IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs.

Please see the IBM JDK Alert page for more information :

http://www.ibm.com/developerworks/java/jdk/alerts/

Security issues fixed :

  - / CVE-2013-0443. (CVE-2013-1486 / CVE-2013-1478 /     CVE-2013-0445 / CVE-2013-1480 / CVE-2013-1476 /     CVE-2013-0442 / CVE-2013-0425 / CVE-2013-0426 /     CVE-2013-0428 / CVE-2013-1481 / CVE-2013-0432 /     CVE-2013-0434 / CVE-2013-0409 / CVE-2013-0427 /     CVE-2013-0433 / CVE-2013-0424 / CVE-2013-0440)

Updated java-1.7.0-openjdk packages fix security vulnerabilities :

Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2012-3174, CVE-2013-0422).

Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-0444).

Multiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges (CVE-2013-1478, CVE-2013-1480).

A flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions (CVE-2013-0432).

The default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted (CVE-2013-0435).

Multiple improper permission check issues were discovered in the JMX, Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2013-0431, CVE-2013-0427, CVE-2013-0433, CVE-2013-0434).

It was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack (CVE-2013-0424).

It was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake (CVE-2013-0440).

It was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack (CVE-2013-0443).

Multiple improper permission check issues were discovered in the JMX and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-1486, CVE-2013-1484).

An improper permission check issue was discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions (CVE-2013-1485).

It was discovered that OpenJDK leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle (CVE-2013-0169).

An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges (CVE-2013-0809).

It was discovered that the 2D component did not properly reject certain malformed images. Specially crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges (CVE-2013-1493).

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2012-1541, CVE-2012-3174, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0422, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0449, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1484, CVE-2013-1485, CVE-2013-1486, CVE-2013-1487, CVE-2013-1493)

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR4 release. All running instances of IBM Java must be restarted for the update to take effect.

IBM Java 7 was updated to SR4, fixing various critical security issues and bugs.

Please see the IBM JDK Alert page for more information :

http://www.ibm.com/developerworks/java/jdk/alerts/

Security issues fixed :

  - / CVE-2012-3174. (CVE-2013-1487 / CVE-2013-1486 /     CVE-2013-1478 / CVE-2013-0445 / CVE-2013-1480 /     CVE-2013-0441 / CVE-2013-1476 / CVE-2012-1541 /     CVE-2013-0446 / CVE-2012-3342 / CVE-2013-0442 /     CVE-2013-0450 / CVE-2013-0425 / CVE-2013-0426 /     CVE-2013-0428 / CVE-2012-3213 / CVE-2013-0419 /     CVE-2013-0423 / CVE-2013-0351 / CVE-2013-0432 /     CVE-2013-1473 / CVE-2013-0435 / CVE-2013-0434 /     CVE-2013-0409 / CVE-2013-0427 / CVE-2013-0433 /     CVE-2013-0424 / CVE-2013-0440 / CVE-2013-0438 /     CVE-2013-0443 / CVE-2013-1484 / CVE-2013-1485 /     CVE-2013-0437 / CVE-2013-0444 / CVE-2013-0449 /     CVE-2013-0431 / CVE-2013-0422)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2013-98:02 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2013-0424     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect integrity via vectors related to RMI.
     CVE-2013-0425     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different     vulnerability than CVE-2013-0428 and CVE-2013-0426.
     CVE-2013-0426     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different     vulnerability than CVE-2013-0425 and CVE-2013-0428.
     CVE-2013-0427     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect integrity via     unknown vectors related to Libraries.
     CVE-2013-0428     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different     vulnerability than CVE-2013-0425 and CVE-2013-0426.
     CVE-2013-0429     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect     confidentiality, integrity, and availability via vectors related to CORBA.
     CVE-2013-0431     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11 allows user-assisted remote attackers to bypass the Java security sandbox via unspecified     vectors related to JMX, aka Issue 52, a different vulnerability than CVE-2013-1490.
     CVE-2013-0432     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality and integrity via vectors related to AWT.
     CVE-2013-0433     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect integrity via     unknown vectors related to Networking.
     CVE-2013-0434     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality via vectors related to JAXP.
     CVE-2013-0435     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via vectors related to     JAX-WS.
     CVE-2013-0440     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect availability via vectors related to JSSE.
     CVE-2013-0441     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via vectors related to CORBA, a different     vulnerability than CVE-2013-1476 and CVE-2013-1475.
     CVE-2013-0442     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via vectors related to AWT.
     CVE-2013-0443     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality and integrity via vectors related to JSSE.
     CVE-2013-0444     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11 allows remote attackers to affect confidentiality, integrity, and availability via unknown     vectors related to Beans.
     CVE-2013-0445     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect     confidentiality, integrity, and availability via vectors related to AWT.
     CVE-2013-0450     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect     confidentiality, integrity, and availability via vectors related to JMX.
     CVE-2013-1475     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via vectors related to CORBA.
     CVE-2013-1476     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via vectors related to CORBA, a different     vulnerability than CVE-2013-0441 and CVE-2013-1475.
     CVE-2013-1478     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via unknown vectors related to 2D.
     CVE-2013-1480     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to     affect confidentiality, integrity, and availability via vectors related to AWT.
     CVE-2013-0169     The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and     other products, do not properly consider timing side-channel attacks on a MAC check requirement during the     processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and     plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the Lucky     Thirteen issue.
     CVE-2013-1484     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13     and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown     vectors related to Libraries.
     CVE-2013-1485     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13     and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.
     CVE-2013-1486     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13     and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect     confidentiality, integrity, and availability via vectors related to JMX.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
65599	SuSE 10 Security Update : Java (ZYPP Patch Number 8483)	Nessus	SuSE Local Security Checks	3/17/2013	1/19/2021	critical
66107	Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:095)	Nessus	Mandriva Local Security Checks	4/20/2013	12/5/2022	critical
65204	RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:0626)	Nessus	Red Hat Local Security Checks	3/12/2013	5/25/2022	critical
65246	SuSE 11.2 Security Update : Java (SAT Patch Number 7454)	Nessus	SuSE Local Security Checks	3/13/2013	5/25/2022	critical
290025	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.9-2.3.7.1.AXS4 (AXSA:2013-98:02)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/17/2026	medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

medium