A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Tomcat to hang via a specially crafted HTTP request.
(CVE-2010-4476)

Tomcat must be restarted for this update to take effect.

The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the following components :

  - TLS and SSL protocols
  - Apache Tomcat
  - Java
  - Flash Player
  - BlazeDS/GraniteDS
  - Adobe LiveCycle
  - Adobe Flex SDK
  - Systems Insight Manager

This update fixes several vulnerabilities in the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. (CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476)

All running instances of Sun Java must be restarted for the update to take effect.

NOTE: jdk-1.6.0_20-fcs.x86_64.rpm has not been signed. We cannot sign this package without breaking it.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0880 advisory.

  - TLS: MITM attacks via session renegotiation (CVE-2009-3555)

  - krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) (CVE-2010-1321)

  - OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004) (CVE-2010-3541,     CVE-2010-3573)

  - OpenJDK DNS server IP address information leak (6957564) (CVE-2010-3548)

  - OpenJDK HttpURLConnection request splitting (6952017) (CVE-2010-3549)

  - JDK unspecified vulnerability in Java Web Start component (CVE-2010-3550, CVE-2010-3558)

  - OpenJDK local network address disclosure (6952603) (CVE-2010-3551)

  - OpenJDK Swing unsafe reflection usage (6622002) (CVE-2010-3553)

  - JDK unspecified vulnerability in Deployment component (CVE-2010-3555, CVE-2010-4422, CVE-2010-4447,     CVE-2010-4452, CVE-2010-4463, CVE-2010-4466, CVE-2010-4467, CVE-2010-4475)

  - JDK unspecified vulnerability in 2D component (CVE-2010-3556, CVE-2010-3571)

  - OpenJDK Swing mutable static (6938813) (CVE-2010-3557)

  - JDK unspecified vulnerability in Networking component (CVE-2010-3560)

  - OpenJDK IndexColorModel double-free (6925710) (CVE-2010-3562)

  - OpenJDK: unspecified vulnerability in Deployment component (CVE-2010-3563)

  - OpenJDK JPEG writeImage remote code execution (6963023) (CVE-2010-3565)

  - OpenJDK ICC Profile remote code execution (6963489) (CVE-2010-3566)

  - OpenJDK Deserialization Race condition (6559775) (CVE-2010-3568)

  - OpenJDK Serialization inconsistencies (6966692) (CVE-2010-3569)

  - JDK unspecified vulnerability in Sound component (CVE-2010-3572, CVE-2010-4454, CVE-2010-4462,     CVE-2010-4473)

  - OpenJDK HttpURLConnection incomplete TRACE permission check (6981426) (CVE-2010-3574)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

  - JDK Double.parseDouble Denial-Of-Service (CVE-2010-4476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
60984	Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
59684	HP Systems Insight Manager < 7.0 Multiple Vulnerabilities	Nessus	Windows	6/15/2012	3/8/2022	critical
60964	Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	critical
63983	RHEL 5 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2011:0880)	Nessus	Red Hat Local Security Checks	1/24/2013	4/21/2024	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical