The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than or equal to  7 Update 17, 6 Update 43 or 5 Update 41.  It is, therefore, potentially affected by security issues in the following components :

  - 2D
  - AWT
  - Beans
  - Deployment
  - HotSpot
  - ImageIO
  - Install
  - JavaFX
  - JAXP
  - JAX-WS
  - JMX
  - Libraries
  - Networking
  - RMI

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0752 advisory.

    [1.7.0.19-2.3.9.1.0.1.el5_9]
    - Add oracle-enterprise.patch
    - Fix DISTRO_NAME to Enterprise Linux

    [1.7.0.19-2.3.9.1.el5]
    - updated to updated IcedTea 2.3.9 with fix to one of security fixes
    - fixed font glyph offset
    - Resolves: rhbz#950376

    [1.7.0.19-2.3.9.0.el5]
    - updated to IcedTea 2.3.9 with latest security patches
    - buildver sync to b19
    - rewritten java-1.7.0-openjdk-java-access-bridge-security.patch
    - Resolves: rhbz#950376

    [1.7.0.9-2.3.8.1.el5]
    - Added some of the latest Fedora spec bugfixes
    - Bumped release
    - zlib in BuildReq restricted for 1.2.3-7 or higher
    - see https://bugzilla.redhat.com/show_bug.cgi?id=904231
    - Removed a -icedtea tag from the version
    - package have less and less connections to icedtea7
    - Added gcc-c++ build dependence. Sometimes caused troubles during rpm -bb
    - Added (Build)Requires for fontconfig and xorg-x11-fonts-Type1
    - see https://bugzilla.redhat.com/show_bug.cgi?id=721033 for details
    - logging.properties marked as config(noreplace)
    - see https://bugzilla.redhat.com/show_bug.cgi?id=679180 for details
    - nss.cfg was marked as config(noreplace)
    - slaves sync with el6
    - Resolves: rhbz#950376

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- apply aarch64 patches on openSUSE 12.3+, EM_AARCH64 is     not defined in earlier releases

  - update to icedtea-2.3.9 (bnc#816720) 

  - Security fixes

  - S6657673, CVE-2013-1518: Issues with JAXP

  - S7200507: Refactor Introspector internals

  - S8000724, CVE-2013-2417: Improve networking     serialization

  - S8001031, CVE-2013-2419: Better font processing

  - S8001040, CVE-2013-1537: Rework RMI model

  - S8001322: Refactor deserialization

  - S8001329, CVE-2013-1557: Augment RMI logging

  - S8003335: Better handling of Finalizer thread

  - S8003445: Adjust JAX-WS to focus on API

  - S8003543, CVE-2013-2415: Improve processing of MTOM     attachments

  - S8004261: Improve input validation

  - S8004336, CVE-2013-2431: Better handling of method     handle intrinsic frames

  - S8004986, CVE-2013-2383: Better handling of glyph table

  - S8004987, CVE-2013-2384: Improve font layout

  - S8004994, CVE-2013-1569: Improve checking of glyph table

  - S8005432: Update access to JAX-WS

  - S8005943: (process) Improved Runtime.exec

  - S8006309: More reliable control panel operation

  - S8006435, CVE-2013-2424: Improvements in JMX

  - S8006790: Improve checking for windows

  - S8006795: Improve font warning messages

  - S8007406: Improve accessibility of AccessBridge

  - S8007617, CVE-2013-2420: Better validation of images

  - S8007667, CVE-2013-2430: Better image reading

  - S8007918, CVE-2013-2429: Better image writing

  - S8008140: Better method handle resolution

  - S8009049, CVE-2013-2436: Better method handle binding

  - S8009063, CVE-2013-2426: Improve reliability of     ConcurrentHashMap

  - S8009305, CVE-2013-0401: Improve AWT data transfer

  - S8009677, CVE-2013-2423: Better setting of setters

  - S8009699, CVE-2013-2421: Methodhandle lookup

  - S8009814, CVE-2013-1488: Better driver management

  - S8009857, CVE-2013-2422: Problem with plugin

  - Backports

  - S7130662, RH928500: GTK file dialog crashes with a NPE

  - Bug fixes

  - PR1363: Fedora 19 / rawhide FTBFS SIGILL

  - PR1401: Fix Zero build on 2.3.8

  - Fix offset problem in ICU LETableReference.

  - Change -Werror fix to preserve OpenJDK default.

  - PR1303: Correct #ifdef to #if

  - PR1404: Failure to bootstrap with ecj 4.2

  - Added url as source. Please see     http://en.opensuse.org/SourceUrls

  - icedtea-2.3.8-zero-patches.patch: remove patch not     applicable to zero compatible hotspot

  - java-1.7.0-openjdk-fork.patch: Add support for     architectures without fork syscall

  - java-1.7.0-openjdk-aarch64.patch: Add support for     aarch64

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.5. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.5 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2011-0802, CVE-2011-0814, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0873, CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561, CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507, CVE-2012-0547, CVE-2012-0551, CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-1541, CVE-2012-1682, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1721, CVE-2012-1722, CVE-2012-1725, CVE-2012-3143, CVE-2012-3159, CVE-2012-3213, CVE-2012-3216, CVE-2012-3342, CVE-2012-4820, CVE-2012-4822, CVE-2012-4823, CVE-2012-5068, CVE-2012-5069, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5075, CVE-2012-5079, CVE-2012-5081, CVE-2012-5083, CVE-2012-5084, CVE-2012-5089, CVE-2013-0169, CVE-2013-0351, CVE-2013-0401, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487, CVE-2013-1491, CVE-2013-1493, CVE-2013-1500, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1563, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2407, CVE-2013-2412, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2422, CVE-2013-2424, CVE-2013-2429, CVE-2013-2430, CVE-2013-2432, CVE-2013-2433, CVE-2013-2435, CVE-2013-2437, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743)

Users of Red Hat Network Satellite Server 5.4 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR14 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The version of Oracle (formerly Sun) Java Runtime Environment (JRE) 7.x installed on the remote host is earlier than Update 21.  It is therefore, potentially affected by the following security issues in the following components :

  - 2D

  - AWT

  - Bean

  - Deployment

  - HotSpot

  - ImageIO

  - Install

  - JavaFX

  - JAXP

  - JMX

  - Libraries

  - Networking

  - RMI

ID	Name	Product	Family	Published	Updated	Severity
65996	Oracle Java SE Multiple Vulnerabilities (April 2013 CPU) (Unix)	Nessus	Misc.	4/17/2013	5/25/2022	critical
68812	Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-0752)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
74990	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0745-1)	Nessus	SuSE Local Security Checks	6/13/2014	5/25/2022	critical
78976	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1456) (ROBOT)	Nessus	Red Hat Local Security Checks	11/8/2014	12/5/2022	critical
78975	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1455) (BEAST) (ROBOT)	Nessus	Red Hat Local Security Checks	11/8/2014	12/5/2022	critical
6761	Oracle Java JDK / JRE / SE Multiple Vulnerabilities (April 2013 CPU)	Nessus Network Monitor	Web Clients	4/17/2013	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical