The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1385 advisory.

  - OpenJDK: java.io.FilePermission information leak (Libraries, 6631398) (CVE-2012-3216)

  - OpenJDK: uninitialized Array JVM memory disclosure (Hotspot, 7198606) (CVE-2012-4416)

  - OpenJDK: RhinoScriptEngine security bypass (Scripting, 7143535) (CVE-2012-5068)

  - OpenJDK: Executors state handling issues (Concurrency, 7189103) (CVE-2012-5069)

  - OpenJDK: DescriptorSupport insufficient package access checks (JMX, 7192975) (CVE-2012-5071)

  - OpenJDK: AccessController.doPrivilegedWithCombiner() information disclosure (Security, 7172522)     (CVE-2012-5072)

  - OpenJDK: LogManager security bypass (Libraries, 7169884) (CVE-2012-5073)

  - OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888) (CVE-2012-5075)

  - OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656) (CVE-2012-5077)

  - OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)     (CVE-2012-5079)

  - OpenJDK: JSSE denial of service (JSSE, 7186286) (CVE-2012-5081)

  - OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194) (CVE-2012-5084)

  - OpenJDK: disable Gopher support by default (Gopher, 7189567) (CVE-2012-5085)

  - OpenJDK: XMLDecoder sandbox restriction bypass (Beans, 7195917) (CVE-2012-5086)

  - OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296) (CVE-2012-5089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 : java-1.6.0-openjdk (RHSA-2012:1385)

medium Nessus Plugin ID 62614

Version 1.28