Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 20.  Such versions are potentially missing critical security updates.

As a result, the remote host could be affected by multiple vulnerabilities.

This update fixes two vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Security Alert page listed in the References section. (CVE-2010-0886, CVE-2010-0887)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

Oracle has released JRE 6 Update 20 in order to fix potential remote code execution vulnerabilities (CVE-2010-0887). Please refer to Oracle's site for more information:
http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010
-0886.html

Updated java-1.6.0-ibm packages that fix one security issue are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes one vulnerability in the IBM Java 2 Runtime Environment. This vulnerability is summarized on the IBM 'Security alerts' page listed in the References section. (CVE-2010-0887)

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR8-FP1 Java release. All running instances of IBM Java must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201006-18 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java     implementation. Please review the CVE identifiers referenced below and     the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause     unspecified impact, possibly including remote execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 2.

The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 7.

The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.

Updated java-1.6.0-sun packages that fix two security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes two vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Security Alert page listed in the References section. (CVE-2010-0886, CVE-2010-0887)

Users of java-1.6.0-sun should upgrade to these updated packages, which correct these issues. All running instances of Sun Java must be restarted for the update to take effect.

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) installed on the remote host is earlier than 6 Update 20.  Such versions are potentially missing critical security updates.

ID	Name	Product	Family	Severity
64837	Oracle Java JDK / JRE 6 < Update 20 Multiple Vulnerabilities (Unix)	Nessus	Misc.	critical
60782	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
50918	SuSE 11 Security Update : Sun Java 1.6.0 (SAT Patch Number 2340)	Nessus	SuSE Local Security Checks	critical
47882	RHEL 4 / 5 : java-1.6.0-ibm (RHSA-2010:0549)	Nessus	Red Hat Local Security Checks	critical
46807	GLSA-201006-18 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
46674	Mac OS X : Java for Mac OS X 10.6 Update 2	Nessus	MacOS X Local Security Checks	critical
46673	Mac OS X : Java for Mac OS X 10.5 Update 7	Nessus	MacOS X Local Security Checks	critical
46300	RHEL 4 / 5 : java-1.6.0-sun (RHSA-2010:0356)	Nessus	Red Hat Local Security Checks	critical
45606	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0140-1)	Nessus	SuSE Local Security Checks	critical
45605	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0140-1)	Nessus	SuSE Local Security Checks	critical
45604	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2010:0140-1)	Nessus	SuSE Local Security Checks	critical
45544	Oracle Java JDK / JRE 6 < Update 20 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2010-0887

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical