Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. Detailed vulnerability descriptions are linked from the IBM 'Security alerts' page, listed in the References section. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4471, CVE-2010-4473, CVE-2010-4475)

Note: The RHSA-2010:0987 and RHSA-2011:0290 java-1.6.0-ibm errata were missing 64-bit PowerPC packages for Red Hat Enterprise Linux 4 Extras.
This erratum provides 64-bit PowerPC packages for Red Hat Enterprise Linux 4 Extras as expected.

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR9-FP1 Java release. All running instances of IBM Java must be restarted for the update to take effect.

IBM Java 6 SR9 FP1 was updated to fix a critical security bug in float number handling :

  - The Java Runtime Environment hangs forever when     converting '2.2250738585072012e-308' to a binary     floating-point number. (CVE-2010-4476)

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 9.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 4.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

Following CVEs were addressed: CVE-2010-4452 CVE-2010-4454 CVE-2010-4462 CVE-2010-4463 CVE-2010-4465 CVE-2010-4467 CVE-2010-4469 CVE-2010-4473 CVE-2010-4422 CVE-2010-4451 CVE-2010-4466 CVE-2010-4470 CVE-2010-4471 CVE-2010-4476 CVE-2010-4447 CVE-2010-4475 CVE-2010-4468 CVE-2010-4450 CVE-2010-4448 CVE-2010-4472 CVE-2010-4474

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 24 / 5.0 Update 28 / 1.4.2_30. Such versions are potentially affected by security issue in the following components :

  - Deployment
  - HotSpot
  - Install
  - JAXP
  - Java Language
  - JDBC
  - Launcher
  - Networking
  - Security
  - Sound
  - Swing
  - XML Digital Signature
  - 2D

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

The following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues.

The update is rated critical by Sun.

Following CVEs were addressed :

CVE-2010-4452 / CVE-2010-4454 / CVE-2010-4462 / CVE-2010-4463 / CVE-2010-4465 / CVE-2010-4467 / CVE-2010-4469 / CVE-2010-4473 / CVE-2010-4422 / CVE-2010-4451 / CVE-2010-4466 / CVE-2010-4470 / CVE-2010-4471 / CVE-2010-4476 / CVE-2010-4447 / CVE-2010-4475 / CVE-2010-4468 / CVE-2010-4450 / CVE-2010-4448 / CVE-2010-4472 / CVE-2010-4474

This update fixes several vulnerabilities in the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 24 / 5.0 Update 28 / 1.4.2_30.  Such versions are potentially affected by security issues in the following components :

  - Deployment
  - HotSpot
  - Install
  - JAXP
  - Java Language
  - JDBC
  - Launcher
  - Networking
  - Security
  - Sound
  - Swing
  - XML Digital Signature
  - 2D

Updated java-1.6.0-sun packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page, listed in the References section. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which resolve these issues. All running instances of Sun Java must be restarted for the update to take effect.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite 5.4.1. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment. Detailed vulnerability descriptions are linked from the IBM 'Security alerts' page, listed in the References section.
(CVE-2009-3555, CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3553, CVE-2010-3555, CVE-2010-3556, CVE-2010-3557, CVE-2010-3558, CVE-2010-3560, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565, CVE-2010-3566, CVE-2010-3568, CVE-2010-3569, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574, CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4471, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

Users of Red Hat Network Satellite 5.4.1 are advised to upgrade to these updated java-1.6.0-ibm packages, which contain the IBM 1.6.0 SR9-FP1 Java release. For this update to take effect, Red Hat Network Satellite must be restarted. Refer to the Solution section for details.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Java Runtime Environment (JRE)
  - libuser
  - Netscape Portable Runtime (NSPR) 
  - Network Security Services (NSS)
  - OpenSSL

a. ESX third-party update for Service Console openssl RPM

   The Service Console openssl RPM is updated to    openssl-0.9.8e.12.el5_5.7 resolving two security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-7270 and CVE-2010-4180 to these    issues.
   b. ESX third-party update for Service Console libuser RPM     The Service Console libuser RPM is updated to version    0.54.7-2.1.el5_5.2 to resolve a security issue.
     The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2011-0002 to this issue.
  c. ESX third-party update for Service Console nss and nspr RPMs     The Service Console Network Security Services (NSS) and Netscape    Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1    and nss-3.12.8-4 resolving multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3170 and CVE-2010-3173 to these    issues.
  d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24

   Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454,    CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466,    CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470,    CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474,    CVE-2010-4475 and CVE-2010-4476.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548,    CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552,    CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556,    CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560,    CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565,    CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569,    CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and    CVE-2010-3574.
  e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30

   Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873,    CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814,    CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465,    CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473,    CVE-2010-4475, CVE-2010-4476.

f. Integer overflow in VMware third-party component sfcb

   This release resolves an integer overflow issue present in the    third-party library SFCB when the httpMaxContentLength has been    changed from its default value to 0 in in /etc/sfcb/sfcb.cfg.
   The integer overflow could allow remote attackers to cause a    denial of service (heap memory corruption) or possibly execute    arbitrary code via a large integer in the Content-Length HTTP    header.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2054 to this issue.

The remote host is affected by the vulnerability described in GLSA-201111-02 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below and       the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause       unspecified impact, possibly including remote execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
52701	RHEL 4 / 5 / 6 : java-1.6.0-ibm (RHSA-2011:0357)	Nessus	Red Hat Local Security Checks	2011/03/17	2021/01/14	critical
52752	SuSE 10 Security Update : java-1_6_0-ibm, java-1_6_0-ibm-32bit, java-1_6_0-ibm-64bit, java-1_6_0-ibm-alsa, java-1_6_0-ibm-alsa-32bit, java-1_6_0-ibm-demo, java-1_6_0-ibm-devel, java-1_6_0-ibm-devel-32bit, java-1_6_0-ibm-fonts, java-1_6_0-ibm-jdbc, java-1_6_0-ibm-jdbc-32bit, java-1_6_0-ibm-jdbc-64bit, java-1_6_0-ibm-plugin, java-1_6_0-ibm-plugin-32bit, java-1_6_0-ibm-src (ZYPP Patch Number 7369)	Nessus	SuSE Local Security Checks	2011/03/22	2021/01/19	critical
52751	SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4109)	Nessus	SuSE Local Security Checks	2011/03/22	2021/01/19	critical
52587	Mac OS X : Java for Mac OS X 10.5 Update 9	Nessus	MacOS X Local Security Checks	2011/03/09	2018/07/14	high
52588	Mac OS X : Java for Mac OS X 10.6 Update 4	Nessus	MacOS X Local Security Checks	2011/03/09	2018/07/14	high
75541	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0126-1)	Nessus	SuSE Local Security Checks	2014/06/13	2021/01/14	critical
52002	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU)	Nessus	Windows	2011/02/16	2018/11/15	critical
52067	SuSE 11.1 Security Update : Sun Java 1.6 (SAT Patch Number 3976)	Nessus	SuSE Local Security Checks	2011/02/23	2021/01/19	critical
52068	SuSE 10 Security Update : IBM Java 1.6 (ZYPP Patch Number 7342)	Nessus	SuSE Local Security Checks	2011/02/23	2021/01/19	critical
75872	openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-4147)	Nessus	SuSE Local Security Checks	2014/06/13	2021/01/14	critical
60964	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/08/01	2021/01/14	critical
64844	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU) (Unix)	Nessus	Misc.	2013/02/22	2018/11/15	critical
52021	RHEL 4 / 5 / 6 : java-1.6.0-sun (RHSA-2011:0282)	Nessus	Red Hat Local Security Checks	2011/02/18	2021/01/14	critical
53736	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0126-1)	Nessus	SuSE Local Security Checks	2011/05/05	2021/01/14	critical
63983	RHEL 5 : IBM Java Runtime (RHSA-2011:0880)	Nessus	Red Hat Local Security Checks	2013/01/24	2021/01/14	critical
89681	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)	Nessus	Misc.	2016/03/04	2021/01/06	critical
56665	VMSA-2011-0013 : VMware third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2011/10/28	2021/01/06	critical
56724	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2011/11/07	2021/01/06	critical

Plugins Search