permissions (2D, 8001034) (CVE-2013-1500)

  - OpenJDK: Frame injection in generated HTML (Javadoc, 8012375) (CVE-2013-1571)

  - Oracle JDK: unspecified vulnerability fixed in 7u25 (Deployment) (CVE-2013-2400, CVE-2013-2437,     CVE-2013-2442, CVE-2013-2462, CVE-2013-2466, CVE-2013-2468, CVE-2013-3744)

  - OpenJDK: Integrate Apache Santuario, rework class loader (Libraries, 6741606, 8008744) (CVE-2013-2407)

  - OpenJDK: JConsole SSL support (Serviceability, 8003703) (CVE-2013-2412)

  - OpenJDK: AccessControlContext check order issue (Libraries, 8001330) (CVE-2013-2443)

  - OpenJDK: Resource denial of service (AWT, 8001038) (CVE-2013-2444)

  - OpenJDK: Better handling of memory allocation errors (Hotspot, 7158805) (CVE-2013-2445)

  - OpenJDK: output stream access restrictions (CORBA, 8000642) (CVE-2013-2446)

  - OpenJDK: Prevent revealing the local address (Networking, 8001318) (CVE-2013-2447)

  - OpenJDK: Better access restrictions (Sound, 8006328) (CVE-2013-2448)

  - OpenJDK: GnomeFileTypeDetector path access check (Libraries, 8004288) (CVE-2013-2449)

  - OpenJDK: ObjectStreamClass circular reference denial of service (Serialization, 8000638) (CVE-2013-2450)

  - OpenJDK: exclusive port binding (Networking, 7170730) (CVE-2013-2451)

  - OpenJDK: Unique VMIDs (Libraries, 8001033) (CVE-2013-2452)

  - OpenJDK: MBeanServer Introspector package access (JMX, 8008124) (CVE-2013-2453)

  - OpenJDK: SerialJavaObject package restriction (JDBC, 8009554) (CVE-2013-2454)

  - OpenJDK: getEnclosing* checks (Libraries, 8007812) (CVE-2013-2455)

  - OpenJDK: ObjectOutputStream access checks (Serialization, 8008132) (CVE-2013-2456)

  - OpenJDK: Proper class checking (JMX, 8008120) (CVE-2013-2457)

  - OpenJDK: Method handles (Libraries, 8009424) (CVE-2013-2458)

  - OpenJDK: Various AWT integer overflow checks (AWT, 8009071) (CVE-2013-2459)

  - OpenJDK: tracing insufficient access checks (Serviceability, 8010209) (CVE-2013-2460)

  - OpenJDK: Missing check for valid DOMCanonicalizationMethod canonicalization algorithm (Libraries, 8014281)     (CVE-2013-2461)

  - OpenJDK: Incorrect image attribute verification (2D, 8012438) (CVE-2013-2463)

  - Oracle JDK: unspecified vulnerability fixed in 7u25 (2D) (CVE-2013-2464)

  - OpenJDK: Incorrect image channel verification (2D, 8012597) (CVE-2013-2465)

  - OpenJDK: Incorrect image layout verification (2D, 8012601) (CVE-2013-2469)

  - OpenJDK: ImagingLib byte lookup processing (2D, 8011243) (CVE-2013-2470)

  - OpenJDK: Incorrect IntegerComponentRaster size checks (2D, 8011248) (CVE-2013-2471)

  - OpenJDK: Incorrect ShortBandedRaster size checks (2D, 8011253) (CVE-2013-2472)

  - OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257) (CVE-2013-2473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0963)

low Nessus Plugin ID 66948

Version 1.27