Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

Oracle Java 6 Update 26 fixes several security vulnerabilities.

Please refer to Oracle's site for further information:
http://www.oracle.com/technetwork/topics/security/javacpujun e2011-313339.html

(CVE-2011-0862, CVE-2011-0873, CVE-2011-0815, CVE-2011-0817, CVE-2011-0863, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814, CVE-2011-0871, CVE-2011-0786, CVE-2011-0788, CVE-2011-0866, CVE-2011-0868, CVE-2011-0872, CVE-2011-0867, CVE-2011-0869, CVE-2011-0865)

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially affected by multiple vulnerabilities affecting the Java software running on the host.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 26 / 5.0 Update 30 / 1.4.2_32.  Such versions are potentially affected by security issues in the following components :

  - AWT
  - Deployment
  - Deserialization
  - Hotspot
  - Java Runtime Environment
  - Networking
  - NIO
  - SAAJ
  - Sound
  - Swing

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE Critical Patch Update Advisory' page (CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0864, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_26-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the following components :

  - TLS and SSL protocols
  - Apache Tomcat
  - Java
  - Flash Player
  - BlazeDS/GraniteDS
  - Adobe LiveCycle
  - Adobe Flex SDK
  - Systems Insight Manager

Oracle Java 6 Update 26 fixes several security vulnerabilities.

Please refer to Oracle's site for further information:
http://www.oracle.com/technetwork/topics/security/javacpujune2011-3133 39.html

IBM Java 1.6.0 SR9-FP2 fixes several of bugs and thew following security issues :

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     integrity via unknown vectors related to     Deserialization. (CVE-2011-0865)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Java Runtime     Environment. (CVE-2011-0866)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0788.
    (CVE-2011-0786)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0786.
    (CVE-2011-0788)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0786.
    (CVE-2011-0802)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote attackers to affect     confidentiality, integrity, and availability via unknown     vectors related to Sound, a different vulnerability than     CVE-2011-0802. (CVE-2011-0814)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to AWT. (CVE-2011-0815)

  - Multiple unspecified vulnerabilities in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allow remote attackers to affect     confidentiality, integrity, and availability via unknown     vectors related to 2D. (CVE-2011-0862)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality via unknown vectors related to     Networking. (CVE-2011-0867)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     26 and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality via unknown vectors related to SAAJ.
    (CVE-2011-0869)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment.
    (CVE-2011-0817)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to Deployment. (CVE-2011-0863)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote attackers to affect     confidentiality via unknown vectors related to 2D.
    (CVE-2011-0868)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to Swing. (CVE-2011-0871)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote attackers to affect     availability via unknown vectors related to NIO.
    (CVE-2011-0872)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, and 5.0 Update 29 and earlier, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to 2D.
    (CVE-2011-0873)

The remote host is affected by the vulnerability described in GLSA-201111-02 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below and       the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause       unspecified impact, possibly including remote execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0938 advisory.

  - Oracle/IBM JDK: unspecified vulnerabilities fixed in 6u26 (Sound) (CVE-2011-0802, CVE-2011-0814)

  - OpenJDK: integer overflows in JPEGImageReader and font SunLayoutEngine (2D, 7013519) (CVE-2011-0862)

  - Oracle/IBM JDK: unspecified vulnerability fixed in 6u26 (Deployment) (CVE-2011-0863)

  - OpenJDK: Deserialization allows creation of mutable SignedObject (Deserialization, 6618658)     (CVE-2011-0865)

  - OpenJDK: NetworkInterface information leak (Networking, 7013969) (CVE-2011-0867)

  - OpenJDK: incorrect numeric type conversion in TransformHelper (2D, 7016495) (CVE-2011-0868)

  - OpenJDK: unprivileged proxy settings change via SOAPConnection (SAAJ, 7013971) (CVE-2011-0869)

  - OpenJDK: MediaTracker created Component instances with unnecessary privileges (Swing, 7020198)     (CVE-2011-0871)

  - Oracle/IBM JDK: unspecified vulnerability fixed in 6u26 (2D) (CVE-2011-0873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 5, which updates the Java version to 1.6.0_26.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 10, which updates the Java version to 1.6.0_26 / 1.5.0_30.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

Updated java-1.6.0-sun packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE Critical Patch Update Advisory' page, listed in the References section. (CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0864, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873)

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide JDK and JRE 6 Update 26 and resolve these issues. All running instances of Sun Java must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
78975	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)	Nessus	Red Hat Local Security Checks	critical
75873	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0633-1)	Nessus	SuSE Local Security Checks	critical
75542	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0633-1)	Nessus	SuSE Local Security Checks	critical
69874	Juniper NSM Servers Multiple Java JDK/JRE Vulnerabilities (PSN-2012-08-689)	Nessus	Misc.	critical
64845	Oracle Java SE Multiple Vulnerabilities (June 2011 CPU) (Unix)	Nessus	Misc.	critical
61071	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
59684	HP Systems Insight Manager < 7.0 Multiple Vulnerabilities	Nessus	Windows	critical
57211	SuSE 10 Security Update : Sun/Oracle Java (ZYPP Patch Number 7569)	Nessus	SuSE Local Security Checks	critical
57210	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7627)	Nessus	SuSE Local Security Checks	critical
56724	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
55622	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7626)	Nessus	SuSE Local Security Checks	critical
55619	SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4875)	Nessus	SuSE Local Security Checks	critical
55598	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2011:0938)	Nessus	Red Hat Local Security Checks	critical
55459	Mac OS X : Java for Mac OS X 10.6 Update 5	Nessus	MacOS X Local Security Checks	critical
55458	Mac OS X : Java for Mac OS X 10.5 Update 10	Nessus	MacOS X Local Security Checks	critical
55137	SuSE 11.1 Security Update : Sun/Oracle Java (SAT Patch Number 4698)	Nessus	SuSE Local Security Checks	critical
55014	RHEL 4 / 5 / 6 : java-1.6.0-sun (RHSA-2011:0860)	Nessus	Red Hat Local Security Checks	critical
54997	Oracle Java SE Multiple Vulnerabilities (June 2011 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2011-0863

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical