IBM Java 6 SR9 was released, fixing a lot of security issues.

IBM JDK Alerts can also be found on this page:
http://www.ibm.com/developerworks/java/jdk/alerts/

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0880 advisory.

  - TLS: MITM attacks via session renegotiation (CVE-2009-3555)

  - krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) (CVE-2010-1321)

  - OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004) (CVE-2010-3541,     CVE-2010-3573)

  - OpenJDK DNS server IP address information leak (6957564) (CVE-2010-3548)

  - OpenJDK HttpURLConnection request splitting (6952017) (CVE-2010-3549)

  - JDK unspecified vulnerability in Java Web Start component (CVE-2010-3550, CVE-2010-3558)

  - OpenJDK local network address disclosure (6952603) (CVE-2010-3551)

  - OpenJDK Swing unsafe reflection usage (6622002) (CVE-2010-3553)

  - JDK unspecified vulnerability in Deployment component (CVE-2010-3555, CVE-2010-4422, CVE-2010-4447,     CVE-2010-4452, CVE-2010-4463, CVE-2010-4466, CVE-2010-4467, CVE-2010-4475)

  - JDK unspecified vulnerability in 2D component (CVE-2010-3556, CVE-2010-3571)

  - OpenJDK Swing mutable static (6938813) (CVE-2010-3557)

  - JDK unspecified vulnerability in Networking component (CVE-2010-3560)

  - OpenJDK IndexColorModel double-free (6925710) (CVE-2010-3562)

  - OpenJDK: unspecified vulnerability in Deployment component (CVE-2010-3563)

  - OpenJDK JPEG writeImage remote code execution (6963023) (CVE-2010-3565)

  - OpenJDK ICC Profile remote code execution (6963489) (CVE-2010-3566)

  - OpenJDK Deserialization Race condition (6559775) (CVE-2010-3568)

  - OpenJDK Serialization inconsistencies (6966692) (CVE-2010-3569)

  - JDK unspecified vulnerability in Sound component (CVE-2010-3572, CVE-2010-4454, CVE-2010-4462,     CVE-2010-4473)

  - OpenJDK HttpURLConnection incomplete TRACE permission check (6981426) (CVE-2010-3574)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

  - JDK Double.parseDouble Denial-Of-Service (CVE-2010-4476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

IBM Java 1.4.2 SR13 was updated to FP8 to fix various bugs and security issues.

The following security issues were fixed :

  - The kg_accept_krb5 function in krb5/accept_sec_context.c     in the GSS-API library in MIT Kerberos 5 (aka krb5)     through 1.7.1 and 1.8 before 1.8.2, as used in kadmind     and other applications, does not properly check for     invalid GSS-API tokens, which allows remote     authenticated users to cause a denial of service (NULL     pointer dereference and daemon crash) via an AP-REQ     message in which the authenticator's checksum field is     missing. (CVE-2010-1321)

  - Unspecified vulnerability in the Networking component in     Oracle Java SE and Java for Business 6 Update 21, 5.0     Update 25, 1.4.2_27, and 1.3.1_28 allows remote     attackers to affect confidentiality, integrity, and     availability via unknown vectors. NOTE: the previous     information was obtained from the October 2010 CPU.
    Oracle has not commented on claims from a reliable     downstream vendor that HttpURLConnection does not     properly check for the allowHttpTrace permission, which     allows untrusted code to perform HTTP TRACE requests.
    (CVE-2010-3574)

  - The Java Runtime Environment hangs forever when     converting '2.2250738585072012e-308' to a binary     floating-point number. (CVE-2010-4476)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

ID	Name	Product	Family	Published	Updated	Severity
51750	SuSE 10 Security Update : IBM Java 6 SR9 (ZYPP Patch Number 7312)	Nessus	SuSE Local Security Checks	1/27/2011	1/19/2021	critical
63983	RHEL 5 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2011:0880)	Nessus	Red Hat Local Security Checks	1/24/2013	4/21/2024	critical
52631	SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4024)	Nessus	SuSE Local Security Checks	3/11/2011	1/19/2021	critical
57203	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7440)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	critical
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	3/4/2016	5/25/2022	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high