The remote host has a version of IBM Notes (formerly Lotus Notes) 8.5.x prior to 8.5.3 Fix Pack 5 installed.  It is, therefore, reportedly affected by the following vulnerabilities :

  - The included version of the IBM Java SDK contains a     version of the IBM JRE that contains numerous security     issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436,     CVE-2013-2455, CVE-2013-3006, CVE-2013-3007,     CVE-2013-3008, CVE-2013-3009, CVE-2013-3010,     CVE-2013-3011, CVE-2013-3012)

  - Note also that fixes in the Oracle Java CPUs for     February, April and June 2013 are included in the     fixed IBM Java release, which is included in the     fixed IBM Notes release.
    (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342,     CVE-2013-0351, CVE-2013-0401, CVE-2013-0402,     CVE-2013-0409, CVE-2013-0419, CVE-2013-0423,     CVE-2013-0424, CVE-2013-0425, CVE-2013-0426,     CVE-2013-0427, CVE-2013-0428, CVE-2013-0429,     CVE-2013-0430, CVE-2013-0431, CVE-2013-0432,     CVE-2013-0433, CVE-2013-0434, CVE-2013-0435,     CVE-2013-0437, CVE-2013-0438, CVE-2013-0440,     CVE-2013-0441, CVE-2013-0442, CVE-2013-0443,     CVE-2013-0444, CVE-2013-0445, CVE-2013-0446,     CVE-2013-0448, CVE-2013-0449, CVE-2013-0450,     CVE-2013-1473, CVE-2013-1475, CVE-2013-1476,     CVE-2013-1478, CVE-2013-1479, CVE-2013-1480,     CVE-2013-1481, CVE-2013-1488, CVE-2013-1489,     CVE-2013-1491, CVE-2013-1500, CVE-2013-1518,     CVE-2013-1537, CVE-2013-1540, CVE-2013-1557,     CVE-2013-1558, CVE-2013-1561, CVE-2013-1563,     CVE-2013-1564, CVE-2013-1569, CVE-2013-1571,     CVE-2013-2383, CVE-2013-2384, CVE-2013-2394,     CVE-2013-2400, CVE-2013-2407, CVE-2013-2412,     CVE-2013-2414, CVE-2013-2415, CVE-2013-2416,     CVE-2013-2417, CVE-2013-2418, CVE-2013-2419,     CVE-2013-2420, CVE-2013-2421, CVE-2013-2422,     CVE-2013-2423, CVE-2013-2424, CVE-2013-2425,     CVE-2013-2426, CVE-2013-2427, CVE-2013-2428,     CVE-2013-2429, CVE-2013-2430, CVE-2013-2431,     CVE-2013-2432, CVE-2013-2433, CVE-2013-2434,     CVE-2013-2435, CVE-2013-2437, CVE-2013-2438,     CVE-2013-2439, CVE-2013-2440, CVE-2013-2442,     CVE-2013-2443, CVE-2013-2444, CVE-2013-2445,     CVE-2013-2446, CVE-2013-2447, CVE-2013-2448,     CVE-2013-2449, CVE-2013-2450, CVE-2013-2451,     CVE-2013-2452, CVE-2013-2453, CVE-2013-2454,     CVE-2013-2456, CVE-2013-2457, CVE-2013-2458,     CVE-2013-2459, CVE-2013-2460, CVE-2013-2461,     CVE-2013-2462, CVE-2013-2463, CVE-2013-2464,     CVE-2013-2465, CVE-2013-2466, CVE-2013-2467,     CVE-2013-2468, CVE-2013-2469, CVE-2013-2470,     CVE-2013-2471, CVE-2013-2472, CVE-2013-2473,     CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)

java-1_7_0-openjdk was updated to icedtea-2.3.7 (bnc#809386) :

  - Security fixes

  - S8007014, CVE-2013-0809: Improve image handling

  - S8007675, CVE-2013-1493: Improve color conversion

  - Backports

  - S8002344: Krb5LoginModule config class does not return     proper KDC list from DNS

  - S8004344: Fix a crash in ToolkitErrorHandler() in     XlibWrapper.c

  - S8006179: JSR292 MethodHandles lookup with interface     using findVirtual()

  - S8006882: Proxy generated classes in sun.proxy package     breaks JMockit

  - Bug fixes

  - PR1303: Correct #ifdef to #if

  - PR1340: Simplify the rhino class rewriter to avoid use     of concurrency

  - Revert 7017193 and add the missing free call, until a     better fix is ready.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.5. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.5 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) 6.x installed on the remote host is earlier than Update 43.  It, therefore, potentially can allow remote code execution due to the following vulnerabilities related to the '2D' sub-component :

  - An integer overflow error exists related to handling     sample model instances that could result in memory     corruption leading to arbitrary code execution.
    (CVE-2013-0809)

  - An unspecified error exists that could allow memory to     be overwritten and could allow the security manager to     be bypassed, thus leading to application crashes or     arbitrary code execution. (CVE-2013-1493)

Please note this issue affects client deployments only and is exploited through untrusted 'Java Web Start' applications and untrusted Java applets.

Updated java-1.6.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.

An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges. (CVE-2013-0809)

It was discovered that the 2D component did not properly reject certain malformed images. Specially crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges.
(CVE-2013-1493)

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.9.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

IBM Java 7 was updated to SR4-FP1, fixing bugs and security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

and on :

http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64.fixes.htm l#SR4FP1

IBM Java 6 was updated to SR13 FP1, fixing bugs and security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

and on :

http://www.ibm.com/developerworks/java/jdk/aix/j664/Java6_64.fixes.htm l#SR13FP1

Security issues: - CVE-2013-0485- CVE-2013-0809

  - CVE-2013-0169. (CVE-2013-1493)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0602 advisory.

    [1.7.0.9-2.3.8.0.0.1.el6_4]
    - Update DISTRO_NAME in specfile

    [1.7.0.9-2.3.8.0el6]
    - Revert to rhel 6.3 version of spec file
    - Revert to icedtea7 2.3.8 forest
    - Resolves: rhbz#917183

    [1.7.0.11-2.4.0.pre5.el6]
    - Update to latest snapshot of icedtea7 2.4 forest
    - Resolves: rhbz#917183

    [1.7.0.9-2.4.0.pre4.3.el6]
    - Updated  to icedtea 2.4.0.pre4,
    - Rewritten (again) patch3 java-1.7.0-openjdk-java-access-bridge-security.patch
    - Resolves: rhbz#911530

    [1.7.0.9-2.4.0.pre3.3.el6]
    - Updated  to icedtea 2.4.0.pre3, updated!
    - Rewritten patch3 java-1.7.0-openjdk-java-access-bridge-security.patch
    - Resolves: rhbz#911530

    [1.7.0.9-2.4.0.pre2.3.el6]
    - Removed testing
     - mauve was outdated and
     - jtreg was icedtea relict
    - Updated  to icedtea 2.4.0.pre2, updated?
    - Added java -Xshare:dump to post (see 513605) fo jitarchs
    - Resolves: rhbz#911530

    [1.7.0.11-2.4.0.2.el6]
    - Unapplied but kept (for 2.3revert) patch110,  java-1.7.0-openjdk-nss-icedtea-e9c857dcb964.patch
    - Added and applied patch113: java-1.7.0-openjdk-aes-update_reset.patch
    - Added and applied patch114: java-1.7.0-openjdk-nss-tck.patch
    - Added and applied patch115: java-1.7.0-openjdk-nss-split_results.patch
    - NSS enabled by default - enable_nss set to 1
    - rewritten patch109 - java-1.7.0-openjdk-nss-config-1.patch
    - rewritten patch111 - java-1.7.0-openjdk-nss-config-2.patch
    - Resolves: rhbz#831734

    [1.7.0.11-2.4.0.1.el6]
    - Rewritten patch105: java-1.7.0-openjdk-disable-system-lcms.patch
    - Added jxmd and idlj to alternatives
    - make executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
    - Unapplied patch302 and deleted systemtap.patch
    - buildver increased to 11
    - icedtea_version set to 2.4.0
    - Added and applied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
    - removed tmp-patches source tarball
    - Added /lib/security/US_export_policy.jar and lib/security/local_policy.jar
    - Disabled nss - enable_nss set to 0
    - Resolves: rhbz#895034

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges. (CVE-2013-0809)

It was discovered that the 2D component did not properly reject certain malformed images. Specially crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges.
(CVE-2013-1493)

ID	Name	Product	Family	Published	Updated	Severity
70744	IBM Notes 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities	Nessus	Windows	11/4/2013	5/25/2022	critical
74933	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0509-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
78976	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1456) (ROBOT)	Nessus	Red Hat Local Security Checks	11/8/2014	12/5/2022	critical
65050	Oracle Java JDK / JRE 6 < Update 43 Remote Code Execution (Windows)	Nessus	Windows	3/6/2013	4/11/2022	critical
65074	RHEL 5 : java-1.6.0-openjdk (RHSA-2013:0604)	Nessus	Red Hat Local Security Checks	3/7/2013	1/14/2021	critical
66031	SuSE 11.2 Security Update : java-1_7_0-ibm (SAT Patch Number 7623)	Nessus	SuSE Local Security Checks	4/19/2013	12/5/2022	critical
66198	SuSE 10 Security Update : java-1_6_0-ibm (ZYPP Patch Number 8544)	Nessus	SuSE Local Security Checks	4/24/2013	12/5/2022	critical
68775	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2013-0602)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
69727	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2013-168)	Nessus	Amazon Linux Local Security Checks	9/4/2013	4/18/2018	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical