The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0408 advisory.

    [1:1.6.0.1-5.1.13.3]
    - updated to icedtea 1.13.3
    - updated to openjdk-6-src-b31-15_apr_2014
    - renmoved upstreamed patch7, 1.13_fixes.patch
    - Resolves: rhbz#1085009

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

BM Java 6 was updated to version 6 SR16 to fix several security issues and various other bugs.

More information can be found at:
http://www.ibm.com/developerworks/java/jdk/alerts/

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities :

  - There is an information disclosure flaw in libjpeg and     libjpeg-turbo allowing remote attackers access to     uninitialized memory via crafted JPEG images.
    (CVE-2013-6629)

  - A vulnerability in libpng allows denial of service     attacks via a flaw in pngtran.c pngset.c.
    (CVE-2013-6954)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in 2D image handling.
    (CVE-2014-0429, CVE-2014-2401, CVE-2014-2421)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in logger handling.
    (CVE-2014-0446)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in the Deployment subcomponent.
    (CVE-2014-0448, CVE-2014-0449, CVE-2014-2409,     CVE-2014-2420, CVE-2014-2428)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in AWT.
    (CVE-2014-0451, CVE-2014-2412)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in     W3CEndpointReference.java. (CVE-2014-0452)

  - An information disclosure vulnerability in Oracle Java     RSAPadding allows a remote attacker to view timing     information protected by encryption. (CVE-2014-0452)

  - A vulnerability in Oracle Java allows a remote attacker     to modify the SIGNATURE_PRIMITIVE_SET through flaws in     SignatureAndHalshAlgorithm and AlgorithmChecker.
    (CVE-2014-0454)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in MethodHandles.java.
    (CVE-2014-0455)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in exception handling.
    (CVE-2014-0457)

  - Vulnerabilities in Oracle Java allow a remote attacker     to bypass security features through flaws in JAX-WS.
    (CVE-2014-0458, CVE-2014-2423)

  - An unspecified vulnerability exists in Oracle Java     via sandboxed applications.
    (CVE-2014-0459)

  - A vulnerability in Oracle Java allows remote attackers     to conduct spoofing attacks via a flaw in the DnsClient     component. (CVE-2014-0460)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in ScriptEngineManager.java.
    (CVE-2014-0461)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the random     number generation of cryptographic protection.
    (CVE-2014-0878)

  - A privilege escalation vulnerability in Oracle Java     allows remote attacks to overwrite arbitrary files     via a flaw in unpack200. (CVE-2014-1876)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in Javadoc. (CVE-2014-2398)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in     asynchronous channel handling across threads.
    (CVE-2014-2402)

  - Vulnerabilities in Oracle Java allow a remote attacker     to bypass security features through flaws in JAXB.
    (CVE-2014-2414)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in Java sound     libraries. (CVE-2014-2427)

ID	Name	Product	Family	Published	Updated	Severity
73584	Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2014-0408)	Nessus	Oracle Linux Local Security Checks	4/17/2014	10/22/2024	critical
73868	Debian DSA-2923-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	5/6/2014	1/11/2021	critical
74284	SuSE 11.3 Security Update : IBM Java 6 (SAT Patch Number 9256)	Nessus	SuSE Local Security Checks	6/3/2014	1/19/2021	critical
76870	AIX Java Advisory : java_apr2014_advisory.asc	Nessus	AIX Local Security Checks	7/28/2014	4/21/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical