A vulnerability has been found and corrected in eclipse :

Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) help/index.jsp or (2) help/advanced/content.jsp (CVE-2010-4647).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

Eclipse help webapp XSS vulnerability fix. See Redhat Bugzilla #661901 and Eclipse Bugzilla #329582.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated eclipse packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Eclipse software development environment provides a set of tools for C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in the official upstream Eclipse Helios SR1 release, providing a number of bug fixes and enhancements over the previous versions :

* eclipse to 3.6.1. (BZ#656329) * eclipse-cdt to 7.0.1. (BZ#656333) * eclipse-birt to 2.6.0. (BZ#656391) * eclipse-emf to 2.6.0. (BZ#656344)
* eclipse-gef to 3.6.1. (BZ#656347) * eclipse-mylyn to 3.4.2.
(BZ#656337) * eclipse-rse to 3.2. (BZ#656338) * eclipse-dtp to 1.8.1.
(BZ#656397) * eclipse-changelog to 2.7.0. (BZ#669499) * eclipse-valgrind to 0.6.1. (BZ#669460) * eclipse-callgraph to 0.6.1.
(BZ#669462) * eclipse-oprofile to 0.6.1. (BZ#670228) * eclipse-linuxprofilingframework to 0.6.1. (BZ#669461)

In addition, the following updates were made to the dependencies of the Eclipse packages above :

* icu4j to 4.2.1. (BZ#656342) * sat4j to 2.2.0. (BZ#661842) * objectweb-asm to 3.2. (BZ#664019) * jetty-eclipse to 6.1.24.
(BZ#661845)

This update includes numerous upstream bug fixes and enhancements, such as :

* The Eclipse IDE and Java Development Tools (JDT) :

  - projects and folders can filter out resources in the     workspace. - new virtual folder and linked files     support. - the full set of UNIX file permissions is now     supported. - addition of the stop button to cancel     long-running wizard tasks. - Java editor now shows     multiple quick-fixes via problem hover. - new support     for running JUnit version 4 tests. - over 200 upstream     bug fixes.

* The Eclipse C/C++ Development Tooling (CDT) :

  - new Codan framework has been added for static code     analysis. - refactoring improvements such as stored     refactoring history. - compile and build errors now     highlighted in the build console. - switch to the new     DSF debugger framework. - new template view support. -     over 600 upstream bug fixes.

This update also fixes the following bugs :

* Incorrect URIs for GNU Tools in the 'Help Contents' window have been fixed. (BZ#622713)

* The profiling of binaries did not work if an Eclipse project was not in an Eclipse workspace. This update adds an automated test for external project profiling, which corrects this issue. (BZ#622867)

* Running a C/C++ application in Eclipse successfully terminated, but returned an I/O exception not related to the application itself in the Error Log window. With this update, the exception is no longer returned. (BZ#668890)

* The eclipse-mylyn package showed a '20100916-0100-e3x' qualifier.
The qualifier has been modified to 'v20100902-0100-e3x' to match the upstream version of eclipse-mylyn. (BZ#669819)

* Installing the eclipse-mylyn package failed and returned a 'Resource temporarily unavailable' error message due to a bug in the packaging.
This update fixes this bug and installation now works as expected.
(BZ#673174)

* Building the eclipse-cdt package could fail due to an incorrect interaction with the local file system. Interaction with the local file system is now prevented and the build no longer fails.
(BZ#678364)

* The libhover plug-in, provided by the eclipse-cdt package, used binary data to search for hover topics. The data location was specified externally as a URL which could cause an exception to occur on a system with no Internet access. This update modifies the plug-in so that it pulls the needed data from a local location. (BZ#679543)

Users of eclipse should upgrade to these updated packages, which correct these issues and add these enhancements.

The Eclipse software development environment provides a set of tools for C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in the official upstream Eclipse Helios SR1 release, providing a number of bug fixes and enhancements over the previous versions :

  - eclipse to 3.6.1.

  - eclipse-cdt to 7.0.1.

  - eclipse-birt to 2.6.0.

  - eclipse-emf to 2.6.0.

  - eclipse-gef to 3.6.1.

  - eclipse-mylyn to 3.4.2.

  - eclipse-rse to 3.2.

  - eclipse-dtp to 1.8.1.

  - eclipse-changelog to 2.7.0.

  - eclipse-valgrind to 0.6.1.

  - eclipse-callgraph to 0.6.1.

  - eclipse-oprofile to 0.6.1.

  - eclipse-linuxprofilingframework to 0.6.1.

In addition, the following updates were made to the dependencies of the Eclipse packages above :

  - icu4j to 4.2.1.

  - sat4j to 2.2.0.

  - objectweb-asm to 3.2.

  - jetty-eclipse to 6.1.24.

This update includes numerous upstream bug fixes and enhancements, such as :

  - The Eclipse IDE and Java Development Tools (JDT) :

    - projects and folders can filter out resources in the       workspace.

    - new virtual folder and linked files support.

    - the full set of UNIX file permissions is now       supported.

    - addition of the stop button to cancel long-running       wizard tasks.

    - Java editor now shows multiple quick-fixes via problem       hover.

    - new support for running JUnit version 4 tests.

    - over 200 upstream bug fixes.

  - The Eclipse C/C++ Development Tooling (CDT) :

    - new Codan framework has been added for static code       analysis.

    - refactoring improvements such as stored refactoring       history.

    - compile and build errors now highlighted in the build       console.

    - switch to the new DSF debugger framework.

    - new template view support.

    - over 600 upstream bug fixes.

This update also fixes the following bugs :

  - Incorrect URIs for GNU Tools in the 'Help Contents'     window have been fixed.

  - The profiling of binaries did not work if an Eclipse     project was not in an Eclipse workspace. This update     adds an automated test for external project profiling,     which corrects this issue.

  - Running a C/C++ application in Eclipse successfully     terminated, but returned an I/O exception not related to     the application itself in the Error Log window. With     this update, the exception is no longer returned.

  - The eclipse-mylyn package showed a '20100916-0100-e3x'     qualifier. The qualifier has been modified to     'v20100902-0100-e3x' to match the upstream version of     eclipse-mylyn.

  - Installing the eclipse-mylyn package failed and returned     a 'Resource temporarily unavailable' error message due     to a bug in the packaging. This update fixes this bug     and installation now works as expected.

  - Building the eclipse-cdt package could fail due to an     incorrect interaction with the local file system.
    Interaction with the local file system is now prevented     and the build no longer fails.

  - The libhover plug-in, provided by the eclipse-cdt     package, used binary data to search for hover topics.
    The data location was specified externally as a URL     which could cause an exception to occur on a system with     no Internet access. This update modifies the plug-in so     that it pulls the needed data from a local location.

Users of eclipse should upgrade to these updated packages, which correct these issues and add these enhancements.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0568 advisory.

  - Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help     Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the     query string to (1) help/index.jsp or (2) help/advanced/content.jsp. (CVE-2010-4647)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix junit runner problem Eclipse help webapp XSS vulnerability fix.
See Redhat Bugzilla #661901 and Eclipse Bugzilla #329582.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - eclipse: Help Content web application vulnerable to multiple XSS (CVE-2010-4647)

  - Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help     Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via     (1) the searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add     action to help/advanced/workingSetManager.jsp, a different issue than CVE-2010-4647. (CVE-2008-7271)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
52041	Mandriva Linux Security Advisory : eclipse (MDVSA-2011:032)	Nessus	Mandriva Local Security Checks	2/21/2011	1/6/2021	medium
51376	Fedora 14 : eclipse-3.6.1-6.1.fc14 (2010-19006)	Nessus	Fedora Local Security Checks	12/26/2010	1/11/2021	medium
54595	RHEL 6 : eclipse (RHSA-2011:0568)	Nessus	Red Hat Local Security Checks	5/20/2011	1/14/2021	medium
61040	Scientific Linux Security Update : eclipse on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
181063	Oracle Linux 6 : eclipse (ELSA-2011-0568)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	medium
51375	Fedora 13 : eclipse-3.5.2-4.fc13 (2010-18990)	Nessus	Fedora Local Security Checks	12/26/2010	1/11/2021	medium
199996	RHEL 5 : eclipse (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium