Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Java Runtime Environment (JRE)
  - libuser
  - Netscape Portable Runtime (NSPR) 
  - Network Security Services (NSS)
  - OpenSSL

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

Oracle Java 6 Update 26 fixes several security vulnerabilities.

Please refer to Oracle's site for further information:
http://www.oracle.com/technetwork/topics/security/javacpujun e2011-313339.html

(CVE-2011-0862, CVE-2011-0873, CVE-2011-0815, CVE-2011-0817, CVE-2011-0863, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814, CVE-2011-0871, CVE-2011-0786, CVE-2011-0788, CVE-2011-0866, CVE-2011-0868, CVE-2011-0872, CVE-2011-0867, CVE-2011-0869, CVE-2011-0865)

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially affected by multiple vulnerabilities affecting the Java software running on the host.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 6 Update 26 / 5.0 Update 30 / 1.4.2_32.  Such versions are potentially affected by security issues in the following components :

  - AWT
  - Deployment
  - Deserialization
  - Hotspot
  - Java Runtime Environment
  - Networking
  - NIO
  - SAAJ
  - Sound
  - Swing

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE Critical Patch Update Advisory' page (CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0864, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_26-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the following components :

  - TLS and SSL protocols
  - Apache Tomcat
  - Java
  - Flash Player
  - BlazeDS/GraniteDS
  - Adobe LiveCycle
  - Adobe Flex SDK
  - Systems Insight Manager

Oracle Java 6 Update 26 fixes several security vulnerabilities.

Please refer to Oracle's site for further information:
http://www.oracle.com/technetwork/topics/security/javacpujune2011-3133 39.html

IBM Java 1.6.0 SR9-FP2 fixes several of bugs and thew following security issues :

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     integrity via unknown vectors related to     Deserialization. (CVE-2011-0865)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Java Runtime     Environment. (CVE-2011-0866)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0788.
    (CVE-2011-0786)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0786.
    (CVE-2011-0788)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0786.
    (CVE-2011-0802)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote attackers to affect     confidentiality, integrity, and availability via unknown     vectors related to Sound, a different vulnerability than     CVE-2011-0802. (CVE-2011-0814)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to AWT. (CVE-2011-0815)

  - Multiple unspecified vulnerabilities in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allow remote attackers to affect     confidentiality, integrity, and availability via unknown     vectors related to 2D. (CVE-2011-0862)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality via unknown vectors related to     Networking. (CVE-2011-0867)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     26 and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality via unknown vectors related to SAAJ.
    (CVE-2011-0869)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment.
    (CVE-2011-0817)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to Deployment. (CVE-2011-0863)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote attackers to affect     confidentiality via unknown vectors related to 2D.
    (CVE-2011-0868)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to Swing. (CVE-2011-0871)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote attackers to affect     availability via unknown vectors related to NIO.
    (CVE-2011-0872)

  - An unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, and 5.0 Update 29 and earlier, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to 2D.
    (CVE-2011-0873)

IBM Java 1.5.0 SR12 FP5 has been released fixing bugs and security issues.

The following security issues were fixed :

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     integrity via unknown vectors related to     Deserialization. (CVE-2011-0865)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Java Runtime     Environment. (CVE-2011-0866)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, when running on Windows, allows remote     untrusted Java Web Start applications and untrusted Java     applets to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment,     a different vulnerability than CVE-2011-0786.
    (CVE-2011-0802)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote attackers to affect     confidentiality, integrity, and availability via unknown     vectors related to Sound, a different vulnerability than     CVE-2011-0802. (CVE-2011-0814)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to AWT. (CVE-2011-0815)

  - Multiple unspecified vulnerabilities in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allow remote attackers to affect     confidentiality, integrity, and availability via unknown     vectors related to 2D. (CVE-2011-0862)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality via unknown vectors related to     Networking. (CVE-2011-0867)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31     and earlier allows remote untrusted Java Web Start     applications and untrusted Java applets to affect     confidentiality, integrity, and availability via unknown     vectors related to Swing. (CVE-2011-0871)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier allows remote attackers to affect     availability via unknown vectors related to NIO.
    (CVE-2011-0872)

  - Unspecified vulnerability in the Java Runtime     Environment (JRE) component in Oracle Java SE 6 Update     25 and earlier, and 5.0 Update 29 and earlier, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to 2D.
    (CVE-2011-0873)

The remote host is affected by the vulnerability described in GLSA-201111-02 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below and       the associated Oracle Critical Patch Update Advisory for details.
  Impact :

    A remote attacker could exploit these vulnerabilities to cause       unspecified impact, possibly including remote execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

a. ESX third-party update for Service Console openssl RPM

   The Service Console openssl RPM is updated to    openssl-0.9.8e.12.el5_5.7 resolving two security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-7270 and CVE-2010-4180 to these    issues.
   b. ESX third-party update for Service Console libuser RPM     The Service Console libuser RPM is updated to version    0.54.7-2.1.el5_5.2 to resolve a security issue.
     The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2011-0002 to this issue.
  c. ESX third-party update for Service Console nss and nspr RPMs     The Service Console Network Security Services (NSS) and Netscape    Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1    and nss-3.12.8-4 resolving multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3170 and CVE-2010-3173 to these    issues.
  d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24

   Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454,    CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466,    CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470,    CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474,    CVE-2010-4475 and CVE-2010-4476.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548,    CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552,    CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556,    CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560,    CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565,    CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569,    CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and    CVE-2010-3574.
  e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30

   Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873,    CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814,    CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448,    CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465,    CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473,    CVE-2010-4475, CVE-2010-4476.

f. Integer overflow in VMware third-party component sfcb

   This release resolves an integer overflow issue present in the    third-party library SFCB when the httpMaxContentLength has been    changed from its default value to 0 in in /etc/sfcb/sfcb.cfg.
   The integer overflow could allow remote attackers to cause a    denial of service (heap memory corruption) or possibly execute    arbitrary code via a large integer in the Content-Length HTTP    header.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2054 to this issue.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1087 advisory.

    The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and     the IBM Java 2 Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java 2 Runtime     Environment and the IBM Java 2 Software Development Kit. Detailed     vulnerability descriptions are linked from the IBM Security alerts page,     listed in the References section. (CVE-2011-0802, CVE-2011-0814,     CVE-2011-0862, CVE-2011-0865, CVE-2011-0867, CVE-2011-0871, CVE-2011-0873)

    All users of java-1.5.0-ibm are advised to upgrade to these updated     packages, containing the IBM 1.5.0 SR12-FP5 Java release. All running     instances of IBM Java must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0938 advisory.

  - Oracle/IBM JDK: unspecified vulnerabilities fixed in 6u26 (Sound) (CVE-2011-0802, CVE-2011-0814)

  - OpenJDK: integer overflows in JPEGImageReader and font SunLayoutEngine (2D, 7013519) (CVE-2011-0862)

  - Oracle/IBM JDK: unspecified vulnerability fixed in 6u26 (Deployment) (CVE-2011-0863)

  - OpenJDK: Deserialization allows creation of mutable SignedObject (Deserialization, 6618658)     (CVE-2011-0865)

  - OpenJDK: NetworkInterface information leak (Networking, 7013969) (CVE-2011-0867)

  - OpenJDK: incorrect numeric type conversion in TransformHelper (2D, 7016495) (CVE-2011-0868)

  - OpenJDK: unprivileged proxy settings change via SOAPConnection (SAAJ, 7013971) (CVE-2011-0869)

  - OpenJDK: MediaTracker created Component instances with unnecessary privileges (Swing, 7020198)     (CVE-2011-0871)

  - Oracle/IBM JDK: unspecified vulnerability fixed in 6u26 (2D) (CVE-2011-0873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 5, which updates the Java version to 1.6.0_26.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 10, which updates the Java version to 1.6.0_26 / 1.5.0_30.  As such, it is affected by several security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.

Updated java-1.6.0-sun packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit.

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE Critical Patch Update Advisory' page, listed in the References section. (CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0864, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873)

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide JDK and JRE 6 Update 26 and resolve these issues. All running instances of Sun Java must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
89681	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)	Nessus	Misc.	critical
78975	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)	Nessus	Red Hat Local Security Checks	critical
75873	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0633-1)	Nessus	SuSE Local Security Checks	critical
75542	openSUSE Security Update : java-1_6_0-sun (openSUSE-SU-2011:0633-1)	Nessus	SuSE Local Security Checks	critical
69874	Juniper NSM Servers Multiple Java JDK/JRE Vulnerabilities (PSN-2012-08-689)	Nessus	Misc.	critical
64845	Oracle Java SE Multiple Vulnerabilities (June 2011 CPU) (Unix)	Nessus	Misc.	critical
61071	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
59684	HP Systems Insight Manager < 7.0 Multiple Vulnerabilities	Nessus	Windows	critical
57211	SuSE 10 Security Update : Sun/Oracle Java (ZYPP Patch Number 7569)	Nessus	SuSE Local Security Checks	critical
57210	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7627)	Nessus	SuSE Local Security Checks	critical
57207	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7650)	Nessus	SuSE Local Security Checks	critical
56724	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
56665	VMSA-2011-0013 : VMware third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	critical
55768	SuSE9 Security Update : IBM Java5 JRE and SDK (YOU Patch Number 12810)	Nessus	SuSE Local Security Checks	critical
55757	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7649)	Nessus	SuSE Local Security Checks	critical
55667	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2011:1087)	Nessus	Red Hat Local Security Checks	high
55622	SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7626)	Nessus	SuSE Local Security Checks	critical
55619	SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4875)	Nessus	SuSE Local Security Checks	critical
55598	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2011:0938)	Nessus	Red Hat Local Security Checks	critical
55459	Mac OS X : Java for Mac OS X 10.6 Update 5	Nessus	MacOS X Local Security Checks	critical
55458	Mac OS X : Java for Mac OS X 10.5 Update 10	Nessus	MacOS X Local Security Checks	critical
55137	SuSE 11.1 Security Update : Sun/Oracle Java (SAT Patch Number 4698)	Nessus	SuSE Local Security Checks	critical
55014	RHEL 4 / 5 / 6 : java-1.6.0-sun (RHSA-2011:0860)	Nessus	Red Hat Local Security Checks	critical
54997	Oracle Java SE Multiple Vulnerabilities (June 2011 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2011-0873

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical