The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0770 advisory.

    [1:1.6.0.0-1.61.1.11.11]
    - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
     - fixing regression in fonts introduced by one security patch.
    - Resolves: rhbz#950386

    [1:1.6.0.0-1.60.1.11.11]
    - added and applied (temporally) one more patch to xalan/xerces privileges
     - patch9 jaxp-backport-factoryfinder.patch
    - will be upstreamed
    - Resolves: rhbz#950386

    [1:1.6.0.0-1.59.1.11.11]
    - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges
    - removed patch 8 -  removingOfAarch64.patch.patch - fixed upstream
    - Resolves: rhbz#950386

    [1:1.6.0.0-1.58.1.11.10]
    - Updated to icedtea6 1.11.10
    - rewritten java-1.6.0-openjdk-java-access-bridge-security.patch
    - excluded aarch64.patch
      - by patch 8 -  removingOfAarch64.patch.patch
    - Resolves: rhbz#950386

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This is an update for icu. Unfortunately, one of the fixes adds a new virtual function to LayoutEngine class, breaking ABI. So dependent packages have to be updated too.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0752 advisory.

    These packages provide the OpenJDK 7 Java Runtime Environment and the     OpenJDK 7 Software Development Kit.

    Multiple flaws were discovered in the font layout engine in the 2D     component. An untrusted Java application or applet could possibly use these     flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-1569,     CVE-2013-2383, CVE-2013-2384)

    Multiple improper permission check issues were discovered in the Beans,     Libraries, JAXP, and RMI components in OpenJDK. An untrusted Java     application or applet could use these flaws to bypass Java sandbox     restrictions. (CVE-2013-1558, CVE-2013-2422, CVE-2013-2436, CVE-2013-1518,     CVE-2013-1557)

    The previous default value of the java.rmi.server.useCodebaseOnly property     permitted the RMI implementation to automatically load classes from     remotely specified locations. An attacker able to connect to an application     using RMI could use this flaw to make the application execute arbitrary     code. (CVE-2013-1537)

    Note: The fix for CVE-2013-1537 changes the default value of the property     to true, restricting class loading to the local CLASSPATH and locations     specified in the java.rmi.server.codebase property. Refer to Red Hat     Bugzilla bug 952387 for additional details.

    The 2D component did not properly process certain images. An untrusted Java     application or applet could possibly use this flaw to trigger Java Virtual     Machine memory corruption. (CVE-2013-2420)

    It was discovered that the Hotspot component did not properly handle     certain intrinsic frames, and did not correctly perform access checks and     MethodHandle lookups. An untrusted Java application or applet could     use these flaws to bypass Java sandbox restrictions. (CVE-2013-2431,     CVE-2013-2421, CVE-2013-2423)

    It was discovered that JPEGImageReader and JPEGImageWriter in the ImageIO     component did not protect against modification of their state while     performing certain native code operations. An untrusted Java application or     applet could possibly use these flaws to trigger Java Virtual Machine     memory corruption. (CVE-2013-2429, CVE-2013-2430)

    The JDBC driver manager could incorrectly call the toString() method in     JDBC drivers, and the ConcurrentHashMap class could incorrectly call the     defaultReadObject() method. An untrusted Java application or applet could     possibly use these flaws to bypass Java sandbox restrictions.
    (CVE-2013-1488, CVE-2013-2426)

    The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly     invoke the system class loader. An untrusted Java application or applet     could possibly use this flaw to bypass certain Java sandbox restrictions.
    (CVE-2013-0401)

    Flaws were discovered in the Network component's InetAddress serialization,     and the 2D component's font handling. An untrusted Java application or     applet could possibly use these flaws to crash the Java Virtual Machine.
    (CVE-2013-2417, CVE-2013-2419)

    The MBeanInstantiator class implementation in the OpenJDK JMX component did     not properly check class access before creating new instances. An untrusted     Java application or applet could use this flaw to create instances of     non-public classes. (CVE-2013-2424)

    It was discovered that JAX-WS could possibly create temporary files with     insecure permissions. A local attacker could use this flaw to access     temporary files created by an application using JAX-WS. (CVE-2013-2415)

    This erratum also upgrades the OpenJDK package to IcedTea7 2.3.9. Refer to     the NEWS file, linked to in the References, for further information.

    All users of java-1.7.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit.

Multiple flaws were discovered in the font layout engine in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption.
(CVE-2013-1569, CVE-2013-2383, CVE-2013-2384)

Multiple improper permission check issues were discovered in the Beans, Libraries, JAXP, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-1558, CVE-2013-2422, CVE-2013-2436, CVE-2013-1518, CVE-2013-1557)

The previous default value of the java.rmi.server.useCodebaseOnly property permitted the RMI implementation to automatically load classes from remotely specified locations. An attacker able to connect to an application using RMI could use this flaw to make the application execute arbitrary code. (CVE-2013-1537)

Note: The fix for CVE-2013-1537 changes the default value of the property to true, restricting class loading to the local CLASSPATH and locations specified in the java.rmi.server.codebase property. Refer to Red Hat Bugzilla bug 952387 for additional details.

The 2D component did not properly process certain images. An untrusted Java application or applet could possibly use this flaw to trigger Java Virtual Machine memory corruption. (CVE-2013-2420)

It was discovered that the Hotspot component did not properly handle certain intrinsic frames, and did not correctly perform access checks and MethodHandle lookups. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2013-2431, CVE-2013-2421, CVE-2013-2423)

It was discovered that JPEGImageReader and JPEGImageWriter in the ImageIO component did not protect against modification of their state while performing certain native code operations. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. (CVE-2013-2429, CVE-2013-2430)

The JDBC driver manager could incorrectly call the toString() method in JDBC drivers, and the ConcurrentHashMap class could incorrectly call the defaultReadObject() method. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. (CVE-2013-1488, CVE-2013-2426)

The sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2013-0401)

Flaws were discovered in the Network component's InetAddress serialization, and the 2D component's font handling. An untrusted Java application or applet could possibly use these flaws to crash the Java Virtual Machine. (CVE-2013-2417, CVE-2013-2419)

The MBeanInstantiator class implementation in the OpenJDK JMX component did not properly check class access before creating new instances. An untrusted Java application or applet could use this flaw to create instances of non-public classes. (CVE-2013-2424)

It was discovered that JAX-WS could possibly create temporary files with insecure permissions. A local attacker could use this flaw to access temporary files created by an application using JAX-WS.
(CVE-2013-2415)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

This erratum also upgrades the OpenJDK package to IcedTea7 2.3.9.
Refer to the NEWS file, linked to in the References, for further information.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2013-0401, CVE-2013-0402, CVE-2013-1488, CVE-2013-1491, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2436, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440)

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 21 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0823 advisory.

    IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2013-0169, CVE-2013-0401,     CVE-2013-1491, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563,     CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2417,     CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424,     CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435,     CVE-2013-2440)

    All users of java-1.6.0-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 6 SR13-FP2 release. All running     instances of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has a version of IBM Domino (formerly Lotus Domino) 9.x prior to 9.0.1 installed. It is, therefore, reportedly affected by the following vulnerabilities :

  - The included version of the IBM Java SDK contains a     version of IBM JRE that contains numerous security     issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436,     CVE-2013-2455, CVE-2013-3006, CVE-2013-3007,     CVE-2013-3008, CVE-2013-3009, CVE-2013-3010,     CVE-2013-3011, CVE-2013-3012)

  - An input validation error exists related to handling     content in email messages that could allow cross-site     scripting attacks. (CVE-2013-4063)

  - An input validation error exists related to iNotes when     running in 'ultra-light' mode that could allow cross-     site scripting attacks. (CVE-2013-4064)

  - An input validation error exists related to handling     content in email messages and iNotes when running in     'ultra-light' mode that could allow cross-site     scripting attacks. (CVE-2013-4065)

  - Note that fixes in the Oracle Java CPUs for February,     April and June 2013 are included in the fixed IBM Java     release, which is included in the fixed IBM Domino     release. (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342,     CVE-2013-0351, CVE-2013-0401, CVE-2013-0402,     CVE-2013-0409, CVE-2013-0419, CVE-2013-0423,     CVE-2013-0424, CVE-2013-0425, CVE-2013-0426,     CVE-2013-0427, CVE-2013-0428, CVE-2013-0429,     CVE-2013-0430, CVE-2013-0431, CVE-2013-0432,     CVE-2013-0433, CVE-2013-0434, CVE-2013-0435,     CVE-2013-0437, CVE-2013-0438, CVE-2013-0440,     CVE-2013-0441, CVE-2013-0442, CVE-2013-0443,     CVE-2013-0444, CVE-2013-0445, CVE-2013-0446,     CVE-2013-0448, CVE-2013-0449, CVE-2013-0450,     CVE-2013-1473, CVE-2013-1475, CVE-2013-1476,     CVE-2013-1478, CVE-2013-1479, CVE-2013-1480,     CVE-2013-1481, CVE-2013-1488, CVE-2013-1489,     CVE-2013-1491, CVE-2013-1500, CVE-2013-1518,     CVE-2013-1537, CVE-2013-1540, CVE-2013-1557,     CVE-2013-1558, CVE-2013-1561, CVE-2013-1563,     CVE-2013-1564, CVE-2013-1569, CVE-2013-1571,     CVE-2013-2383, CVE-2013-2384, CVE-2013-2394,     CVE-2013-2400, CVE-2013-2407, CVE-2013-2412,     CVE-2013-2414, CVE-2013-2415, CVE-2013-2416,     CVE-2013-2417, CVE-2013-2418, CVE-2013-2419,     CVE-2013-2420, CVE-2013-2421, CVE-2013-2422,     CVE-2013-2423, CVE-2013-2424, CVE-2013-2425,     CVE-2013-2426, CVE-2013-2427, CVE-2013-2428,     CVE-2013-2429, CVE-2013-2430, CVE-2013-2431,     CVE-2013-2432, CVE-2013-2433, CVE-2013-2434,     CVE-2013-2435, CVE-2013-2437, CVE-2013-2438,     CVE-2013-2439, CVE-2013-2440, CVE-2013-2442,     CVE-2013-2443, CVE-2013-2444, CVE-2013-2445,     CVE-2013-2446, CVE-2013-2447, CVE-2013-2448,     CVE-2013-2449, CVE-2013-2450, CVE-2013-2451,     CVE-2013-2452, CVE-2013-2453, CVE-2013-2454,     CVE-2013-2456, CVE-2013-2457, CVE-2013-2458,     CVE-2013-2459, CVE-2013-2460, CVE-2013-2461,     CVE-2013-2462, CVE-2013-2463, CVE-2013-2464,     CVE-2013-2465, CVE-2013-2466, CVE-2013-2467,     CVE-2013-2468, CVE-2013-2469, CVE-2013-2470,     CVE-2013-2471, CVE-2013-2472, CVE-2013-2473,     CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)

ID	Name	Product	Family	Published	Updated	Severity
68815	Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2013-0770)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
69202	Fedora 18 : fontmatrix-0.9.99-9.r1218.fc18 / icu-49.1.1-10.fc18 / libreoffice-3.6.7.2-3.fc18 / etc (2013-13479)	Nessus	Fedora Local Security Checks	8/5/2013	1/11/2021	critical
66014	RHEL 5 : java-1.7.0-openjdk (RHSA-2013:0752)	Nessus	Red Hat Local Security Checks	4/18/2013	11/4/2024	critical
66027	CentOS 6 : java-1.7.0-openjdk (CESA-2013:0751)	Nessus	CentOS Local Security Checks	4/19/2013	5/25/2022	critical
66029	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:0757)	Nessus	Red Hat Local Security Checks	4/19/2013	5/25/2022	critical
66440	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2013:0823)	Nessus	Red Hat Local Security Checks	5/15/2013	11/4/2024	critical
71861	IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	1/8/2014	5/25/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical