The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenJDK: InetSocketAddress serialization issue (Networking, 7201071) (CVE-2013-0433)

  - Oracle JDK 7: bypass of the security level setting in browser plugin (Deployment, SE-2012-01 Issue 53)     (CVE-2013-1489)

  - Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through     Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and     availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed     in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not     commented on claims from a third party that the issue is due to an interaction error in between the JRE     plug-in for WebKit-based browsers and the Javascript engine, which allows remote attackers to execute     arbitrary code by modifying DOM nodes that contain applet elements in a way that triggers an incorrect     reference count and a use after free. (CVE-2012-1541)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Detections

Analytics

RHEL 5 : java-1.4.2-ibm (Unpatched Vulnerability)

high Nessus Plugin ID 199362

Version 1.2