Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX.

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0030 advisory.

  - OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars (CVE-2013-4578)

  - Oracle JDK: multiple unspecified vulnerabilities fixed in 7u51 (JavaFX) (CVE-2013-5870, CVE-2013-5895,     CVE-2014-0382)

  - OpenJDK: null xmlns handling issue (Security, 8025026) (CVE-2013-5878)

  - OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193) (CVE-2013-5884)

  - Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) (CVE-2013-5887, CVE-2013-5888,     CVE-2013-5889, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2014-0375, CVE-2014-0387, CVE-2014-0403,     CVE-2014-0410, CVE-2014-0415, CVE-2014-0418, CVE-2014-0424)

  - OpenJDK: JVM method processing issues (Libraries, 8029507) (CVE-2013-5893)

  - OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022) (CVE-2013-5896)

  - Oracle JDK: unspecified vulnerability fixed in 7u51 (Deployment) (CVE-2013-5904)

  - Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install) (CVE-2013-5905,     CVE-2013-5906)

  - ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034) (CVE-2013-5907)

  - OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417) (CVE-2013-5910)

  - OpenJDK: insufficient Socket checkListen checks (Networking, 8011786) (CVE-2014-0368)

  - OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126) (CVE-2014-0373)

  - OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018) (CVE-2014-0376)

  - OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069) (CVE-2014-0411)

  - OpenJDK: insecure subject principals set handling (JAAS, 8024306) (CVE-2014-0416)

  - Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (2D) (CVE-2014-0417)

  - OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758) (CVE-2014-0422)

  - OpenJDK: XXE issue in decoder (Beans, 8023245) (CVE-2014-0423)

  - OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767) (CVE-2014-0428)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 51, 6 Update 71, or 5 Update 61.  It is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Beans
  - CORBA
  - Deployment
  - Hotspot
  - Install
  - JAAS
  - JavaFX
  - JAXP
  - JNDI
  - JSSE
  - Libraries
  - Networking
  - Security
  - Serviceability

ID	Name	Product	Family	Severity
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	critical
71987	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0030)	Nessus	Red Hat Local Security Checks	medium
71967	Oracle Java SE Multiple Vulnerabilities (January 2014 CPU) (Unix)	Nessus	Misc.	critical
71966	Oracle Java SE Multiple Vulnerabilities (January 2014 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2014-0382

critical

Tenable Plugins

critical

medium

critical

critical