Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component.
An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-2470 , CVE-2013-2471 , CVE-2013-2472 , CVE-2013-2473 , CVE-2013-2463 , CVE-2013-2465 , CVE-2013-2469)

Integer overflow flaws were found in the way AWT processed certain input. An attacker could use these flaws to execute arbitrary code with the privileges of the user running an untrusted Java applet or application. (CVE-2013-2459)

Multiple improper permission check issues were discovered in the Sound and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2013-2448 , CVE-2013-2457 , CVE-2013-2453)

Multiple flaws in the Serialization, Networking, Libraries and CORBA components can be exploited by an untrusted Java application or applet to gain access to potentially sensitive information. (CVE-2013-2456 , CVE-2013-2447 , CVE-2013-2455 , CVE-2013-2452 , CVE-2013-2443 , CVE-2013-2446)

It was discovered that the Hotspot component did not properly handle out-of-memory errors. An untrusted Java application or applet could possibly use these flaws to terminate the Java Virtual Machine.
(CVE-2013-2445)

It was discovered that the AWT component did not properly manage certain resources and that the ObjectStreamClass of the Serialization component did not properly handle circular references. An untrusted Java application or applet could possibly use these flaws to cause a denial of service. (CVE-2013-2444 , CVE-2013-2450)

It was discovered that the Libraries component contained certain errors related to XML security and the class loader. A remote attacker could possibly exploit these flaws to bypass intended security mechanisms or disclose potentially sensitive information and cause a denial of service. (CVE-2013-2407 , CVE-2013-2461)

It was discovered that JConsole did not properly inform the user when establishing an SSL connection failed. An attacker could exploit this flaw to gain access to potentially sensitive information.
(CVE-2013-2412)

It was found that documentation generated by Javadoc was vulnerable to a frame injection attack. If such documentation was accessible over a network, and a remote attacker could trick a user into visiting a specially crafted URL, it would lead to arbitrary web content being displayed next to the documentation. This could be used to perform a phishing attack by providing frame content that spoofed a login form on the site hosting the vulnerable documentation. (CVE-2013-1571)

It was discovered that the 2D component created shared memory segments with insecure permissions. A local attacker could use this flaw to read or write to the shared memory segment. (CVE-2013-1500)

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.5. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.5 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-553:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
     CVE-2013-1500     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to     affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is     from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related     to weak permissions for shared memory.
     CVE-2013-1571     Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45     and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote     attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is     from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related     to frame injection in HTML that is generated by Javadoc.
     CVE-2013-2407     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality     and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June     2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to XML     security and the class loader.
     CVE-2013-2412     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality     via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU.
    Oracle has not commented on claims from another vendor that this issue is related to insufficient     indication of an SSL connection failure by JConsole, related to RMI connection dialog box.
     CVE-2013-2443     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability     than CVE-2013-2452 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has     not commented on claims from another vendor that this issue is due to an incorrect checking order within     the AccessControlContext class.
     CVE-2013-2444     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and     OpenJDK 7 allows remote attackers to affect availability via vectors related to AWT. NOTE: the previous     information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this     issue does not properly manage and restrict certain resources related to the processing of fonts,     possibly involving temporary files.
     CVE-2013-2445     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect availability via unknown vectors related to Hotspot. NOTE: the previous information is     from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows     remote attackers to bypass the Java sandbox via vectors related to handling of memory allocation errors.
     CVE-2013-2446     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from     the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not     properly enforce access restrictions for CORBA output streams.
     CVE-2013-2447     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous     information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this     issue allows remote attackers to obtain a socket's local address via vectors involving inconsistencies     between Socket.getLocalAddress and InetAddress.getLocalHost.
     CVE-2013-2448     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.
    NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another     vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to     insufficient access restrictions and robustness of sound classes.
     CVE-2013-2450     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect availability via unknown vectors related to Serialization. NOTE: the previous     information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this     issue is related to improper handling of circular references in ObjectStreamClass.
     CVE-2013-2452     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability     than CVE-2013-2443 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has     not commented on claims from another vendor that this issue is related to network address handling in     virtual machine identifiers and the lack of unique and unpredictable IDs in the java.rmi.dgc.VMID     class.
     CVE-2013-2453     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier and 6 Update 45 and earlier allows remote attackers to affect integrity via vectors related to     JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from     another vendor that this issue is due to a missing check for package access by the MBeanServer     Introspector.
     CVE-2013-2455     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability     than CVE-2013-2443 and CVE-2013-2452. NOTE: the previous information is from the June 2013 CPU. Oracle has     not commented on claims from another vendor that this issue is related to incorrect access checks by the     (1) getEnclosingClass, (2) getEnclosingMethod, and (3) getEnclosingConstructor methods.
     CVE-2013-2456     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality via unknown vectors related to Serialization. NOTE: the previous     information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this     issue is related to improper access checks for subclasses in the ObjectOutputStream class.
     CVE-2013-2457     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June     2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect     implementation of certain class checks that allows remote attackers to bypass intended class     restrictions.
     CVE-2013-2459     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the     previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to integer     overflow checks.
     CVE-2013-2461     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is     from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows     remote attackers to bypass verification of XML signatures via vectors related to a Missing check for [a]     valid DOMCanonicalizationMethod canonicalization algorithm.
     CVE-2013-2463     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to Incorrect image     attribute verification in 2D.
     CVE-2013-2465     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to Incorrect image     channel verification in 2D.
     CVE-2013-2469     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to Incorrect image     layout verification in 2D.
     CVE-2013-2470     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to ImagingLib byte     lookup processing.
     CVE-2013-2471     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to Incorrect     IntegerComponentRaster size checks.
     CVE-2013-2472     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to Incorrect     ShortBandedRaster size checks in 2D.
     CVE-2013-2473     Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21     and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE:
    the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor     that this issue allows remote attackers to bypass the Java sandbox via vectors related to Incorrect     ByteBandedRaster size checks in 2D.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
69084	Debian DSA-2727-1 : openjdk-6 - several vulnerabilities	Nessus	Debian Local Security Checks	7/28/2013	3/29/2022	critical
69765	Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2013-207)	Nessus	Amazon Linux Local Security Checks	9/4/2013	3/29/2022	critical
78976	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1456) (ROBOT)	Nessus	Red Hat Local Security Checks	11/8/2014	12/5/2022	critical
291498	MiracleLinux 3 : java-1.6.0-openjdk-1.6.0.0-1.41.1.11.11.90.0.1.AXS3 (AXSA:2013-553:03)	Nessus	Miracle Linux Local Security Checks	1/19/2026	2/5/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical