The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

IBM Java 1.5.0 was updated to SR11 which fixes bugs and security issues.

http://www.ibm.com/developerworks/java/jdk/alerts/

Also three bugs have been fixed :

  - fix bnc#771808: create symlink /usr/bin/javaws properly

  - fix bnc#666744: mark all configuration files as     %config(noreplace)

  - fix bnc#773021: add code removing fonts symlink to     baselibs.conf

The version of VMware vCenter installed on the remote host is 4.0 earlier than Update 4a, 4.1 earlier than Update 3, or 5.0 earlier than Update 2.  As such, it is potentially affected by multiple vulnerabilities in the included Oracle (Sun) Java Runtime Environment.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 5 / 6 Update 33 / 5.0 Update 36 / 1.4.2_38 and is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Deployment
  - Hotspot
  - Swing
  - CORBA
  - Libraries
  - JAXP
  - Security
  - Networking
  - Java Runtime Environment

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0730 advisory.

  - OpenJDK: improper protection of CORBA data models (CORBA, 7079902) (CVE-2012-1711)

  - OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) (CVE-2012-1713)

  - OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) (CVE-2012-1716)

  - OpenJDK: insecure temporary file permissions (JRE, 7143606) (CVE-2012-1717)

  - OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) (CVE-2012-1718)

  - OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) (CVE-2012-1719)

  - OpenJDK: insufficient field accessibility checks (HotSpot, 7152811) (CVE-2012-1723)

  - OpenJDK: XML parsing infinite loop (JAXP, 7157609) (CVE-2012-1724)

  - OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) (CVE-2012-1725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were identified and fixed in OpenJDK (icedtea6) :

  - S7079902, CVE-2012-1711: Refine CORBA data models

    - S7143617, CVE-2012-1713: Improve fontmanager layout       lookup operations

    - S7143614, CVE-2012-1716: SynthLookAndFeel stability       improvement

    - S7143606, CVE-2012-1717: File.createTempFile should be       improved for temporary files created by the platform.

  - S7143872, CVE-2012-1718: Improve certificate extension     processing

    - S7143851, CVE-2012-1719: Improve IIOP stub and tie       generation in RMIC

    - S7152811, CVE-2012-1723: Issues in client compiler

    - S7157609, CVE-2012-1724: Issues with loop

    - S7160757, CVE-2012-1725: Problem with       hotspot/runtime_classfile

    - S7110720: Issue with vm config file loadingIssue with       vm config file loading

  - S7145239: Finetune package definition restriction

    - S7160677: missing else in fix for 7152811

The updated packages provides icedtea6-1.11.3 which is not vulnerable to these issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1009 advisory.

    These packages provide the OpenJDK 7 Java Runtime Environment and the     OpenJDK 7 Software Development Kit.

    Multiple flaws were discovered in the CORBA (Common Object Request Broker     Architecture) implementation in Java. A malicious Java application or     applet could use these flaws to bypass Java sandbox restrictions or modify     immutable object data. (CVE-2012-1711, CVE-2012-1719)

    It was discovered that the SynthLookAndFeel class from Swing did not     properly prevent access to certain UI elements from outside the current     application context. A malicious Java application or applet could use this     flaw to crash the Java Virtual Machine, or bypass Java sandbox     restrictions. (CVE-2012-1716)

    Multiple flaws were discovered in the font manager's layout lookup     implementation. A specially-crafted font file could cause the Java Virtual     Machine to crash or, possibly, execute arbitrary code with the privileges     of the user running the virtual machine. (CVE-2012-1713)

    Multiple flaws were found in the way the Java HotSpot Virtual Machine     verified the bytecode of the class file to be executed. A specially-crafted     Java application or applet could use these flaws to crash the Java Virtual     Machine, or bypass Java sandbox restrictions. (CVE-2012-1723,     CVE-2012-1725)

    It was discovered that java.lang.invoke.MethodHandles.Lookup did not     properly honor access modes. An untrusted Java application or applet could     use this flaw to bypass Java sandbox restrictions. (CVE-2012-1726)

    It was discovered that the Java XML parser did not properly handle certain     XML documents. An attacker able to make a Java application parse a     specially-crafted XML file could use this flaw to make the XML parser enter     an infinite loop. (CVE-2012-1724)

    It was discovered that the Java security classes did not properly handle     Certificate Revocation Lists (CRL). CRL containing entries with duplicate     certificate serial numbers could have been ignored. (CVE-2012-1718)

    It was discovered that various classes of the Java Runtime library could     create temporary files with insecure permissions. A local attacker could     use this flaw to gain access to the content of such temporary files.
    (CVE-2012-1717)

    This update also fixes the following bug:

    * Attempting to compile a SystemTap script using the jstack tapset could     have failed with an error similar to the following:

    error: the frame size of 272 bytes is larger than 256 bytes

    This update corrects the jstack tapset and resolves this issue. (BZ#833035)

    This erratum also upgrades the OpenJDK package to IcedTea7 2.2.1. Refer to     the NEWS file, linked to in the References, for further information.

    All users of java-1.7.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1009 advisory.

    [1.7.0.5-2.2.1.0.1.el6]
    - Modify DISTRO_NAME for Oracle

    [1.7.0.5-2.2.1.el6]
    - Updated priority to be > 17000 and to depend on buildver variable
    - Variable buildver increased to 5 as it should be
    - Resolves: rhbz#828759

    [1.7.0.3-2.2.1.el6]
    - Used newly prepared tarball with security fixes
    - Bump to icedtea7-forest-2.2.1
    - _mandir/man1/jcmd-name.1 added to alternatives
    - Updated rhino.patch
    - Updated java-1.7.0-openjdk-java-access-bridge-security.patch
    - Modified partially upstreamed patch302 - systemtap.patch
    - Temporarly disabled patch102 - java-1.7.0-openjdk-size_t.patch
    - Removed already upstreamed patches 104,108,109,301,110:
      - java-1.7.0-openjdk-arm-ftbfs.patch
      - java-1.7.0-openjdk-system-zlib.patch
      - java-1.7.0-openjdk-remove-mimpure-opt.patch
      - systemtap-alloc-size-workaround.patch
      - java-1.7.0-fix-gio-detection.patch
    - Access gnome bridge jar forced to be 644
    - Added patch303 - java-1.7.0-openjdk-jstack.patch which resolved RH804632 for openjdk6
    - Resolves: rhbz#828759

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	2014/1/27	2026/5/22	critical
62381	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 8284)	Nessus	SuSE Local Security Checks	2012/9/29	2021/1/19	critical
66806	VMware vCenter Multiple Vulnerabilities (VMSA-2012-0013)	Nessus	Misc.	2013/6/5	2022/3/8	critical
59462	Oracle Java SE Multiple Vulnerabilities (June 2012 CPU)	Nessus	Windows	2012/6/13	2022/4/11	critical
59490	RHEL 5 : java-1.6.0-openjdk (RHSA-2012:0730)	Nessus	Red Hat Local Security Checks	2012/6/14	2024/4/27	medium
59561	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2012:095)	Nessus	Mandriva Local Security Checks	2012/6/19	2022/3/8	critical
59637	RHEL 6 : java-1.7.0-openjdk (RHSA-2012:1009)	Nessus	Red Hat Local Security Checks	2012/6/21	2025/4/15	critical
68566	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2012-1009)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical

検出

プラグインの検索

critical

critical

critical

critical

medium

critical

critical

critical