Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

- Fix a file conflict between -devel and -headless package 

  - Update to 2.4.4 (bnc#858818)

  - changed from xz to gzipped tarball as the first was not     available during update

  - changed a keyring file due release manager change new     one is signed by 66484681 from omajid@redhat.com, see     http://mail.openjdk.java.net/pipermail/distro-pkg-dev/20     14-January/025800.html

  - Security fixes

  - S6727821: Enhance JAAS Configuration

  - S7068126, CVE-2014-0373: Enhance SNMP statuses

  - S8010935: Better XML handling

  - S8011786, CVE-2014-0368: Better applet networking

  - S8021257, S8025022, CVE-2013-5896 : com.sun.corba.se.**     should be on restricted package list

  - S8021271, S8021266, CVE-2014-0408: Better buffering in     ObjC code

  - S8022904: Enhance JDBC Parsers

  - S8022927: Input validation for byte/endian conversions

  - S8022935: Enhance Apache resolver classes

  - S8022945: Enhance JNDI implementation classes

  - S8023057: Enhance start up image display

  - S8023069, CVE-2014-0411: Enhance TLS connections

  - S8023245, CVE-2014-0423: Enhance Beans decoding

  - S8023301: Enhance generic classes

  - S8023338: Update jarsigner to encourage timestamping

  - S8023672: Enhance jar file validation

  - S8024302: Clarify jar verifications

  - S8024306, CVE-2014-0416: Enhance Subject consistency

  - S8024530: Enhance font process resilience

  - S8024867: Enhance logging start up

  - S8025014: Enhance Security Policy

  - S8025018, CVE-2014-0376: Enhance JAX-P set up

  - S8025026, CVE-2013-5878: Enhance canonicalization

  - S8025034, CVE-2013-5907: Improve layout lookups

  - S8025448: Enhance listening events

  - S8025758, CVE-2014-0422: Enhance Naming management

  - S8025767, CVE-2014-0428: Enhance IIOP Streams

  - S8026172: Enhance UI Management

  - S8026176: Enhance document printing

  - S8026193, CVE-2013-5884: Enhance CORBA stub factories

  - S8026204: Enhance auth login contexts

  - S8026417, CVE-2013-5910: Enhance XML canonicalization

  - S8026502: java/lang/invoke/MethodHandleConstants.java     fails on all platforms

  - S8027201, CVE-2014-0376: Enhance JAX-P set up

  - S8029507, CVE-2013-5893: Enhance JVM method processing

  - S8029533: REGRESSION:
    closed/java/lang/invoke/8008140/Test8008140.java fails     against

  - Backports

  - S8025255: (tz) Support tzdata2013g

  - S8026826: JDK 7 fix for 8010935 broke the build

  - Bug fixes

  - PR1618: Include defs.make in vm.make so VM_LITTLE_ENDIAN     is defined on Zero builds

  - D729448: 32-bit alignment on mips and mipsel

  - PR1623: Collision between OpenJDK 6 & 7 classes when     bootstrapping with OpenJDK 6

  - Add update.py, helper script to download openjdk     tarballs from hg repo

  - Buildrequire quilt unconditionally as it's used     unconditionally.

  - Really disable tests on non-JIT architectures. (from     Ulrich Weigand)

  - Add headless subpackage wich does not require X and     pulse/alsa

  - Add accessibility to extra subpackage, which requires     new java-atk-wrapper package

  - removed java-1.7.0-openjdk-java-access-bridge-idlj.patch

  - removed java-1.7.0-openjdk-java-access-bridge-tck.patch

  - removed java-access-bridge-1.26.2.tar.bz2

  - Refreshed

  - java-1.7.0-openjdk-java-access-bridge-security.patch

  - Add a support for running tests using --with tests

  - this is ignored on non-jit architectures

  - Prefer global over define as bcond_with does use them

  - Forward declare aarch64 arch macro

  - Define archbuild/archinstall macros for arm and aarch64

  - remove a few ifarch conditions by using those macros in     filelist

  - Need ecj-bootstrap in bootstrap mode (noted by mmatz)

  - Don't install vim and quilt in bootstrap mode

  - A few enhancenments of bootstrap mode

  - usable wia --with bootstrap

  - disable docs, javadoc package

  - fix configure arguments on bootstrap

  - Add the unversioned SDK directory link to the files list     of -devel package (fixes update-alternatives from     %post).

  - Add support for bootstrapping with just gcj (using     included ecj directly). Increase stacksize for powerpc     (amends java-1.7.0-openjdk-ppc-zero-jdk.patch). Add     support for ppc64le.

  - fix stackoverflow for powerpc     (java-1_7_0-openjdk-ppc-stackoverflow.patch)

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-3829, CVE-2013-5783, CVE-2013-5804, CVE-2014-0411)

Several vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2013-4002, CVE-2013-5803, CVE-2013-5823, CVE-2013-5825, CVE-2013-5896, CVE-2013-5910)

Several vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2013-5772, CVE-2013-5774, CVE-2013-5784, CVE-2013-5797, CVE-2013-5820, CVE-2014-0376, CVE-2014-0416)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-5778, CVE-2013-5780, CVE-2013-5790, CVE-2013-5800, CVE-2013-5840, CVE-2013-5849, CVE-2013-5851, CVE-2013-5884, CVE-2014-0368)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2013-5782, CVE-2013-5802, CVE-2013-5809, CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5830, CVE-2013-5842, CVE-2013-5850, CVE-2013-5878, CVE-2013-5893, CVE-2013-5907, CVE-2014-0373, CVE-2014-0408, CVE-2014-0422, CVE-2014-0428)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure and availability. An attacker could exploit this to expose sensitive data over the network or cause a denial of service. (CVE-2014-0423).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 51, 6 Update 71, or 5 Update 61.  It is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Beans
  - CORBA
  - Deployment
  - Hotspot
  - Install
  - JAAS
  - JavaFX
  - JAXP
  - JNDI
  - JSSE
  - Libraries
  - Networking
  - Security
  - Serviceability

ID	Name	Product	Family	Severity
75414	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2014:0180-1)	Nessus	SuSE Local Security Checks	critical
75413	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2014:0174-1)	Nessus	SuSE Local Security Checks	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	critical
72117	Ubuntu 12.10 / 13.04 / 13.10 : openjdk-7 vulnerabilities (USN-2089-1)	Nessus	Ubuntu Local Security Checks	critical
71967	Oracle Java SE Multiple Vulnerabilities (January 2014 CPU) (Unix)	Nessus	Misc.	critical
71966	Oracle Java SE Multiple Vulnerabilities (January 2014 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2014-0408

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical