- Security update :

    - S4421494, CVE-2010-4476: infinite loop while parsing       double literal.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the floating point parser in OpenJDK, an implementation of the Java platform, can enter an infinite loop when processing certain input strings. Such input strings represent valid numbers and can be contained in data supplied by an attacker over the network, leading to a denial-of-service attack.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0290 advisory.

    The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and     the IBM Java 2 Software Development Kit.

    A denial of service flaw was found in the way certain strings were     converted to Double objects. A remote attacker could use this flaw to cause     Java based applications to hang, for example, if they parsed Double values     in a specially-crafted HTTP request. (CVE-2010-4476)

    All users of java-1.6.0-ibm are advised to upgrade to these updated     packages, containing the IBM 1.6.0 SR9 Java release. All running instances     of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0291 advisory.

    The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and     the IBM Java 2 Software Development Kit.

    A denial of service flaw was found in the way certain strings were     converted to Double objects. A remote attacker could use this flaw to cause     Java based applications to hang, for example, if they parsed Double values     in a specially-crafted HTTP request. (CVE-2010-4476)

    All users of java-1.5.0-ibm are advised to upgrade to these updated     packages, containing the IBM 1.5.0 SR12-FP3 Java release. All running     instances of IBM Java must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

The following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0336 advisory.

  - JDK Double.parseDouble Denial-Of-Service (CVE-2010-4476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
51960	Fedora 13 : java-1.6.0-openjdk-1.6.0.0-50.1.8.6.fc13 (2011-1231)	Nessus	Fedora Local Security Checks	2/14/2011	1/11/2021	medium
51977	Debian DSA-2161-1 : openjdk-6 - denial of service	Nessus	Debian Local Security Checks	2/15/2011	1/4/2021	medium
52063	RHEL 6 : java-1.6.0-ibm (RHSA-2011:0290)	Nessus	Red Hat Local Security Checks	2/23/2011	4/14/2025	high
52064	RHEL 6 : java-1.5.0-ibm (RHSA-2011:0291)	Nessus	Red Hat Local Security Checks	2/23/2011	4/14/2025	high
52067	SuSE 11.1 Security Update : Sun Java 1.6 (SAT Patch Number 3976)	Nessus	SuSE Local Security Checks	2/23/2011	1/19/2021	critical
52607	RHEL 5 : tomcat5 (RHSA-2011:0336)	Nessus	Red Hat Local Security Checks	3/10/2011	4/21/2024	high
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	6/30/2014	12/5/2022	critical

Detections

Analytics

Plugins Search

medium

medium

high

high

critical

high

critical