IBM Java 1.5.0 was updated to SR11 which fixes bugs and security issues.

http://www.ibm.com/developerworks/java/jdk/alerts/

Also three bugs have been fixed :

  - fix bnc#771808: create symlink /usr/bin/javaws properly

  - fix bnc#666744: mark all configuration files as     %config(noreplace)

  - fix bnc#773021: add code removing fonts symlink to     baselibs.conf

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 9, which updates the Java version to 1.6.0_33.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

In addition, the Java browser plugin and Java Web Start are deactivated if they remain unused for 35 days or do not meet the criteria for minimum safe version.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0729 advisory.

  - OpenJDK: improper protection of CORBA data models (CORBA, 7079902) (CVE-2012-1711)

  - OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) (CVE-2012-1713)

  - OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) (CVE-2012-1716)

  - OpenJDK: insecure temporary file permissions (JRE, 7143606) (CVE-2012-1717)

  - OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) (CVE-2012-1718)

  - OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) (CVE-2012-1719)

  - OpenJDK: insufficient field accessibility checks (HotSpot, 7152811) (CVE-2012-1723)

  - OpenJDK: XML parsing infinite loop (JAXP, 7157609) (CVE-2012-1724)

  - OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) (CVE-2012-1725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1019 advisory.

    The Oracle Java 7 release includes the Oracle Java 7 Runtime Environment     and the Oracle Java 7 Software Development Kit.

    This update fixes several vulnerabilities in the Oracle Java 7 Runtime     Environment and the Oracle Java 7 Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE Critical     Patch page, listed in the References section. (CVE-2012-0551,     CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718,     CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724,     CVE-2012-1725, CVE-2012-1726)

    All users of java-1.7.0-oracle are advised to upgrade to these updated     packages, which provide Oracle Java 7 Update 5 and resolve these issues.
    All running instances of Oracle Java must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform.

  - CVE-2012-1711 CVE-2012-1719     Multiple errors in the CORBA implementation could lead     to breakouts of the Java sandbox.

  - CVE-2012-1713     Missing input sanitising in the font manager could lead     to the execution of arbitrary code.

  - CVE-2012-1716     The SynthLookAndFeel Swing class could be abused to     break out of the Java sandbox.

  - CVE-2012-1717     Several temporary files were created insecurely,     resulting in local information disclosure.

  - CVE-2012-1718     Certificate revocation lists were incorrectly     implemented.

  - CVE-2012-1723 CVE-2012-1725     Validation errors in the bytecode verifier of the     Hotspot VM could lead to breakouts of the Java sandbox.

  - CVE-2012-1724     Missing input sanitising in the XML parser could lead to     denial of service through an infinite loop.

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
64165	SuSE 11.2 Security Update : IBM Java (SAT Patch Number 6793)	Nessus	SuSE Local Security Checks	1/25/2013	1/19/2021	critical
78975	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)	Nessus	Red Hat Local Security Checks	11/8/2014	12/5/2022	critical
59463	Mac OS X : Java for Mac OS X 10.6 Update 9	Nessus	MacOS X Local Security Checks	6/13/2012	11/27/2023	critical
59489	RHEL 6 : java-1.6.0-openjdk (RHSA-2012:0729)	Nessus	Red Hat Local Security Checks	6/14/2012	4/27/2024	medium
59638	RHEL 6 : java-1.7.0-oracle (RHSA-2012:1019)	Nessus	Red Hat Local Security Checks	6/21/2012	11/4/2024	critical
59839	Debian DSA-2507-1 : openjdk-6 - several vulnerabilities	Nessus	Debian Local Security Checks	7/5/2012	3/8/2022	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	1/27/2014	5/22/2026	critical
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	6/30/2014	12/5/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

medium

critical

critical

critical

critical