The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-202:02 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2013-0809     Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle     Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote     attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493.
     CVE-2013-1493     The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6     Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or     cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-     of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges. (CVE-2013-0809)

It was discovered that the 2D component did not properly reject certain malformed images. Specially crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges.
(CVE-2013-1493)

Note: If your system has not yet been upgraded to Scientific Linux 6.4 and the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. Thus, this update has been rated as having critical security impact as a one time exception. The icedtea-web package as provided with Scientific Linux 6.4 uses OpenJDK 7 instead.

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.9. All running instances of OpenJDK Java must be restarted for the update to take effect.

An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges. (CVE-2013-0809)

It was discovered that the 2D component did not properly reject certain malformed images. Specially crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges.
(CVE-2013-1493)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.8.

All running instances of OpenJDK Java must be restarted for the update to take effect.

This release of Icedtea6-1.12.4 fixes the following two issues that allowed a remote attacker to execute arbitrary code remotely by providing crafted images to the affected code.

  - CVE-2013-0809: CVSS v2 Base Score: 6.8 (critical)     (AV:N/AC:M/Au:N/C:P/I:P/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2013-1493: CVSS v2 Base Score: 6.8 (critical)     (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0603 advisory.

    [1.7.0.9-2.3.8.0.0.1.el5_9]
    - Add oracle-enterprise.patch
    - Fix DISTRO_NAME to 'Enterprise Linux'

    [1.7.0.9-2.3.8.0.el5_9]
    - Updated to icedtea7-forest-2.3
    - Resolves: rhbz#917181

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0604 advisory.

    [ 1:1.6.0.0-1.36.1.11.9.0.1.el5_9]
    - Add oracle-enterprise.patch

    [1:1.6.0.0-1.36.1.11.9]
    - Updated to icedtea6 1.11.9
    - Resolves: rhbz#917176

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has a version of IBM Notes (formerly Lotus Notes) 8.5.x prior to 8.5.3 Fix Pack 5 installed.  It is, therefore, reportedly affected by the following vulnerabilities :

  - The included version of the IBM Java SDK contains a     version of the IBM JRE that contains numerous security     issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436,     CVE-2013-2455, CVE-2013-3006, CVE-2013-3007,     CVE-2013-3008, CVE-2013-3009, CVE-2013-3010,     CVE-2013-3011, CVE-2013-3012)

  - Note also that fixes in the Oracle Java CPUs for     February, April and June 2013 are included in the     fixed IBM Java release, which is included in the     fixed IBM Notes release.
    (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342,     CVE-2013-0351, CVE-2013-0401, CVE-2013-0402,     CVE-2013-0409, CVE-2013-0419, CVE-2013-0423,     CVE-2013-0424, CVE-2013-0425, CVE-2013-0426,     CVE-2013-0427, CVE-2013-0428, CVE-2013-0429,     CVE-2013-0430, CVE-2013-0431, CVE-2013-0432,     CVE-2013-0433, CVE-2013-0434, CVE-2013-0435,     CVE-2013-0437, CVE-2013-0438, CVE-2013-0440,     CVE-2013-0441, CVE-2013-0442, CVE-2013-0443,     CVE-2013-0444, CVE-2013-0445, CVE-2013-0446,     CVE-2013-0448, CVE-2013-0449, CVE-2013-0450,     CVE-2013-1473, CVE-2013-1475, CVE-2013-1476,     CVE-2013-1478, CVE-2013-1479, CVE-2013-1480,     CVE-2013-1481, CVE-2013-1488, CVE-2013-1489,     CVE-2013-1491, CVE-2013-1500, CVE-2013-1518,     CVE-2013-1537, CVE-2013-1540, CVE-2013-1557,     CVE-2013-1558, CVE-2013-1561, CVE-2013-1563,     CVE-2013-1564, CVE-2013-1569, CVE-2013-1571,     CVE-2013-2383, CVE-2013-2384, CVE-2013-2394,     CVE-2013-2400, CVE-2013-2407, CVE-2013-2412,     CVE-2013-2414, CVE-2013-2415, CVE-2013-2416,     CVE-2013-2417, CVE-2013-2418, CVE-2013-2419,     CVE-2013-2420, CVE-2013-2421, CVE-2013-2422,     CVE-2013-2423, CVE-2013-2424, CVE-2013-2425,     CVE-2013-2426, CVE-2013-2427, CVE-2013-2428,     CVE-2013-2429, CVE-2013-2430, CVE-2013-2431,     CVE-2013-2432, CVE-2013-2433, CVE-2013-2434,     CVE-2013-2435, CVE-2013-2437, CVE-2013-2438,     CVE-2013-2439, CVE-2013-2440, CVE-2013-2442,     CVE-2013-2443, CVE-2013-2444, CVE-2013-2445,     CVE-2013-2446, CVE-2013-2447, CVE-2013-2448,     CVE-2013-2449, CVE-2013-2450, CVE-2013-2451,     CVE-2013-2452, CVE-2013-2453, CVE-2013-2454,     CVE-2013-2456, CVE-2013-2457, CVE-2013-2458,     CVE-2013-2459, CVE-2013-2460, CVE-2013-2461,     CVE-2013-2462, CVE-2013-2463, CVE-2013-2464,     CVE-2013-2465, CVE-2013-2466, CVE-2013-2467,     CVE-2013-2468, CVE-2013-2469, CVE-2013-2470,     CVE-2013-2471, CVE-2013-2472, CVE-2013-2473,     CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)

java-1_7_0-openjdk was updated to icedtea-2.3.7 (bnc#809386) :

  - Security fixes

  - S8007014, CVE-2013-0809: Improve image handling

  - S8007675, CVE-2013-1493: Improve color conversion

  - Backports

  - S8002344: Krb5LoginModule config class does not return     proper KDC list from DNS

  - S8004344: Fix a crash in ToolkitErrorHandler() in     XlibWrapper.c

  - S8006179: JSR292 MethodHandles lookup with interface     using findVirtual()

  - S8006882: Proxy generated classes in sun.proxy package     breaks JMockit

  - Bug fixes

  - PR1303: Correct #ifdef to #if

  - PR1340: Simplify the rhino class rewriter to avoid use     of concurrency

  - Revert 7017193 and add the missing free call, until a     better fix is ready.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.5. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.5 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	Name	Product	Family	Published	Updated	Severity
289094	MiracleLinux 4 : java-1.6.0-openjdk-1.6.0.0-1.57.1.11.9.AXS4 (AXSA:2013-202:02)	Nessus	Miracle Linux Local Security Checks	1/16/2026	2/10/2026	critical
65087	Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64 (20130306)	Nessus	Scientific Linux Local Security Checks	3/8/2013	1/14/2021	critical
65089	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20130306)	Nessus	Scientific Linux Local Security Checks	3/8/2013	1/14/2021	critical
65245	SuSE 11.2 Security Update : Java (SAT Patch Number 7457)	Nessus	SuSE Local Security Checks	3/13/2013	1/19/2021	critical
68776	Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-0603)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
68777	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2013-0604)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
70744	IBM Notes 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities	Nessus	Windows	11/4/2013	5/25/2022	critical
74933	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0509-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
78976	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1456) (ROBOT)	Nessus	Red Hat Local Security Checks	11/8/2014	12/5/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical