The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0030 advisory.

  - OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars (CVE-2013-4578)

  - Oracle JDK: multiple unspecified vulnerabilities fixed in 7u51 (JavaFX) (CVE-2013-5870, CVE-2013-5895,     CVE-2014-0382)

  - OpenJDK: null xmlns handling issue (Security, 8025026) (CVE-2013-5878)

  - OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193) (CVE-2013-5884)

  - Oracle JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) (CVE-2013-5887, CVE-2013-5888,     CVE-2013-5889, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2014-0375, CVE-2014-0387, CVE-2014-0403,     CVE-2014-0410, CVE-2014-0415, CVE-2014-0418, CVE-2014-0424)

  - OpenJDK: JVM method processing issues (Libraries, 8029507) (CVE-2013-5893)

  - OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022) (CVE-2013-5896)

  - Oracle JDK: unspecified vulnerability fixed in 7u51 (Deployment) (CVE-2013-5904)

  - Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (Install) (CVE-2013-5905,     CVE-2013-5906)

  - ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034) (CVE-2013-5907)

  - OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417) (CVE-2013-5910)

  - OpenJDK: insufficient Socket checkListen checks (Networking, 8011786) (CVE-2014-0368)

  - OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126) (CVE-2014-0373)

  - OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018) (CVE-2014-0376)

  - OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069) (CVE-2014-0411)

  - OpenJDK: insecure subject principals set handling (JAAS, 8024306) (CVE-2014-0416)

  - Oracle JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (2D) (CVE-2014-0417)

  - OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758) (CVE-2014-0422)

  - OpenJDK: XXE issue in decoder (Beans, 8023245) (CVE-2014-0423)

  - OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767) (CVE-2014-0428)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 51, 6 Update 71, or 5 Update 61.  It is, therefore, potentially affected by security issues in the following components :

  - 2D
  - Beans
  - CORBA
  - Deployment
  - Hotspot
  - Install
  - JAAS
  - JavaFX
  - JAXP
  - JNDI
  - JSSE
  - Libraries
  - Networking
  - Security
  - Serviceability

The remote host is affected by the vulnerability described in GLSA-201401-30 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Oracle Java       implementation. Please review the CVE identifiers referenced below for       details.
  Impact :

    An unauthenticated, remote attacker could exploit these vulnerabilities       to execute arbitrary code.
      Furthermore, a local or remote attacker could exploit these       vulnerabilities to cause unspecified impact, possibly including remote       execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
71987	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0030)	Nessus	Red Hat Local Security Checks	1/16/2014	4/24/2024	medium
71967	Oracle Java SE Multiple Vulnerabilities (January 2014 CPU) (Unix)	Nessus	Misc.	1/15/2014	6/20/2024	critical
71966	Oracle Java SE Multiple Vulnerabilities (January 2014 CPU)	Nessus	Windows	1/15/2014	4/11/2022	critical
72139	GLSA-201401-30 : Oracle JRE/JDK: Multiple vulnerabilities (ROBOT)	Nessus	Gentoo Local Security Checks	1/27/2014	12/5/2022	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical