The Sun JDK 6 was updated to Update13 to fix various bugs and security issues.

  - LdapCtx in the LDAP service in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier; 6 Update 12 and earlier; SDK and JRE     1.3.1_24 and earlier; and 1.4.2_19 and earlier does not     close the connection when initialization fails, which     allows remote attackers to cause a denial of service     (LDAP service hang). (CVE-2009-1093)

  - Unspecified vulnerability in the LDAP implementation in     Java SE Development Kit (JDK) and Java Runtime     Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12     and earlier; SDK and JRE 1.3.1_24 and earlier; and     1.4.2_19 and earlier allows remote LDAP servers to     execute arbitrary code via unknown vectors related to     serialized data. (CVE-2009-1094)

  - Integer overflow in unpack200 in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier, and 6 Update 12 and earlier, allows remote     attackers to access files or execute arbitrary code via     a JAR file with crafted Pack200 headers. (CVE-2009-1095)

  - Buffer overflow in unpack200 in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier, and 6 Update 12 and earlier, allows remote     attackers to access files or execute arbitrary code via     a JAR file with crafted Pack200 headers. (CVE-2009-1096)

  - Multiple buffer overflows in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 6 Update 12 and     earlier allow remote attackers to access files or     execute arbitrary code via a crafted (1) PNG image, aka     CR 6804996, and (2) GIF image, aka CR 6804997.
    (CVE-2009-1097)

  - Buffer overflow in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 5.0 Update 17 and     earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier;
    and 1.3.1_24 and earlier allows remote attackers to     access files or execute arbitrary code via a crafted GIF     image, aka CR 6804998. (CVE-2009-1098)

  - Integer signedness error in Java SE Development Kit     (JDK) and Java Runtime Environment (JRE) 5.0 Update 17     and earlier, and 6 Update 12 and earlier, allows remote     attackers to access files or execute arbitrary code via     a crafted Type1 font, which triggers a buffer overflow.
    (CVE-2009-1099)

  - Multiple unspecified vulnerabilities in Java SE     Development Kit (JDK) and Java Runtime Environment (JRE)     5.0 Update 17 and earlier, and 6 Update 12 and earlier,     allow remote attackers to cause a denial of service     (disk consumption) via vectors related to temporary font     files and (1) 'limits on Font creation,' aka CR 6522586,     and (2) another unspecified vector, aka CR 6632886.
    (CVE-2009-1100)

  - Unspecified vulnerability in the lightweight HTTP server     implementation in Java SE Development Kit (JDK) and Java     Runtime Environment (JRE) 6 Update 12 and earlier allows     remote attackers to cause a denial of service (probably     resource consumption) for a JAX-WS service endpoint via     a connection without any data, which triggers a file     descriptor 'leak.'. (CVE-2009-1101)

  - Unspecified vulnerability in the Virtual Machine in Java     SE Development Kit (JDK) and Java Runtime Environment     (JRE) 6 Update 12 and earlier allows remote attackers to     access files and execute arbitrary code via unknown     vectors related to 'code generation.'. (CVE-2009-1102)

  - Unspecified vulnerability in the Java Plug-in in Java SE     Development Kit (JDK) and Java Runtime Environment (JRE)     5.0 Update 17 and earlier; 6 Update 12 and earlier;
    1.4.2_19 and earlier; and 1.3.1_24 and earlier allows     remote attackers to access files and execute arbitrary     code via unknown vectors related to 'deserializing     applets,' aka CR 6646860. (CVE-2009-1103)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 5.0 Update 17 and     earlier; 6 Update 12 and earlier; and 1.4.2_19 and     earlier does not prevent JavaScript that is loaded from     the localhost from connecting to other ports on the     system, which allows user-assisted attackers to bypass     intended access restrictions via LiveConnect, aka CR     6724331. NOTE: this vulnerability can be leveraged with     separate cross-site scripting (XSS) vulnerabilities for     remote attack vectors. (CVE-2009-1104)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 6 Update 12, 11, and 10     allows user-assisted remote attackers to cause a trusted     applet to run in an older JRE version, which can be used     to exploit vulnerabilities in that older version, aka CR     6706490. (CVE-2009-1105)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 6 Update 12, 11, and 10     does not properly parse crossdomain.xml files, which     allows remote attackers to bypass intended access     restrictions and connect to arbitrary sites via unknown     vectors, aka CR 6798948. (CVE-2009-1106)

  - The Java Plug-in in Java SE Development Kit (JDK) and     Java Runtime Environment (JRE) 6 Update 12 and earlier,     and 5.0 Update 17 and earlier, allows remote attackers     to trick a user into trusting a signed applet via     unknown vectors that misrepresent the security warning     dialog, related to a 'Swing JLabel HTML parsing     vulnerability,' aka CR 6782871. (CVE-2009-1107)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - ISC DHCP dhclient
  - Integrated Services Digital Network (ISDN) subsystem
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Web Start
  - Linux kernel
  - Linux kernel 32-bit and 64-bit emulation
  - Linux kernel Simple Internet Transition INET6
  - Linux kernel tty
  - Linux kernel virtual file system (VFS)
  - Red Hat dhcpd init script for DHCP
  - SBNI WAN driver

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.3. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2009-0217, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, CVE-2009-1107, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877)

Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to these updated java-1.6.0-ibm packages, which resolve these issues.
For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	Name	Product	Family	Published	Updated	Severity
41407	SuSE 11 Security Update : Sun JDK 6 (SAT Patch Number 699)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
89116	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0014) (remote check)	Nessus	Misc.	3/3/2016	1/6/2021	critical
44029	RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)	Nessus	Red Hat Local Security Checks	1/15/2010	1/14/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical