ID CENTOS_RHSA-2013-0246.NASL Type nessus Reporter This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2013-02-10T00:00:00
Description
Updated java-1.6.0-openjdk packages that fix several security issues
are now available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.
These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.
Multiple improper permission check issues were discovered in the AWT,
CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass Java sandbox
restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,
CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,
CVE-2013-0425, CVE-2013-0426, CVE-2013-0428)
Multiple flaws were found in the way image parsers in the 2D and AWT
components handled image raster parameters. A specially crafted image
could cause Java Virtual Machine memory corruption and, possibly, lead
to arbitrary code execution with the virtual machine privileges.
(CVE-2013-1478, CVE-2013-1480)
A flaw was found in the AWT component's clipboard handling code. An
untrusted Java application or applet could use this flaw to access
clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)
The default Java security properties configuration did not restrict
access to certain com.sun.xml.internal packages. An untrusted Java
application or applet could use this flaw to access information,
bypassing certain Java sandbox restrictions. This update lists the
whole package as restricted. (CVE-2013-0435)
Multiple improper permission check issues were discovered in the
Libraries, Networking, and JAXP components. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)
It was discovered that the RMI component's CGIHandler class used user
inputs in error messages without any sanitization. An attacker could
use this flaw to perform a cross-site scripting (XSS) attack.
(CVE-2013-0424)
It was discovered that the SSL/TLS implementation in the JSSE
component did not properly enforce handshake message ordering,
allowing an unlimited number of handshake restarts. A remote attacker
could use this flaw to make an SSL/TLS server using JSSE consume an
excessive amount of CPU by continuously restarting the handshake.
(CVE-2013-0440)
It was discovered that the JSSE component did not properly validate
Diffie-Hellman public keys. An SSL/TLS client could possibly use this
flaw to perform a small subgroup attack. (CVE-2013-0443)
This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.
Refer to the NEWS file, linked to in the References, for further
information.
All users of java-1.6.0-openjdk are advised to upgrade to these
updated packages, which resolve these issues. All running instances of
OpenJDK Java must be restarted for the update to take effect.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2013:0246 and
# CentOS Errata and Security Advisory 2013:0246 respectively.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(64512);
script_version("1.15");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");
script_cve_id("CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0445", "CVE-2013-0450", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480");
script_xref(name:"RHSA", value:"2013:0246");
script_name(english:"CentOS 5 : java-1.6.0-openjdk (CESA-2013:0246)");
script_summary(english:"Checks rpm output for the updated packages");
script_set_attribute(
attribute:"synopsis",
value:"The remote CentOS host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"Updated java-1.6.0-openjdk packages that fix several security issues
are now available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.
These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.
Multiple improper permission check issues were discovered in the AWT,
CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass Java sandbox
restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,
CVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,
CVE-2013-0425, CVE-2013-0426, CVE-2013-0428)
Multiple flaws were found in the way image parsers in the 2D and AWT
components handled image raster parameters. A specially crafted image
could cause Java Virtual Machine memory corruption and, possibly, lead
to arbitrary code execution with the virtual machine privileges.
(CVE-2013-1478, CVE-2013-1480)
A flaw was found in the AWT component's clipboard handling code. An
untrusted Java application or applet could use this flaw to access
clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)
The default Java security properties configuration did not restrict
access to certain com.sun.xml.internal packages. An untrusted Java
application or applet could use this flaw to access information,
bypassing certain Java sandbox restrictions. This update lists the
whole package as restricted. (CVE-2013-0435)
Multiple improper permission check issues were discovered in the
Libraries, Networking, and JAXP components. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)
It was discovered that the RMI component's CGIHandler class used user
inputs in error messages without any sanitization. An attacker could
use this flaw to perform a cross-site scripting (XSS) attack.
(CVE-2013-0424)
It was discovered that the SSL/TLS implementation in the JSSE
component did not properly enforce handshake message ordering,
allowing an unlimited number of handshake restarts. A remote attacker
could use this flaw to make an SSL/TLS server using JSSE consume an
excessive amount of CPU by continuously restarting the handshake.
(CVE-2013-0440)
It was discovered that the JSSE component did not properly validate
Diffie-Hellman public keys. An SSL/TLS client could possibly use this
flaw to perform a small subgroup attack. (CVE-2013-0443)
This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.
Refer to the NEWS file, linked to in the References, for further
information.
All users of java-1.6.0-openjdk are advised to upgrade to these
updated packages, which resolve these issues. All running instances of
OpenJDK Java must be restarted for the update to take effect."
);
# https://lists.centos.org/pipermail/centos-announce/2013-February/019231.html
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?7117ea7d"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected java-1.6.0-openjdk packages."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-0425");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:java-1.6.0-openjdk");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:java-1.6.0-openjdk-demo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:java-1.6.0-openjdk-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:java-1.6.0-openjdk-javadoc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:java-1.6.0-openjdk-src");
script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
script_set_attribute(attribute:"vuln_publication_date", value:"2013/02/02");
script_set_attribute(attribute:"patch_publication_date", value:"2013/02/08");
script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/10");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"CentOS Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/CentOS/release");
if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);
if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
flag = 0;
if (rpm_check(release:"CentOS-5", reference:"java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9")) flag++;
if (rpm_check(release:"CentOS-5", reference:"java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9")) flag++;
if (rpm_check(release:"CentOS-5", reference:"java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9")) flag++;
if (rpm_check(release:"CentOS-5", reference:"java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9")) flag++;
if (rpm_check(release:"CentOS-5", reference:"java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9")) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "java-1.6.0-openjdk / java-1.6.0-openjdk-demo / etc");
}
{"id": "CENTOS_RHSA-2013-0246.NASL", "bulletinFamily": "scanner", "title": "CentOS 5 : java-1.6.0-openjdk (CESA-2013:0246)", "description": "Updated java-1.6.0-openjdk packages that fix several security issues\nare now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\nRefer to the NEWS file, linked to in the References, for further\ninformation.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.", "published": "2013-02-10T00:00:00", "modified": "2013-02-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://www.tenable.com/plugins/nessus/64512", "reporter": "This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://www.nessus.org/u?7117ea7d"], "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "type": "nessus", "lastseen": "2021-01-06T09:28:24", "edition": 25, "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310870905", "OPENVAS:881598", "OPENVAS:1361412562310870906", "OPENVAS:865341", "OPENVAS:1361412562310865341", "OPENVAS:870906", "OPENVAS:1361412562310123729", "OPENVAS:1361412562310881598", "OPENVAS:1361412562310881597", "OPENVAS:870905"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2013:0312-1", "SUSE-SU-2013:0440-6", "SUSE-SU-2013:0478-1", "SUSE-SU-2013:0440-4", "OPENSUSE-SU-2013:0377-1", "SUSE-SU-2013:0440-2", "SUSE-SU-2013:0440-3", "OPENSUSE-SU-2013:0308-1", "SUSE-SU-2013:0315-1", "SUSE-SU-2013:0440-5"]}, {"type": "fedora", "idList": ["FEDORA:A2D5520A3D", "FEDORA:3B8F6208CD"]}, {"type": "nessus", "idList": ["FEDORA_2013-2205.NASL", "ORACLELINUX_ELSA-2013-0245.NASL", "FEDORA_2013-1898.NASL", "FEDORA_2013-2197.NASL", "MANDRIVA_MDVSA-2013-010.NASL", "SUSE_11_JAVA-1_6_0-OPENJDK-130212.NASL", "FEDORA_2013-2209.NASL", "FEDORA_2013-2188.NASL", "SL_20130208_JAVA_1_6_0_OPENJDK_ON_SL6_X.NASL", "REDHAT-RHSA-2013-0246.NASL"]}, {"type": "redhat", "idList": ["RHSA-2013:0246", "RHSA-2013:0236", "RHSA-2013:0245", "RHSA-2013:0247", "RHSA-2013:0625", "RHSA-2013:0624"]}, {"type": "centos", "idList": ["CESA-2013:0246", "CESA-2013:0245", "CESA-2013:0247"]}, {"type": "oraclelinux", "idList": ["ELSA-2013-0247", "ELSA-2013-0246", "ELSA-2013-0245"]}, {"type": "amazon", "idList": ["ALAS-2013-156", "ALAS-2013-155"]}, {"type": "ubuntu", "idList": ["USN-1724-1"]}, {"type": "cve", "idList": ["CVE-2013-0440", "CVE-2013-0445"]}], "modified": "2021-01-06T09:28:24", "rev": 2}, "score": {"value": 10.1, "vector": "NONE", "modified": "2021-01-06T09:28:24", "rev": 2}, "vulnersScore": 10.1}, "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2013:0246 and \n# CentOS Errata and Security Advisory 2013:0246 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64512);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_xref(name:\"RHSA\", value:\"2013:0246\");\n\n script_name(english:\"CentOS 5 : java-1.6.0-openjdk (CESA-2013:0246)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated java-1.6.0-openjdk packages that fix several security issues\nare now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\nRefer to the NEWS file, linked to in the References, for further\ninformation.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2013-February/019231.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7117ea7d\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.6.0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2013-0425\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 5.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-5\", reference:\"java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"CentOS-5\", reference:\"java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.6.0-openjdk / java-1.6.0-openjdk-demo / etc\");\n}\n", "naslFamily": "CentOS Local Security Checks", "pluginID": "64512", "cpe": ["p-cpe:/a:centos:centos:java-1.6.0-openjdk", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-src", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-javadoc", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-demo", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-devel", "cpe:/o:centos:centos:5"], "scheme": null}
{"suse": [{"lastseen": "2016-09-04T11:23:06", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "java-1_6_0-openjdk based on Icedtea6-1.12.2 was released,\n fixing various security issues:\n\n New in release 1.12.2 (2012-02-03):\n\n *\n\n Security fixes\n\n o S6563318, CVE-2013-0424: RMI data sanitization\n o S6664509, CVE-2013-0425: Add logging context o S6664528,\n CVE-2013-0426: Find log level matching its name or value\n given at construction time o S6776941: CVE-2013-0427:\n Improve thread pool shutdown o S7141694, CVE-2013-0429:\n Improving CORBA internals o S7173145: Improve in-memory\n representation of splashscreens o S7186945: Unpack200\n improvement o S7186946: Refine unpacker resource usage o\n S7186948: Improve Swing data validation o S7186952,\n CVE-2013-0432: Improve clipboard access o S7186954: Improve\n connection performance o S7186957: Improve Pack200 data\n validation o S7192392, CVE-2013-0443: Better validation of\n client keys o S7192393, CVE-2013-0440: Better Checking of\n order of TLS Messages o S7192977, CVE-2013-0442: Issue in\n toolkit thread o S7197546, CVE-2013-0428: (proxy) Reflect\n about creating reflective proxies o S7200491: Tighten up\n JTable layout code o S7200500: Launcher better input\n validation o S7201064: Better dialogue checking o S7201066,\n CVE-2013-0441: Change modifiers on unused fields o\n S7201068, CVE-2013-0435: Better handling of UI elements o\n S7201070: Serialization to conform to protocol o S7201071,\n CVE-2013-0433: InetSocketAddress serialization issue o\n S8000210: Improve JarFile code quality o S8000537,\n CVE-2013-0450: Contextualize RequiredModelMBean class o\n S8000540, CVE-2013-1475: Improve IIOP type reuse management\n o S8000631, CVE-2013-1476: Restrict access to class\n constructor o S8001235, CVE-2013-0434: Improve JAXP HTTP\n handling o S8001242: Improve RMI HTTP conformance o\n S8001307: Modify ACC_SUPER behavior o S8001972,\n CVE-2013-1478: Improve image processing o S8002325,\n CVE-2013-1480: Improve management of images\n *\n\n Backports\n\n o S7010849: 5/5 Extraneous javac source/target\n options when building sa-jdi o S8004341: Two JCK tests\n fails with 7u11 b06 o S8005615: Java Logger fails to load\n tomcat logger implementation (JULI)\n *\n\n Bug fixes\n\n o PR1297: cacao and jamvm parallel unpack\n failures o PR1301: PR1171 causes builds of Zero to fail\n\n", "edition": 1, "modified": "2013-02-20T16:04:20", "published": "2013-02-20T16:04:20", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00015.html", "id": "SUSE-SU-2013:0315-1", "title": "Security update for Java 1.6.0 (important)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:41:29", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "OpenJDK (java-1_6_0-openjdk) was updated to 1.12.2 to fix\n bugs and security issues (bnc#801972)\n\n * Security fixes (on top of 1.12.0)\n - S6563318, CVE-2013-0424: RMI data sanitization\n - S6664509, CVE-2013-0425: Add logging context\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n - S7141694, CVE-2013-0429: Improving CORBA internals\n - S7173145: Improve in-memory representation of\n splashscreens\n - S7186945: Unpack200 improvement\n - S7186946: Refine unpacker resource usage\n - S7186948: Improve Swing data validation\n - S7186952, CVE-2013-0432: Improve clipboard access\n - S7186954: Improve connection performance\n - S7186957: Improve Pack200 data validation\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n - S7197546, CVE-2013-0428: (proxy) Reflect about creating\n reflective proxies\n - S7200491: Tighten up JTable layout code\n - S7200500: Launcher better input validation\n - S7201064: Better dialogue checking\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n - S7201068, CVE-2013-0435: Better handling of UI elements\n - S7201070: Serialization to conform to protocol\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n - S8000210: Improve JarFile code quality\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n", "edition": 1, "modified": "2013-02-19T11:04:35", "published": "2013-02-19T11:04:35", "id": "OPENSUSE-SU-2013:0308-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00013.html", "type": "suse", "title": "java-1_6_0-openjdk to 1.12.2 (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:57:01", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "OpenJDK (java-1_6_0-openjdk) was updated to 1.12.1 to fix\n bugs and security issues (bnc#801972)\n\n * Security fixes (on top of 1.12.0)\n - S6563318, CVE-2013-0424: RMI data sanitization\n - S6664509, CVE-2013-0425: Add logging context\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n - S7141694, CVE-2013-0429: Improving CORBA internals\n - S7173145: Improve in-memory representation of\n splashscreens\n - S7186945: Unpack200 improvement\n - S7186946: Refine unpacker resource usage\n - S7186948: Improve Swing data validation\n - S7186952, CVE-2013-0432: Improve clipboard access\n - S7186954: Improve connection performance\n - S7186957: Improve Pack200 data validation\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n - S7197546, CVE-2013-0428: (proxy) Reflect about creating\n reflective proxies\n - S7200491: Tighten up JTable layout code\n - S7200500: Launcher better input validation\n - S7201064: Better dialogue checking\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n - S7201068, CVE-2013-0435: Better handling of UI elements\n - S7201070: Serialization to conform to protocol\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n - S8000210: Improve JarFile code quality\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n", "edition": 1, "modified": "2013-02-19T15:04:26", "published": "2013-02-19T15:04:26", "id": "OPENSUSE-SU-2013:0312-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00014.html", "type": "suse", "title": "java-1_6_0-openjdk to 1.12.1 (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:15:24", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0431", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0444", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "java-1_7_0-openjdk was updated to icedtea-2.3.6\n (bnc#803379) containing various security and bugfixes:\n\n * Security fixes\n - S6563318, CVE-2013-0424: RMI data sanitization\n - S6664509, CVE-2013-0425: Add logging context\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n - S7141694, CVE-2013-0429: Improving CORBA internals\n - S7173145: Improve in-memory representation of\n splashscreens\n - S7186945: Unpack200 improvement\n - S7186946: Refine unpacker resource usage\n - S7186948: Improve Swing data validation\n - S7186952, CVE-2013-0432: Improve clipboard access\n - S7186954: Improve connection performance\n - S7186957: Improve Pack200 data validation\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n - S7197546, CVE-2013-0428: (proxy) Reflect about creating\n reflective proxies\n - S7200491: Tighten up JTable layout code\n - S7200493, CVE-2013-0444: Improve cache handling\n - S7200499: Better data validation for options\n - S7200500: Launcher better input validation\n - S7201064: Better dialogue checking\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n - S7201068, CVE-2013-0435: Better handling of UI elements\n - S7201070: Serialization to conform to protocol\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n - S8000210: Improve JarFile code quality\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n - S8000539, CVE-2013-0431: Introspect JMX data handling\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n - S8001242: Improve RMI HTTP conformance\n - S8001307: Modify ACC_SUPER behavior\n - S8001972, CVE-2013-1478: Improve image processing\n - S8002325, CVE-2013-1480: Improve management of images\n * Backports\n - S7057320:\n test/java/util/concurrent/Executors/AutoShutdown.java\n failing intermittently\n - S7083664: TEST_BUG: test hard code of using c:/temp but\n this dir might not exist\n - S7107613: scalability blocker in\n javax.crypto.CryptoPermissions\n - S7107616: scalability blocker in\n javax.crypto.JceSecurityManager\n - S7146424: Wildcard expansion for single entry classpath\n - S7160609: [macosx] JDK crash in libjvm.dylib ( C\n [GeForceGLDriver+0x675a] gldAttachDrawable+0x941)\n - S7160951: [macosx] ActionListener called twice for\n JMenuItem using ScreenMenuBar\n - S7162488: VM not printing unknown -XX options\n - S7169395: Exception throws due to the changes in JDK 7\n object tranversal and break backward compatibility\n - S7175616: Port fix for TimeZone from JDK 8 to JDK 7\n - S7176485: (bf) Allow temporary buffer cache to grow to\n IOV_MAX\n - S7179908: Fork hs23.3 hsx from hs22.2 for jdk7u7 and\n reinitialize build number\n - S7184326: TEST_BUG:\n java/awt/Frame/7024749/bug7024749.java has a typo\n - S7185245: Licensee source bundle tries to compile JFR\n - S7185471: Avoid key expansion when AES cipher is\n re-init w/ the same key\n - S7186371: [macosx] Main menu shortcuts not displayed\n (7u6 regression)\n - S7187834: [macosx] Usage of private API in macosx 2d\n implementation causes Apple Store rejection\n - S7188114: (launcher) need an alternate command line\n parser for Windows\n - S7189136: Fork hs23.5 hsx from hs23.4 for jdk7u9 and\n reinitialize build number\n - S7189350: Fix failed for CR 7162144\n - S7190550: REGRESSION: Some closed/com/oracle/jfr/api\n tests fail to compile becuse of fix 7185245\n - S7193219: JComboBox serialization fails in JDK 1.7\n - S7193977: REGRESSION:Java 7's JavaBeans persistence\n ignoring the "transient" flag on properties\n - S7195106: REGRESSION : There is no way to get Icon inf,\n once Softreference is released\n - S7195301: XML Signature DOM implementation should not\n use instanceof to determine type of Node\n - S7195931: UnsatisfiedLinkError on\n PKCS11.C_GetOperationState while using NSS from jre7u6+\n - S7197071: Makefiles for various security providers\n aren't including the default manifest.\n - S7197652: Impossible to run any signed JNLP\n applications or applets, OCSP off by default\n - S7198146: Another new regression test does not compile\n on windows-amd64\n - S7198570: (tz) Support tzdata2012f\n - S7198640: new hotspot build - hs23.6-b04\n - S7199488: [TEST] runtime/7158800/InternTest.java failed\n due to false-positive on PID match.\n - S7199645: Increment build # of hs23.5 to b02\n - S7199669: Update tags in .hgtags file for CPU release\n rename\n - S7200720: crash in net.dll during NTLM authentication\n - S7200742: (se) Selector.select does not block when\n starting Coherence (sol11u1)\n - S7200762: [macosx] Stuck in\n sun.java2d.opengl.CGLGraphicsConfig.getMaxTextureSize(Native\n Method)\n - S8000285: Deadlock between PostEventQueue.noEvents,\n EventQueue.isDispatchThread and\n SwingUtilities.invokeLater\n - S8000286: [macosx] Views keep scrolling back to the\n drag position after DnD\n - S8000297: REGRESSION:\n closed/java/awt/EventQueue/PostEventOrderingTest.java\n fails\n - S8000307: Jre7cert: focusgained does not get called for\n all focus req when do alt + tab\n - S8000822: Fork hs23.7 hsx from hs23.6 for jdk7u11 and\n reinitialize build number\n - S8001124: jdk7u ProblemList.txt updates (10/2012)\n - S8001242: Improve RMI HTTP conformance\n - S8001808: Create a test for 8000327\n - S8001876: Create regtest for 8000283\n - S8002068: Build broken: corba code changes unable to\n use new JDK 7 classes\n - S8002091: tools/launcher/ToolsOpts.java test started to\n fail since 7u11 b01 on Windows\n - S8002114: fix failed for JDK-7160951: [macosx]\n ActionListener called twice for JMenuItem using\n ScreenMenuBar\n - S8002225: (tz) Support tzdata2012i\n - S8003402: (dc)\n test/java/nio/channels/DatagramChannel/SendToUnresovled.java\n failing after 7u11 cleanup issues\n - S8003403: Test ShortRSAKeyWithinTLS and\n ClientJSSEServerJSSE failing after 7u11 cleanup\n - S8003948: NTLM/Negotiate authentication problem\n - S8004175: Restricted packages added in java.security\n are missing in java.security-{macosx, solaris, windows}\n - S8004302: javax/xml/soap/Test7013971.java fails since\n jdk6u39b01\n - S8004341: Two JCK tests fails with 7u11 b06\n - S8005615: Java Logger fails to load tomcat logger\n implementation (JULI)\n * Bug fixes\n - Fix build using Zero's HotSpot so all patches apply\n again.\n - PR1295: jamvm parallel unpack failure\n * removed\n icedtea-2.3.2-fix-extract-jamvm-dependency.patch\n - removed\n icedtea-2.3.3-refresh-6924259-string_offset.patch\n\n - few missing /openjdk/%{origin}/ changes\n\n", "edition": 1, "modified": "2013-03-01T17:05:38", "published": "2013-03-01T17:05:38", "id": "OPENSUSE-SU-2013:0377-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html", "title": "java-1_7_0-openjdk: update to 2.3.6 (critical)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:29:41", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425"], "description": "IBM Java 1.4.2 has been updated to SR13-FP15 which fixes\n various critical security issues and bugs.\n\n Please see the IBM JDK Alert page for more information:\n\n <a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>\n <<a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>>\n\n Security issues fixed:\n\n CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442,\n CVE-2013-0425, CVE-2013-0426, CVE-2013-0428,\n CVE-2013-1481, CVE-2013-0432, CVE-2013-0434,\n CVE-2013-0424, CVE-2013-0440, CVE-2013-0443.\n\n", "edition": 1, "modified": "2013-03-14T23:04:46", "published": "2013-03-14T23:04:46", "id": "SUSE-SU-2013:0440-3", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00022.html", "type": "suse", "title": "Security update for Java (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:36:29", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425"], "description": "IBM Java 1.4.2 has been updated to SR13-FP15 which fixes\n various critical security issues and bugs.\n\n Please see the IBM JDK Alert page for more information:\n\n <a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>\n <<a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>>\n\n Security issues fixed:\n\n CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442,\n CVE-2013-0425, CVE-2013-0426, CVE-2013-0428,\n CVE-2013-1481, CVE-2013-0432, CVE-2013-0434,\n CVE-2013-0424, CVE-2013-0440, CVE-2013-0443.\n\n", "edition": 1, "modified": "2013-03-13T18:04:30", "published": "2013-03-13T18:04:30", "id": "SUSE-SU-2013:0440-2", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00016.html", "type": "suse", "title": "Security update for Java (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:51:43", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425"], "description": "IBM Java 1.4.2 has been updated to SR13-FP15 which fixes\n various critical security issues and bugs.\n\n Please see the IBM JDK Alert page for more information:\n\n <a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>\n <<a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>>\n\n Security issues fixed:\n\n CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442,\n CVE-2013-0425, CVE-2013-0426, CVE-2013-0428,\n CVE-2013-1481, CVE-2013-0432, CVE-2013-0434,\n CVE-2013-0424, CVE-2013-0440, CVE-2013-0443.\n\n\n", "edition": 1, "modified": "2013-03-18T22:04:28", "published": "2013-03-18T22:04:28", "id": "SUSE-SU-2013:0478-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00034.html", "type": "suse", "title": "Security update for IBM Java2 JRE and SDK (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:28:41", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-0409", "CVE-2013-1486", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425"], "description": "IBM Java 5 has been updated to SR16 which fixes various\n critical security issues and bugs.\n\n Please see the IBM JDK Alert page for more information:\n\n <a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>\n <<a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>>\n\n Security issues fixed:\n\n CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480,\n CVE-2013-1476, CVE-2013-0442, CVE-2013-0425,\n CVE-2013-0426, CVE-2013-0428, CVE-2013-1481,\n CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427,\n CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443.\n\n\n", "edition": 1, "modified": "2013-03-16T17:06:57", "published": "2013-03-16T17:06:57", "id": "SUSE-SU-2013:0440-5", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00032.html", "title": "Security update for IBM Java5 JRE and SDK (important)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:50:34", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-0409", "CVE-2013-1486", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425"], "edition": 1, "description": "IBM Java 5 has been updated to SR16 which fixes various\n critical security issues and bugs.\n\n Please see the IBM JDK Alert page for more information:\n\n <a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>\n <<a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>>\n\n Security issues fixed:\n\n CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480,\n CVE-2013-1476, CVE-2013-0442, CVE-2013-0425,\n CVE-2013-0426, CVE-2013-0428, CVE-2013-1481,\n CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427,\n CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443.\n\n\n", "modified": "2013-03-15T20:04:28", "published": "2013-03-15T20:04:28", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00030.html", "id": "SUSE-SU-2013:0440-4", "type": "suse", "title": "Security update for Java (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:45:49", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-0409", "CVE-2013-1486", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425"], "description": "IBM Java 5 has been updated to SR16 which fixes various\n critical security issues and bugs.\n\n Please see the IBM JDK Alert page for more information:\n\n <a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>\n <<a rel=\"nofollow\" href=\"http://www.ibm.com/developerworks/java/jdk/alerts/\">http://www.ibm.com/developerworks/java/jdk/alerts/</a>>\n\n Security issues fixed:\n\n CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480,\n CVE-2013-1476, CVE-2013-0442, CVE-2013-0425,\n CVE-2013-0426, CVE-2013-0428, CVE-2013-1481,\n CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427,\n CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443.\n\n\n", "edition": 1, "modified": "2013-03-18T21:04:29", "published": "2013-03-18T21:04:29", "id": "SUSE-SU-2013:0440-6", "href": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00033.html", "title": "Security update for Java (important)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2019-05-29T18:38:02", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:1361412562310865341", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310865341", "type": "openvas", "title": "Fedora Update for java-1.7.0-openjdk FEDORA-2013-2205", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for java-1.7.0-openjdk FEDORA-2013-2205\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098445.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.865341\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:14:28 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0443\", \"CVE-2013-0440\",\n \"CVE-2013-0442\", \"CVE-2013-0428\", \"CVE-2013-0441\", \"CVE-2013-0435\",\n \"CVE-2013-0433\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\",\n \"CVE-2013-0434\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"FEDORA\", value:\"2013-2205\");\n script_name(\"Fedora Update for java-1.7.0-openjdk FEDORA-2013-2205\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1.7.0-openjdk'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC18\");\n script_tag(name:\"affected\", value:\"java-1.7.0-openjdk on Fedora 18\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC18\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.9~2.3.5.3.fc18\", rls:\"FC18\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2018-02-06T13:09:54", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Check for the Version of java-1.7.0-openjdk", "modified": "2018-02-05T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:865341", "href": "http://plugins.openvas.org/nasl.php?oid=865341", "type": "openvas", "title": "Fedora Update for java-1.7.0-openjdk FEDORA-2013-2205", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for java-1.7.0-openjdk FEDORA-2013-2205\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"java-1.7.0-openjdk on Fedora 18\";\ntag_insight = \"The OpenJDK runtime environment.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098445.html\");\n script_id(865341);\n script_version(\"$Revision: 8672 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-02-05 17:39:18 +0100 (Mon, 05 Feb 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:14:28 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0443\", \"CVE-2013-0440\",\n \"CVE-2013-0442\", \"CVE-2013-0428\", \"CVE-2013-0441\", \"CVE-2013-0435\",\n \"CVE-2013-0433\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\",\n \"CVE-2013-0434\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2013-2205\");\n script_name(\"Fedora Update for java-1.7.0-openjdk FEDORA-2013-2205\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of java-1.7.0-openjdk\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC18\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.9~2.3.5.3.fc18\", rls:\"FC18\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:05", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:1361412562310881597", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881597", "type": "openvas", "title": "CentOS Update for java CESA-2013:0246 centos5", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for java CESA-2013:0246 centos5\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2013-February/019231.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.881597\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:22:14 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\",\n \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\",\n \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\",\n \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"CESA\", value:\"2013:0246\");\n script_name(\"CentOS Update for java CESA-2013:0246 centos5\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS5\");\n script_tag(name:\"affected\", value:\"java on CentOS 5\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"insight\", value:\"These packages provide the OpenJDK 6 Java Runtime Environment and the\n OpenJDK 6 Software Development Kit.\n\n Multiple improper permission check issues were discovered in the AWT,\n CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\n application or applet could use these flaws to bypass Java sandbox\n restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\n CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\n CVE-2013-0428)\n\n Multiple flaws were found in the way image parsers in the 2D and AWT\n components handled image raster parameters. A specially-crafted image could\n cause Java Virtual Machine memory corruption and, possibly, lead to\n arbitrary code execution with the virtual machine privileges.\n (CVE-2013-1478, CVE-2013-1480)\n\n A flaw was found in the AWT component's clipboard handling code. An\n untrusted Java application or applet could use this flaw to access\n clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\n The default Java security properties configuration did not restrict access\n to certain com.sun.xml.internal packages. An untrusted Java application or\n applet could use this flaw to access information, bypassing certain Java\n sandbox restrictions. This update lists the whole package as restricted.\n (CVE-2013-0435)\n\n Multiple improper permission check issues were discovered in the Libraries,\n Networking, and JAXP components. An untrusted Java application or applet\n could use these flaws to bypass certain Java sandbox restrictions.\n (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\n It was discovered that the RMI component's CGIHandler class used user\n inputs in error messages without any sanitization. An attacker could use\n this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\n It was discovered that the SSL/TLS implementation in the JSSE component\n did not properly enforce handshake message ordering, allowing an unlimited\n number of handshake restarts. A remote attacker could use this flaw to\n make an SSL/TLS server using JSSE consume an excessive amount of CPU by\n continuously restarting the handshake. (CVE-2013-0440)\n\n It was discovered that the JSSE component did not properly validate\n Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\n to perform a small subgroup attack. (CVE-2013-0443)\n\n This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\n the NEWS file, linked to in the References, for further information.\n\n All users of java-1.6.0-openjdk are advised to upgrade to these updated\n packages, which resolve these issues. All running instances of OpenJDK Java\n must be restarted for the update to take effect.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-demo\", rpm:\"java-1.6.0-openjdk-demo~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-src\", rpm:\"java-1.6.0-openjdk-src~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2018-01-18T11:09:34", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Check for the Version of java-1.6.0-openjdk", "modified": "2018-01-17T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:870905", "href": "http://plugins.openvas.org/nasl.php?oid=870905", "type": "openvas", "title": "RedHat Update for java-1.6.0-openjdk RHSA-2013:0246-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for java-1.6.0-openjdk RHSA-2013:0246-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"These packages provide the OpenJDK 6 Java Runtime Environment and the\n OpenJDK 6 Software Development Kit.\n\n Multiple improper permission check issues were discovered in the AWT,\n CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\n application or applet could use these flaws to bypass Java sandbox\n restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\n CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\n CVE-2013-0428)\n\n Multiple flaws were found in the way image parsers in the 2D and AWT\n components handled image raster parameters. A specially-crafted image could\n cause Java Virtual Machine memory corruption and, possibly, lead to\n arbitrary code execution with the virtual machine privileges.\n (CVE-2013-1478, CVE-2013-1480)\n\n A flaw was found in the AWT component's clipboard handling code. An\n untrusted Java application or applet could use this flaw to access\n clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\n The default Java security properties configuration did not restrict access\n to certain com.sun.xml.internal packages. An untrusted Java application or\n applet could use this flaw to access information, bypassing certain Java\n sandbox restrictions. This update lists the whole package as restricted.\n (CVE-2013-0435)\n\n Multiple improper permission check issues were discovered in the Libraries,\n Networking, and JAXP components. An untrusted Java application or applet\n could use these flaws to bypass certain Java sandbox restrictions.\n (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\n It was discovered that the RMI component's CGIHandler class used user\n inputs in error messages without any sanitization. An attacker could use\n this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\n It was discovered that the SSL/TLS implementation in the JSSE component\n did not properly enforce handshake message ordering, allowing an unlimited\n number of handshake restarts. A remote attacker could use this flaw to\n make an SSL/TLS server using JSSE consume an excessive amount of CPU by\n continuously restarting the handshake. (CVE-2013-0440)\n\n It was discovered that the JSSE component did not properly validate\n Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\n to perform a small subgroup attack. (CVE-2013-0443)\n\n This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\n the NEWS file, linked to in the References, for further information.\n\n All users of java-1.6.0-openjdk are advised to upgrade to these updated\n packages, which resolve these issues. All running instances of OpenJDK Java\n must be restarted for the update to take effect.\";\n\n\ntag_affected = \"java-1.6.0-openjdk on Red Hat Enterprise Linux (v. 5 server)\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/rhsa-announce/2013-February/msg00014.html\");\n script_id(870905);\n script_version(\"$Revision: 8448 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 17:18:06 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:17:05 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\",\n \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\",\n \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\",\n \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"RHSA\", value: \"2013:0246-01\");\n script_name(\"RedHat Update for java-1.6.0-openjdk RHSA-2013:0246-01\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of java-1.6.0-openjdk\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-debuginfo\", rpm:\"java-1.6.0-openjdk-debuginfo~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-demo\", rpm:\"java-1.6.0-openjdk-demo~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-src\", rpm:\"java-1.6.0-openjdk-src~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-27T10:51:33", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Check for the Version of java-1.6.0-openjdk", "modified": "2017-07-12T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:870906", "href": "http://plugins.openvas.org/nasl.php?oid=870906", "type": "openvas", "title": "RedHat Update for java-1.6.0-openjdk RHSA-2013:0245-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for java-1.6.0-openjdk RHSA-2013:0245-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"These packages provide the OpenJDK 6 Java Runtime Environment and the\n OpenJDK 6 Software Development Kit.\n\n Multiple improper permission check issues were discovered in the AWT,\n CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\n application or applet could use these flaws to bypass Java sandbox\n restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\n CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\n CVE-2013-0428)\n\n Multiple flaws were found in the way image parsers in the 2D and AWT\n components handled image raster parameters. A specially-crafted image could\n cause Java Virtual Machine memory corruption and, possibly, lead to\n arbitrary code execution with the virtual machine privileges.\n (CVE-2013-1478, CVE-2013-1480)\n\n A flaw was found in the AWT component's clipboard handling code. An\n untrusted Java application or applet could use this flaw to access\n clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\n The default Java security properties configuration did not restrict access\n to certain com.sun.xml.internal packages. An untrusted Java application or\n applet could use this flaw to access information, bypassing certain Java\n sandbox restrictions. This update lists the whole package as restricted.\n (CVE-2013-0435)\n\n Multiple improper permission check issues were discovered in the Libraries,\n Networking, and JAXP components. An untrusted Java application or applet\n could use these flaws to bypass certain Java sandbox restrictions.\n (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\n It was discovered that the RMI component's CGIHandler class used user\n inputs in error messages without any sanitization. An attacker could use\n this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\n It was discovered that the SSL/TLS implementation in the JSSE component\n did not properly enforce handshake message ordering, allowing an unlimited\n number of handshake restarts. A remote attacker could use this flaw to\n make an SSL/TLS server using JSSE consume an excessive amount of CPU by\n continuously restarting the handshake. (CVE-2013-0440)\n\n It was discovered that the JSSE component did not properly validate\n Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\n to perform a small subgroup attack. (CVE-2013-0443)\n\n Note: If the web browser plug-in provided by the icedtea-web package was\n installed, the issue ...\n\n Description truncated, for more information please check the Reference URL\";\n\n\ntag_affected = \"java-1.6.0-openjdk on Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Workstation (v. 6)\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/rhsa-announce/2013-February/msg00013.html\");\n script_id(870906);\n script_version(\"$Revision: 6687 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:46:43 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:18:16 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\",\n \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\",\n \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\",\n \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"RHSA\", value: \"2013:0245-01\");\n script_name(\"RedHat Update for java-1.6.0-openjdk RHSA-2013:0245-01\");\n\n script_summary(\"Check for the Version of java-1.6.0-openjdk\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-debuginfo\", rpm:\"java-1.6.0-openjdk-debuginfo~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-24T11:09:21", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Check for the Version of java", "modified": "2018-01-24T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:881598", "href": "http://plugins.openvas.org/nasl.php?oid=881598", "type": "openvas", "title": "CentOS Update for java CESA-2013:0245 centos6 ", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for java CESA-2013:0245 centos6 \n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"These packages provide the OpenJDK 6 Java Runtime Environment and the\n OpenJDK 6 Software Development Kit.\n\n Multiple improper permission check issues were discovered in the AWT,\n CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\n application or applet could use these flaws to bypass Java sandbox\n restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\n CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\n CVE-2013-0428)\n \n Multiple flaws were found in the way image parsers in the 2D and AWT\n components handled image raster parameters. A specially-crafted image could\n cause Java Virtual Machine memory corruption and, possibly, lead to\n arbitrary code execution with the virtual machine privileges.\n (CVE-2013-1478, CVE-2013-1480)\n \n A flaw was found in the AWT component's clipboard handling code. An\n untrusted Java application or applet could use this flaw to access\n clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n \n The default Java security properties configuration did not restrict access\n to certain com.sun.xml.internal packages. An untrusted Java application or\n applet could use this flaw to access information, bypassing certain Java\n sandbox restrictions. This update lists the whole package as restricted.\n (CVE-2013-0435)\n \n Multiple improper permission check issues were discovered in the Libraries,\n Networking, and JAXP components. An untrusted Java application or applet\n could use these flaws to bypass certain Java sandbox restrictions.\n (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n \n It was discovered that the RMI component's CGIHandler class used user\n inputs in error messages without any sanitization. An attacker could use\n this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n \n It was discovered that the SSL/TLS implementation in the JSSE component\n did not properly enforce handshake message ordering, allowing an unlimited\n number of handshake restarts. A remote attacker could use this flaw to\n make an SSL/TLS server using JSSE consume an excessive amount of CPU by\n continuously restarting the handshake. (CVE-2013-0440)\n \n It was discovered that the JSSE component did not properly validate\n Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\n to perform a small subgroup attack. (CVE-2013-0443)\n \n Note: If the web browser plug-in provided by the icedtea-web package was\n installed, the issues exposed via Java applets could have been exploited\n without user interaction if a user visited a malicious website.\n \n This errat ... \n\n Description truncated, for more information please check the Reference URL\";\n\n\ntag_affected = \"java on CentOS 6\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2013-February/019233.html\");\n script_id(881598);\n script_version(\"$Revision: 8509 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-24 07:57:46 +0100 (Wed, 24 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:23:28 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\",\n \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\",\n \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\",\n \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"CESA\", value: \"2013:0245\");\n script_name(\"CentOS Update for java CESA-2013:0245 centos6 \");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of java\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-demo\", rpm:\"java-1.6.0-openjdk-demo~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-src\", rpm:\"java-1.6.0-openjdk-src~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:36:45", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Oracle Linux Local Security Checks ELSA-2013-0246", "modified": "2018-09-28T00:00:00", "published": "2015-10-06T00:00:00", "id": "OPENVAS:1361412562310123727", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123727", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2013-0246", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2013-0246.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.123727\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:07:44 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2013-0246\");\n script_tag(name:\"insight\", value:\"ELSA-2013-0246 - java-1.6.0-openjdk security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2013-0246\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2013-0246.html\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1480\", \"CVE-2013-1478\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-1476\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.33.1.11.6.0.1.el5_9\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-demo\", rpm:\"java-1.6.0-openjdk-demo~1.6.0.0~1.33.1.11.6.0.1.el5_9\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.33.1.11.6.0.1.el5_9\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.33.1.11.6.0.1.el5_9\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-src\", rpm:\"java-1.6.0-openjdk-src~1.6.0.0~1.33.1.11.6.0.1.el5_9\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2018-02-05T11:11:35", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Check for the Version of java", "modified": "2018-02-03T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:881597", "href": "http://plugins.openvas.org/nasl.php?oid=881597", "type": "openvas", "title": "CentOS Update for java CESA-2013:0246 centos5 ", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for java CESA-2013:0246 centos5 \n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"These packages provide the OpenJDK 6 Java Runtime Environment and the\n OpenJDK 6 Software Development Kit.\n\n Multiple improper permission check issues were discovered in the AWT,\n CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\n application or applet could use these flaws to bypass Java sandbox\n restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\n CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\n CVE-2013-0428)\n \n Multiple flaws were found in the way image parsers in the 2D and AWT\n components handled image raster parameters. A specially-crafted image could\n cause Java Virtual Machine memory corruption and, possibly, lead to\n arbitrary code execution with the virtual machine privileges.\n (CVE-2013-1478, CVE-2013-1480)\n \n A flaw was found in the AWT component's clipboard handling code. An\n untrusted Java application or applet could use this flaw to access\n clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n \n The default Java security properties configuration did not restrict access\n to certain com.sun.xml.internal packages. An untrusted Java application or\n applet could use this flaw to access information, bypassing certain Java\n sandbox restrictions. This update lists the whole package as restricted.\n (CVE-2013-0435)\n \n Multiple improper permission check issues were discovered in the Libraries,\n Networking, and JAXP components. An untrusted Java application or applet\n could use these flaws to bypass certain Java sandbox restrictions.\n (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n \n It was discovered that the RMI component's CGIHandler class used user\n inputs in error messages without any sanitization. An attacker could use\n this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n \n It was discovered that the SSL/TLS implementation in the JSSE component\n did not properly enforce handshake message ordering, allowing an unlimited\n number of handshake restarts. A remote attacker could use this flaw to\n make an SSL/TLS server using JSSE consume an excessive amount of CPU by\n continuously restarting the handshake. (CVE-2013-0440)\n \n It was discovered that the JSSE component did not properly validate\n Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\n to perform a small subgroup attack. (CVE-2013-0443)\n \n This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\n the NEWS file, linked to in the References, for further information.\n \n All users of java-1.6.0-openjdk are advised to upgrade to these updated\n packages, which resolve these issues. All running instances of OpenJDK Java\n must be restarted for the update to take effect.\";\n\n\ntag_affected = \"java on CentOS 5\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2013-February/019231.html\");\n script_id(881597);\n script_version(\"$Revision: 8650 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-02-03 13:16:59 +0100 (Sat, 03 Feb 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:22:14 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\",\n \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\",\n \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\",\n \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"CESA\", value: \"2013:0246\");\n script_name(\"CentOS Update for java CESA-2013:0246 centos5 \");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of java\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-demo\", rpm:\"java-1.6.0-openjdk-demo~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-src\", rpm:\"java-1.6.0-openjdk-src~1.6.0.0~1.33.1.11.6.el5_9\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:36:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "Oracle Linux Local Security Checks ELSA-2013-0245", "modified": "2018-09-28T00:00:00", "published": "2015-10-06T00:00:00", "id": "OPENVAS:1361412562310123729", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123729", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2013-0245", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2013-0245.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.123729\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:07:46 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2013-0245\");\n script_tag(name:\"insight\", value:\"ELSA-2013-0245 - java-1.6.0-openjdk security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2013-0245\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2013-0245.html\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux6\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux6\")\n{\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-demo\", rpm:\"java-1.6.0-openjdk-demo~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-src\", rpm:\"java-1.6.0-openjdk-src~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:37:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2013-02-11T00:00:00", "id": "OPENVAS:1361412562310870906", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870906", "type": "openvas", "title": "RedHat Update for java-1.6.0-openjdk RHSA-2013:0245-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for java-1.6.0-openjdk RHSA-2013:0245-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2013-February/msg00013.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.870906\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-02-11 10:18:16 +0530 (Mon, 11 Feb 2013)\");\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\",\n \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\",\n \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\",\n \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\",\n \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"RHSA\", value:\"2013:0245-01\");\n script_name(\"RedHat Update for java-1.6.0-openjdk RHSA-2013:0245-01\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1.6.0-openjdk'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_6\");\n script_tag(name:\"affected\", value:\"java-1.6.0-openjdk on Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Workstation (v. 6)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"These packages provide the OpenJDK 6 Java Runtime Environment and the\n OpenJDK 6 Software Development Kit.\n\n Multiple improper permission check issues were discovered in the AWT,\n CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\n application or applet could use these flaws to bypass Java sandbox\n restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\n CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\n CVE-2013-0428)\n\n Multiple flaws were found in the way image parsers in the 2D and AWT\n components handled image raster parameters. A specially-crafted image could\n cause Java Virtual Machine memory corruption and, possibly, lead to\n arbitrary code execution with the virtual machine privileges.\n (CVE-2013-1478, CVE-2013-1480)\n\n A flaw was found in the AWT component's clipboard handling code. An\n untrusted Java application or applet could use this flaw to access\n clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\n The default Java security properties configuration did not restrict access\n to certain com.sun.xml.internal packages. An untrusted Java application or\n applet could use this flaw to access information, bypassing certain Java\n sandbox restrictions. This update lists the whole package as restricted.\n (CVE-2013-0435)\n\n Multiple improper permission check issues were discovered in the Libraries,\n Networking, and JAXP components. An untrusted Java application or applet\n could use these flaws to bypass certain Java sandbox restrictions.\n (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\n It was discovered that the RMI component's CGIHandler class used user\n inputs in error messages without any sanitization. An attacker could use\n this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\n It was discovered that the SSL/TLS implementation in the JSSE component\n did not properly enforce handshake message ordering, allowing an unlimited\n number of handshake restarts. A remote attacker could use this flaw to\n make an SSL/TLS server using JSSE consume an excessive amount of CPU by\n continuously restarting the handshake. (CVE-2013-0440)\n\n It was discovered that the JSSE component did not properly validate\n Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\n to perform a small subgroup attack. (CVE-2013-0443)\n\n Note: If the web browser plug-in provided by the icedtea-web package was\n installed, the issue ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk\", rpm:\"java-1.6.0-openjdk~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-debuginfo\", rpm:\"java-1.6.0-openjdk-debuginfo~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-devel\", rpm:\"java-1.6.0-openjdk-devel~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.6.0-openjdk-javadoc\", rpm:\"java-1.6.0-openjdk-javadoc~1.6.0.0~1.54.1.11.6.el6_3\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "fedora": [{"lastseen": "2020-12-21T08:17:51", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0450", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480"], "description": "The OpenJDK runtime environment. ", "modified": "2013-02-09T11:29:39", "published": "2013-02-09T11:29:39", "id": "FEDORA:3B8F6208CD", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 18 Update: java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc18", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:51", "bulletinFamily": "unix", "cvelist": ["CVE-2012-4681", "CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0450", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480"], "description": "The OpenJDK runtime environment. ", "modified": "2013-02-09T11:30:33", "published": "2013-02-09T11:30:33", "id": "FEDORA:A2D5520A3D", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 17 Update: java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc17", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-01-20T14:39:22", "description": "java-1_6_0-openjdk based on Icedtea6-1.12.2 was released, fixing\nvarious security issues :\n\nNew in release 1.12.2 (2012-02-03) :\n\n - Security fixes\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of TLS\n Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about creating\n reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress serialization\n issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\n - Backports\n\n - S7010849: 5/5 Extraneous javac source/target options\n when building sa-jdi\n\n - S8004341: Two JCK tests fails with 7u11 b06\n\n - S8005615: Java Logger fails to load tomcat logger\n implementation (JULI)\n\n - Bug fixes\n\n - PR1297: cacao and jamvm parallel unpack failures\n\n - PR1301: PR1171 causes builds of Zero to fail", "edition": 18, "published": "2013-02-21T00:00:00", "title": "SuSE 11.2 Security Update : Java 1.6.0 (SAT Patch Number 7332)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-21T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:11:java-1_6_0-openjdk", "cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:11:java-1_6_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:11:java-1_6_0-openjdk-demo"], "id": "SUSE_11_JAVA-1_6_0-OPENJDK-130212.NASL", "href": "https://www.tenable.com/plugins/nessus/64780", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from SuSE 11 update information. The text itself is\n# copyright (C) Novell, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64780);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n\n script_name(english:\"SuSE 11.2 Security Update : Java 1.6.0 (SAT Patch Number 7332)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 11 host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"java-1_6_0-openjdk based on Icedtea6-1.12.2 was released, fixing\nvarious security issues :\n\nNew in release 1.12.2 (2012-02-03) :\n\n - Security fixes\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of TLS\n Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about creating\n reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress serialization\n issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\n - Backports\n\n - S7010849: 5/5 Extraneous javac source/target options\n when building sa-jdi\n\n - S8004341: Two JCK tests fails with 7u11 b06\n\n - S8005615: Java Logger fails to load tomcat logger\n implementation (JULI)\n\n - Bug fixes\n\n - PR1297: cacao and jamvm parallel unpack failures\n\n - PR1301: PR1171 causes builds of Zero to fail\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=494536\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=792951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=801972\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0424.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0425.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0426.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0427.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0428.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0429.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0432.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0433.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0434.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0435.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0440.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0441.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0442.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0443.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-0450.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-1475.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-1476.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-1478.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2013-1480.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply SAT patch number 7332.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:java-1_6_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:java-1_6_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:java-1_6_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)11\") audit(AUDIT_OS_NOT, \"SuSE 11\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SuSE 11\", cpu);\n\npl = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(pl) || int(pl) != 2) audit(AUDIT_OS_NOT, \"SuSE 11.2\");\n\n\nflag = 0;\nif (rpm_check(release:\"SLED11\", sp:2, cpu:\"i586\", reference:\"java-1_6_0-openjdk-1.6.0.0_b27.1.12.2-0.2.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:2, cpu:\"i586\", reference:\"java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.2-0.2.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:2, cpu:\"i586\", reference:\"java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.2-0.2.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:2, cpu:\"x86_64\", reference:\"java-1_6_0-openjdk-1.6.0.0_b27.1.12.2-0.2.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:2, cpu:\"x86_64\", reference:\"java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.2-0.2.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:2, cpu:\"x86_64\", reference:\"java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.2-0.2.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:11:23", "description": "The update contains the following security fixes :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\nThis update backs out two of the recent security fixes (664509 and\n7201064) that caused severe regressions. This update backs out two of\nthe recent security fixes (664509 and 7201064) that caused severe\nregressions.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "published": "2013-02-11T00:00:00", "title": "Fedora 17 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc17 (2013-2209)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-11T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:17", "p-cpe:/a:fedoraproject:fedora:java-1.7.0-openjdk"], "id": "FEDORA_2013-2209.NASL", "href": "https://www.tenable.com/plugins/nessus/64550", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-2209.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64550);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2013-2209\");\n\n script_name(english:\"Fedora 17 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc17 (2013-2209)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The update contains the following security fixes :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\nThis update backs out two of the recent security fixes (664509 and\n7201064) that caused severe regressions. This update backs out two of\nthe recent security fixes (664509 and 7201064) that caused severe\nregressions.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098449.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2ac56c30\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.7.0-openjdk package.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:17\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^17([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 17.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC17\", reference:\"java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc17\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:11:21", "description": "This is rebuild of java-1.6.0-openjdk-1.6.0.0-69.1.11.6.fc16 with\nremoved 7201064 and added 8005615 so :\n\nkept rewritten java-1.6.0-openjdk-java-access-bridgesecurity.patch\nkept icedtea6 1.11.6 Security fixes: S8005615, fix for S6664509\nS6563318, CVE-2013-0424: RMI data sanitization S6664509,\nCVE-2013-0425: Add logging context S6664528, CVE-2013-0426: Find log\nlevel matching its name or value given at construction time S6776941:\nCVE-2013-0427: Improve thread pool shutdown S7141694, CVE-2013-0429:\nImproving CORBA internals S7173145: Improve in-memory representation\nof splashscreens S7186945: Unpack200 improvement S7186946: Refine\nunpacker resource usage S7186948: Improve Swing data validation\nS7186952, CVE-2013-0432: Improve clipboard access S7186954: Improve\nconnection performance S7186957: Improve Pack200 data validation\nS7192392, CVE-2013-0443: Better validation of client keys S7192393,\nCVE-2013-0440: Better Checking of order of TLS Messages S7192977,\nCVE-2013-0442: Issue in toolkit thread S7197546, CVE-2013-0428:\n(proxy) Reflect about creating reflective proxies S7200491: Tighten up\nJTable layout code S7200500: Launcher better input validation\nS7201066, CVE-2013-0441: Change modifiers on unused fields S7201068,\nCVE-2013-0435: Better handling of UI elements S7201070: Serialization\nto conform to protocol S7201071, CVE-2013-0433: InetSocketAddress\nserialization issue S8000210: Improve JarFile code quality S8000537,\nCVE-2013-0450: Contextualize RequiredModelMBean class S8000540,\nCVE-2013-1475: Improve IIOP type reuse management S8000631,\nCVE-2013-1476: Restrict access to class constructor S8001235,\nCVE-2013-0434: Improve JAXP HTTP handling S8001242: Improve RMI HTTP\nconformance S8001307: Modify ACC_SUPER behavior S8001972,\nCVE-2013-1478: Improve image processing S8002325, CVE-2013-1480:\nImprove management of images Backports S7010849: 5/5 Extraneous javac\nsource/target options when building sa-jdi\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "published": "2013-02-11T00:00:00", "title": "Fedora 16 : java-1.6.0-openjdk-1.6.0.0-71.1.11.6.fc16 (2013-2197)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:java-1.6.0-openjdk", "cpe:/o:fedoraproject:fedora:16"], "id": "FEDORA_2013-2197.NASL", "href": "https://www.tenable.com/plugins/nessus/64548", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-2197.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64548);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2013-2197\");\n\n script_name(english:\"Fedora 16 : java-1.6.0-openjdk-1.6.0.0-71.1.11.6.fc16 (2013-2197)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This is rebuild of java-1.6.0-openjdk-1.6.0.0-69.1.11.6.fc16 with\nremoved 7201064 and added 8005615 so :\n\nkept rewritten java-1.6.0-openjdk-java-access-bridgesecurity.patch\nkept icedtea6 1.11.6 Security fixes: S8005615, fix for S6664509\nS6563318, CVE-2013-0424: RMI data sanitization S6664509,\nCVE-2013-0425: Add logging context S6664528, CVE-2013-0426: Find log\nlevel matching its name or value given at construction time S6776941:\nCVE-2013-0427: Improve thread pool shutdown S7141694, CVE-2013-0429:\nImproving CORBA internals S7173145: Improve in-memory representation\nof splashscreens S7186945: Unpack200 improvement S7186946: Refine\nunpacker resource usage S7186948: Improve Swing data validation\nS7186952, CVE-2013-0432: Improve clipboard access S7186954: Improve\nconnection performance S7186957: Improve Pack200 data validation\nS7192392, CVE-2013-0443: Better validation of client keys S7192393,\nCVE-2013-0440: Better Checking of order of TLS Messages S7192977,\nCVE-2013-0442: Issue in toolkit thread S7197546, CVE-2013-0428:\n(proxy) Reflect about creating reflective proxies S7200491: Tighten up\nJTable layout code S7200500: Launcher better input validation\nS7201066, CVE-2013-0441: Change modifiers on unused fields S7201068,\nCVE-2013-0435: Better handling of UI elements S7201070: Serialization\nto conform to protocol S7201071, CVE-2013-0433: InetSocketAddress\nserialization issue S8000210: Improve JarFile code quality S8000537,\nCVE-2013-0450: Contextualize RequiredModelMBean class S8000540,\nCVE-2013-1475: Improve IIOP type reuse management S8000631,\nCVE-2013-1476: Restrict access to class constructor S8001235,\nCVE-2013-0434: Improve JAXP HTTP handling S8001242: Improve RMI HTTP\nconformance S8001307: Modify ACC_SUPER behavior S8001972,\nCVE-2013-1478: Improve image processing S8002325, CVE-2013-1480:\nImprove management of images Backports S7010849: 5/5 Extraneous javac\nsource/target options when building sa-jdi\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098442.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?84699316\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.6.0-openjdk package.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:16\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^16([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 16.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC16\", reference:\"java-1.6.0-openjdk-1.6.0.0-71.1.11.6.fc16\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.6.0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:11:21", "description": "The update contains the following security fixes :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\nThis update backs out two of the recent security fixes (664509 and\n7201064) that caused severe regressions. This update backs out two of\nthe recent security fixes (664509 and 7201064) that caused severe\nregressions.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "published": "2013-02-11T00:00:00", "title": "Fedora 16 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc16 (2013-2188)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-11T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:16", "p-cpe:/a:fedoraproject:fedora:java-1.7.0-openjdk"], "id": "FEDORA_2013-2188.NASL", "href": "https://www.tenable.com/plugins/nessus/64547", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-2188.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64547);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2013-2188\");\n\n script_name(english:\"Fedora 16 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc16 (2013-2188)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The update contains the following security fixes :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\nThis update backs out two of the recent security fixes (664509 and\n7201064) that caused severe regressions. This update backs out two of\nthe recent security fixes (664509 and 7201064) that caused severe\nregressions.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098440.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?beaab269\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.7.0-openjdk package.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:16\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^16([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 16.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC16\", reference:\"java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc16\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:11:22", "description": "The update contains the following security fixes :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\nThis update backs out two of the recent security fixes (664509 and\n7201064) that caused severe regressions. This update backs out two of\nthe recent security fixes (664509 and 7201064) that caused severe\nregressions.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "published": "2013-02-11T00:00:00", "title": "Fedora 18 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc18 (2013-2205)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-11T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:18", "p-cpe:/a:fedoraproject:fedora:java-1.7.0-openjdk"], "id": "FEDORA_2013-2205.NASL", "href": "https://www.tenable.com/plugins/nessus/64549", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-2205.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64549);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2013-2205\");\n\n script_name(english:\"Fedora 18 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc18 (2013-2205)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The update contains the following security fixes :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\nThis update backs out two of the recent security fixes (664509 and\n7201064) that caused severe regressions. This update backs out two of\nthe recent security fixes (664509 and 7201064) that caused severe\nregressions.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098445.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?807d138c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.7.0-openjdk package.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:18\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^18([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 18.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC18\", reference:\"java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc18\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:11:15", "description": " - Rewritten\n java-1.6.0-openjdk-java-access-bridge-security.patch\n\n - Updated to icedtea6 1.11.6\n\n - Security fixes\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\n - Backports\n\n - S7010849: 5/5 Extraneous javac source/target options\n when building sa-jdi\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "published": "2013-02-06T00:00:00", "title": "Fedora 16 : java-1.6.0-openjdk-1.6.0.0-69.1.11.6.fc16 (2013-1898)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:java-1.6.0-openjdk", "cpe:/o:fedoraproject:fedora:16"], "id": "FEDORA_2013-1898.NASL", "href": "https://www.tenable.com/plugins/nessus/64478", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-1898.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64478);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_bugtraq_id(57686, 57687, 57691, 57692, 57694, 57696, 57702, 57703, 57709, 57710, 57711, 57712, 57713, 57715, 57724, 57727, 57729, 57730);\n script_xref(name:\"FEDORA\", value:\"2013-1898\");\n\n script_name(english:\"Fedora 16 : java-1.6.0-openjdk-1.6.0.0-69.1.11.6.fc16 (2013-1898)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Rewritten\n java-1.6.0-openjdk-java-access-bridge-security.patch\n\n - Updated to icedtea6 1.11.6\n\n - Security fixes\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\n - Backports\n\n - S7010849: 5/5 Extraneous javac source/target options\n when building sa-jdi\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098329.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5ff2f4a1\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.6.0-openjdk package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:16\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/02/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^16([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 16.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC16\", reference:\"java-1.6.0-openjdk-1.6.0.0-69.1.11.6.fc16\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.6.0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T11:53:57", "description": "Multiple security issues were identified and fixed in OpenJDK\n(icedtea6) :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\n - Backports\n\n - S7010849: 5/5 Extraneous javac source/target options\n when building sa-jdi\n\nThe updated packages provides icedtea6-1.11.6 which is not vulnerable\nto these issues.", "edition": 25, "published": "2013-02-12T00:00:00", "title": "Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2013:010)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-12T00:00:00", "cpe": ["cpe:/o:mandriva:linux:2011", "p-cpe:/a:mandriva:linux:java-1.6.0-openjdk", "p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-demo", "p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-javadoc", "p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-src", "p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-devel"], "id": "MANDRIVA_MDVSA-2013-010.NASL", "href": "https://www.tenable.com/plugins/nessus/64563", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:010. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64563);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_bugtraq_id(57686, 57687, 57691, 57692, 57694, 57696, 57702, 57703, 57709, 57710, 57711, 57712, 57713, 57715, 57719, 57727, 57729, 57730);\n script_xref(name:\"MDVSA\", value:\"2013:010\");\n\n script_name(english:\"Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2013:010)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security issues were identified and fixed in OpenJDK\n(icedtea6) :\n\n - S6563318, CVE-2013-0424: RMI data sanitization\n\n - S6664509, CVE-2013-0425: Add logging context\n\n - S6664528, CVE-2013-0426: Find log level matching its\n name or value given at construction time\n\n - S6776941: CVE-2013-0427: Improve thread pool shutdown\n\n - S7141694, CVE-2013-0429: Improving CORBA internals\n\n - S7173145: Improve in-memory representation of\n splashscreens\n\n - S7186945: Unpack200 improvement\n\n - S7186946: Refine unpacker resource usage\n\n - S7186948: Improve Swing data validation\n\n - S7186952, CVE-2013-0432: Improve clipboard access\n\n - S7186954: Improve connection performance\n\n - S7186957: Improve Pack200 data validation\n\n - S7192392, CVE-2013-0443: Better validation of client\n keys\n\n - S7192393, CVE-2013-0440: Better Checking of order of\n TLS Messages\n\n - S7192977, CVE-2013-0442: Issue in toolkit thread\n\n - S7197546, CVE-2013-0428: (proxy) Reflect about\n creating reflective proxies\n\n - S7200491: Tighten up JTable layout code\n\n - S7200500: Launcher better input validation\n\n - S7201064: Better dialogue checking\n\n - S7201066, CVE-2013-0441: Change modifiers on unused\n fields\n\n - S7201068, CVE-2013-0435: Better handling of UI\n elements\n\n - S7201070: Serialization to conform to protocol\n\n - S7201071, CVE-2013-0433: InetSocketAddress\n serialization issue\n\n - S8000210: Improve JarFile code quality\n\n - S8000537, CVE-2013-0450: Contextualize\n RequiredModelMBean class\n\n - S8000540, CVE-2013-1475: Improve IIOP type reuse\n management\n\n - S8000631, CVE-2013-1476: Restrict access to class\n constructor\n\n - S8001235, CVE-2013-0434: Improve JAXP HTTP handling\n\n - S8001242: Improve RMI HTTP conformance\n\n - S8001307: Modify ACC_SUPER behavior\n\n - S8001972, CVE-2013-1478: Improve image processing\n\n - S8002325, CVE-2013-1480: Improve management of images\n\n - Backports\n\n - S7010849: 5/5 Extraneous javac source/target options\n when building sa-jdi\n\nThe updated packages provides icedtea6-1.11.6 which is not vulnerable\nto these issues.\"\n );\n # http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021708.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e15a1d25\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:java-1.6.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2011\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2011\", reference:\"java-1.6.0-openjdk-1.6.0.0-35.b24.2-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"java-1.6.0-openjdk-demo-1.6.0.0-35.b24.2-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"java-1.6.0-openjdk-devel-1.6.0.0-35.b24.2-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"java-1.6.0-openjdk-javadoc-1.6.0.0-35.b24.2-mdv2011.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2011\", reference:\"java-1.6.0-openjdk-src-1.6.0.0-35.b24.2-mdv2011.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-06T09:28:22", "description": "Updated java-1.6.0-openjdk packages that fix several security issues\nare now available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\ncritical security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\nRefer to the NEWS file, linked to in the References, for further\ninformation.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.", "edition": 25, "published": "2013-02-11T00:00:00", "title": "CentOS 6 : java-1.6.0-openjdk (CESA-2013:0245)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-11T00:00:00", "cpe": ["cpe:/o:centos:centos:6", "p-cpe:/a:centos:centos:java-1.6.0-openjdk", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-src", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-javadoc", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-demo", "p-cpe:/a:centos:centos:java-1.6.0-openjdk-devel"], "id": "CENTOS_RHSA-2013-0245.NASL", "href": "https://www.tenable.com/plugins/nessus/64536", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2013:0245 and \n# CentOS Errata and Security Advisory 2013:0245 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64536);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_xref(name:\"RHSA\", value:\"2013:0245\");\n\n script_name(english:\"CentOS 6 : java-1.6.0-openjdk (CESA-2013:0245)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated java-1.6.0-openjdk packages that fix several security issues\nare now available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\ncritical security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\nRefer to the NEWS file, linked to in the References, for further\ninformation.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2013-February/019233.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?bedc9ea4\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.6.0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2013-0425\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:java-1.6.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 6.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-6\", reference:\"java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"java-1.6.0-openjdk-demo-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"java-1.6.0-openjdk-devel-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"java-1.6.0-openjdk-javadoc-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"java-1.6.0-openjdk-src-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.6.0-openjdk / java-1.6.0-openjdk-demo / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T13:11:51", "description": "Updated java-1.6.0-openjdk packages that fix several security issues\nare now available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\ncritical security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\nRefer to the NEWS file, linked to in the References, for further\ninformation.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.", "edition": 25, "published": "2013-02-10T00:00:00", "title": "RHEL 6 : java-1.6.0-openjdk (RHSA-2013:0245)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-10T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-devel", "p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-src", "cpe:/o:redhat:enterprise_linux:6.3", "p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-demo", "p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-javadoc", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk", "p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-debuginfo"], "id": "REDHAT-RHSA-2013-0245.NASL", "href": "https://www.tenable.com/plugins/nessus/64518", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2013:0245. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64518);\n script_version(\"1.21\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n script_xref(name:\"RHSA\", value:\"2013:0245\");\n\n script_name(english:\"RHEL 6 : java-1.6.0-openjdk (RHSA-2013:0245)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated java-1.6.0-openjdk packages that fix several security issues\nare now available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\ncritical security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\nRefer to the NEWS file, linked to in the References, for further\ninformation.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.\"\n );\n # http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d4964317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2013:0245\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-1478\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0450\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-1476\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-1475\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-1480\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0427\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0426\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0425\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0429\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0445\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0441\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0440\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0443\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0442\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0432\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0433\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0434\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0435\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-0428\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.6.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/02/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2013:0245\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.6.0-openjdk-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.6.0-openjdk-debuginfo-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.6.0-openjdk-debuginfo-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.6.0-openjdk-demo-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.6.0-openjdk-demo-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.6.0-openjdk-devel-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.6.0-openjdk-devel-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.6.0-openjdk-javadoc-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.6.0-openjdk-javadoc-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.6.0-openjdk-src-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.6.0-openjdk-src-1.6.0.0-1.54.1.11.6.el6_3\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.6.0-openjdk / java-1.6.0-openjdk-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T13:47:17", "description": "Multiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie- Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\n\nAll running instances of OpenJDK Java must be restarted for the update\nto take effect.", "edition": 15, "published": "2013-02-10T00:00:00", "title": "Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64 (20130208)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "modified": "2013-02-10T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk", "p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-demo", "p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-src", "p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-javadoc", "p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-devel", "p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-debuginfo", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20130208_JAVA_1_6_0_OPENJDK_ON_SL5_X.NASL", "href": "https://www.tenable.com/plugins/nessus/64521", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(64521);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2013-0424\", \"CVE-2013-0425\", \"CVE-2013-0426\", \"CVE-2013-0427\", \"CVE-2013-0428\", \"CVE-2013-0429\", \"CVE-2013-0432\", \"CVE-2013-0433\", \"CVE-2013-0434\", \"CVE-2013-0435\", \"CVE-2013-0440\", \"CVE-2013-0441\", \"CVE-2013-0442\", \"CVE-2013-0443\", \"CVE-2013-0445\", \"CVE-2013-0450\", \"CVE-2013-1475\", \"CVE-2013-1476\", \"CVE-2013-1478\", \"CVE-2013-1480\");\n\n script_name(english:\"Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64 (20130208)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441,\nCVE-2013-1475, CVE-2013-1476, CVE-2013-0429, CVE-2013-0450,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially crafted image\ncould cause Java Virtual Machine memory corruption and, possibly, lead\nto arbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict\naccess to certain com.sun.xml.internal packages. An untrusted Java\napplication or applet could use this flaw to access information,\nbypassing certain Java sandbox restrictions. This update lists the\nwhole package as restricted. (CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the\nLibraries, Networking, and JAXP components. An untrusted Java\napplication or applet could use these flaws to bypass certain Java\nsandbox restrictions. (CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could\nuse this flaw to perform a cross-site scripting (XSS) attack.\n(CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE\ncomponent did not properly enforce handshake message ordering,\nallowing an unlimited number of handshake restarts. A remote attacker\ncould use this flaw to make an SSL/TLS server using JSSE consume an\nexcessive amount of CPU by continuously restarting the handshake.\n(CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie- Hellman public keys. An SSL/TLS client could possibly use this\nflaw to perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6.\n\nAll running instances of OpenJDK Java must be restarted for the update\nto take effect.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1302&L=scientific-linux-errata&T=0&P=1768\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ae6ec2d8\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.6.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 5.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL5\", reference:\"java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.6.0-openjdk / java-1.6.0-openjdk-debuginfo / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2019-08-13T18:44:45", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0445", "CVE-2013-0450", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480"], "description": "These packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\nCVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially-crafted image could\ncause Java Virtual Machine memory corruption and, possibly, lead to\narbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict access\nto certain com.sun.xml.internal packages. An untrusted Java application or\napplet could use this flaw to access information, bypassing certain Java\nsandbox restrictions. This update lists the whole package as restricted.\n(CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the Libraries,\nNetworking, and JAXP components. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could use\nthis flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE component\ndid not properly enforce handshake message ordering, allowing an unlimited\nnumber of handshake restarts. A remote attacker could use this flaw to\nmake an SSL/TLS server using JSSE consume an excessive amount of CPU by\ncontinuously restarting the handshake. (CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\nto perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\nthe NEWS file, linked to in the References, for further information.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "modified": "2017-09-08T12:07:12", "published": "2013-02-08T05:00:00", "id": "RHSA-2013:0246", "href": "https://access.redhat.com/errata/RHSA-2013:0246", "type": "redhat", "title": "(RHSA-2013:0246) Important: java-1.6.0-openjdk security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:47:06", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0445", "CVE-2013-0450", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480"], "description": "These packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\nCVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially-crafted image could\ncause Java Virtual Machine memory corruption and, possibly, lead to\narbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict access\nto certain com.sun.xml.internal packages. An untrusted Java application or\napplet could use this flaw to access information, bypassing certain Java\nsandbox restrictions. This update lists the whole package as restricted.\n(CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the Libraries,\nNetworking, and JAXP components. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could use\nthis flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE component\ndid not properly enforce handshake message ordering, allowing an unlimited\nnumber of handshake restarts. A remote attacker could use this flaw to\nmake an SSL/TLS server using JSSE consume an excessive amount of CPU by\ncontinuously restarting the handshake. (CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\nto perform a small subgroup attack. (CVE-2013-0443)\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\nthe NEWS file, linked to in the References, for further information.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "modified": "2018-06-06T20:24:33", "published": "2013-02-08T05:00:00", "id": "RHSA-2013:0245", "href": "https://access.redhat.com/errata/RHSA-2013:0245", "type": "redhat", "title": "(RHSA-2013:0245) Critical: java-1.6.0-openjdk security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:46:19", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0431", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0444", "CVE-2013-0445", "CVE-2013-0450", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480"], "description": "These packages provide the OpenJDK 7 Java Runtime Environment and the\nOpenJDK 7 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\nCVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0428, CVE-2013-0444)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially-crafted image could\ncause Java Virtual Machine memory corruption and, possibly, lead to\narbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict access\nto certain com.sun.xml.internal packages. An untrusted Java application or\napplet could use this flaw to access information, bypassing certain Java\nsandbox restrictions. This update lists the whole package as restricted.\n(CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the JMX,\nLibraries, Networking, and JAXP components. An untrusted Java application\nor applet could use these flaws to bypass certain Java sandbox\nrestrictions. (CVE-2013-0431, CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could use\nthis flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE component\ndid not properly enforce handshake message ordering, allowing an unlimited\nnumber of handshake restarts. A remote attacker could use this flaw to\nmake an SSL/TLS server using JSSE consume an excessive amount of CPU by\ncontinuously restarting the handshake. (CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\nto perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea7 2.3.5. Refer to\nthe NEWS file, linked to in the References, for further information.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "modified": "2018-06-06T20:24:22", "published": "2013-02-08T05:00:00", "id": "RHSA-2013:0247", "href": "https://access.redhat.com/errata/RHSA-2013:0247", "type": "redhat", "title": "(RHSA-2013:0247) Important: java-1.7.0-openjdk security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:46:02", "bulletinFamily": "unix", "cvelist": ["CVE-2012-5085", "CVE-2013-0409", "CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0440", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0445", "CVE-2013-0450", "CVE-2013-0809", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480", "CVE-2013-1481", "CVE-2013-1486", "CVE-2013-1493"], "description": "IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Detailed\nvulnerability descriptions are linked from the IBM Security alerts page,\nlisted in the References section. (CVE-2013-0409, CVE-2013-0424,\nCVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0432,\nCVE-2013-0433, CVE-2013-0434, CVE-2013-0440, CVE-2013-0442, CVE-2013-0443,\nCVE-2013-0445, CVE-2013-0450, CVE-2013-0809, CVE-2013-1476, CVE-2013-1478,\nCVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1493)\n\nAll users of java-1.5.0-ibm are advised to upgrade to these updated\npackages, containing the IBM J2SE 5.0 SR16 release. All running instances\nof IBM Java must be restarted for this update to take effect.\n", "modified": "2018-06-07T09:04:37", "published": "2013-03-11T04:00:00", "id": "RHSA-2013:0624", "href": "https://access.redhat.com/errata/RHSA-2013:0624", "type": "redhat", "title": "(RHSA-2013:0624) Critical: java-1.5.0-ibm security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:46:11", "bulletinFamily": "unix", "cvelist": ["CVE-2012-1541", "CVE-2012-3213", "CVE-2012-3342", "CVE-2013-0351", "CVE-2013-0409", "CVE-2013-0419", "CVE-2013-0423", "CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-0430", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0438", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0445", "CVE-2013-0446", "CVE-2013-0450", "CVE-2013-1473", "CVE-2013-1475", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480", "CVE-2013-1481"], "description": "Oracle Java SE version 6 includes the Oracle Java Runtime Environment and\nthe Oracle Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the Oracle Java Runtime\nEnvironment and the Oracle Java Software Development Kit. Further\ninformation about these flaws can be found on the Oracle Java SE Critical\nPatch Update Advisory page, listed in the References section.\n(CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0409,\nCVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0432,\nCVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438, CVE-2013-0440,\nCVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445, CVE-2013-0446,\nCVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478,\nCVE-2013-1480, CVE-2013-1481)\n\nAll users of java-1.6.0-sun are advised to upgrade to these updated\npackages, which provide Oracle Java 6 Update 39. All running instances of\nOracle Java must be restarted for the update to take effect.\n", "modified": "2018-06-07T09:04:13", "published": "2013-02-04T05:00:00", "id": "RHSA-2013:0236", "href": "https://access.redhat.com/errata/RHSA-2013:0236", "type": "redhat", "title": "(RHSA-2013:0236) Critical: java-1.6.0-sun security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:46:56", "bulletinFamily": "unix", "cvelist": ["CVE-2012-1541", "CVE-2012-3213", "CVE-2012-3342", "CVE-2012-5085", "CVE-2013-0351", "CVE-2013-0409", "CVE-2013-0419", "CVE-2013-0423", "CVE-2013-0424", "CVE-2013-0425", "CVE-2013-0426", "CVE-2013-0427", "CVE-2013-0428", "CVE-2013-0432", "CVE-2013-0433", "CVE-2013-0434", "CVE-2013-0435", "CVE-2013-0438", "CVE-2013-0440", "CVE-2013-0441", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0445", "CVE-2013-0446", "CVE-2013-0450", "CVE-2013-0809", "CVE-2013-1473", "CVE-2013-1476", "CVE-2013-1478", "CVE-2013-1480", "CVE-2013-1481", "CVE-2013-1486", "CVE-2013-1487", "CVE-2013-1493"], "description": "IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Detailed\nvulnerability descriptions are linked from the IBM Security alerts page,\nlisted in the References section. (CVE-2012-1541, CVE-2012-3213,\nCVE-2012-3342, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423,\nCVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428,\nCVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0438,\nCVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0445,\nCVE-2013-0446, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1476,\nCVE-2013-1478, CVE-2013-1480, CVE-2013-1481, CVE-2013-1486, CVE-2013-1487,\nCVE-2013-1493)\n\nAll users of java-1.6.0-ibm are advised to upgrade to these updated\npackages, containing the IBM Java SE 6 SR13 release. All running instances\nof IBM Java must be restarted for the update to take effect.\n", "modified": "2018-06-07T09:04:26", "published": "2013-03-11T04:00:00", "id": "RHSA-2013:0625", "href": "https://access.redhat.com/errata/RHSA-2013:0625", "type": "redhat", "title": "(RHSA-2013:0625) Critical: java-1.6.0-ibm security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "centos": [{"lastseen": "2019-12-20T18:24:58", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "**CentOS Errata and Security Advisory** CESA-2013:0245\n\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\nCVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially-crafted image could\ncause Java Virtual Machine memory corruption and, possibly, lead to\narbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict access\nto certain com.sun.xml.internal packages. An untrusted Java application or\napplet could use this flaw to access information, bypassing certain Java\nsandbox restrictions. This update lists the whole package as restricted.\n(CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the Libraries,\nNetworking, and JAXP components. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could use\nthis flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE component\ndid not properly enforce handshake message ordering, allowing an unlimited\nnumber of handshake restarts. A remote attacker could use this flaw to\nmake an SSL/TLS server using JSSE consume an excessive amount of CPU by\ncontinuously restarting the handshake. (CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\nto perform a small subgroup attack. (CVE-2013-0443)\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\nthe NEWS file, linked to in the References, for further information.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2013-February/031271.html\n\n**Affected packages:**\njava-1.6.0-openjdk\njava-1.6.0-openjdk-demo\njava-1.6.0-openjdk-devel\njava-1.6.0-openjdk-javadoc\njava-1.6.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-0245.html", "edition": 3, "modified": "2013-02-09T11:03:54", "published": "2013-02-09T11:03:54", "href": "http://lists.centos.org/pipermail/centos-announce/2013-February/031271.html", "id": "CESA-2013:0245", "title": "java security update", "type": "centos", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-20T18:26:38", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "**CentOS Errata and Security Advisory** CESA-2013:0246\n\n\nThese packages provide the OpenJDK 6 Java Runtime Environment and the\nOpenJDK 6 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, and Libraries components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\nCVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0428)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially-crafted image could\ncause Java Virtual Machine memory corruption and, possibly, lead to\narbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict access\nto certain com.sun.xml.internal packages. An untrusted Java application or\napplet could use this flaw to access information, bypassing certain Java\nsandbox restrictions. This update lists the whole package as restricted.\n(CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the Libraries,\nNetworking, and JAXP components. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could use\nthis flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE component\ndid not properly enforce handshake message ordering, allowing an unlimited\nnumber of handshake restarts. A remote attacker could use this flaw to\nmake an SSL/TLS server using JSSE consume an excessive amount of CPU by\ncontinuously restarting the handshake. (CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\nto perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to\nthe NEWS file, linked to in the References, for further information.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2013-February/031269.html\n\n**Affected packages:**\njava-1.6.0-openjdk\njava-1.6.0-openjdk-demo\njava-1.6.0-openjdk-devel\njava-1.6.0-openjdk-javadoc\njava-1.6.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-0246.html", "edition": 3, "modified": "2013-02-08T22:39:51", "published": "2013-02-08T22:39:51", "href": "http://lists.centos.org/pipermail/centos-announce/2013-February/031269.html", "id": "CESA-2013:0246", "title": "java security update", "type": "centos", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-20T18:24:35", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0431", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0444", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "**CentOS Errata and Security Advisory** CESA-2013:0247\n\n\nThese packages provide the OpenJDK 7 Java Runtime Environment and the\nOpenJDK 7 Software Development Kit.\n\nMultiple improper permission check issues were discovered in the AWT,\nCORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to bypass Java sandbox\nrestrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,\nCVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,\nCVE-2013-0428, CVE-2013-0444)\n\nMultiple flaws were found in the way image parsers in the 2D and AWT\ncomponents handled image raster parameters. A specially-crafted image could\ncause Java Virtual Machine memory corruption and, possibly, lead to\narbitrary code execution with the virtual machine privileges.\n(CVE-2013-1478, CVE-2013-1480)\n\nA flaw was found in the AWT component's clipboard handling code. An\nuntrusted Java application or applet could use this flaw to access\nclipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)\n\nThe default Java security properties configuration did not restrict access\nto certain com.sun.xml.internal packages. An untrusted Java application or\napplet could use this flaw to access information, bypassing certain Java\nsandbox restrictions. This update lists the whole package as restricted.\n(CVE-2013-0435)\n\nMultiple improper permission check issues were discovered in the JMX,\nLibraries, Networking, and JAXP components. An untrusted Java application\nor applet could use these flaws to bypass certain Java sandbox\nrestrictions. (CVE-2013-0431, CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)\n\nIt was discovered that the RMI component's CGIHandler class used user\ninputs in error messages without any sanitization. An attacker could use\nthis flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)\n\nIt was discovered that the SSL/TLS implementation in the JSSE component\ndid not properly enforce handshake message ordering, allowing an unlimited\nnumber of handshake restarts. A remote attacker could use this flaw to\nmake an SSL/TLS server using JSSE consume an excessive amount of CPU by\ncontinuously restarting the handshake. (CVE-2013-0440)\n\nIt was discovered that the JSSE component did not properly validate\nDiffie-Hellman public keys. An SSL/TLS client could possibly use this flaw\nto perform a small subgroup attack. (CVE-2013-0443)\n\nThis erratum also upgrades the OpenJDK package to IcedTea7 2.3.5. Refer to\nthe NEWS file, linked to in the References, for further information.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2013-February/031270.html\nhttp://lists.centos.org/pipermail/centos-announce/2013-February/031272.html\n\n**Affected packages:**\njava-1.7.0-openjdk\njava-1.7.0-openjdk-demo\njava-1.7.0-openjdk-devel\njava-1.7.0-openjdk-javadoc\njava-1.7.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-0247.html", "edition": 3, "modified": "2013-02-09T11:04:30", "published": "2013-02-09T00:57:50", "href": "http://lists.centos.org/pipermail/centos-announce/2013-February/031270.html", "id": "CESA-2013:0247", "title": "java security update", "type": "centos", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:35:10", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "[1:1.6.0.0-1.54.1.11.6]\n- removed patch8 revertTwoWrongSecurityPatches2013-02-06.patch\n- added patch8: 7201064.patch to be reverted\n- added patch9: 8005615.patch to fix the 6664509.patch\n- Resolves: rhbz#906707\n[1:1.6.0.0-1.53.1.11.6]\n- added patch8 revertTwoWrongSecurityPatches2013-02-06.patch\n to remove 6664509 and 7201064 from 1.11.6 tarball\n- Resolves: rhbz#906707\n[1:1.6.0.0-1.51.1.11.6]\n- Updated to icedtea6 1.11.6\n- Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch\n- Resolves: rhbz#906707", "edition": 4, "modified": "2013-02-08T00:00:00", "published": "2013-02-08T00:00:00", "id": "ELSA-2013-0245", "href": "http://linux.oracle.com/errata/ELSA-2013-0245.html", "title": "java-1.6.0-openjdk security update", "type": "oraclelinux", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:37:04", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "[ 1:1.6.0.0-1.33.1.11.6.0.1.el5_9]\n- Add oracle-enterprise.patch\n[1:1.6.0.0-1.33.1.11.6]\n- removed patch9 revertTwoWrongSecurityPatches2013-02-06.patch\n- added patch9: 7201064.patch to be reverted\n- added patch10: 8005615.patch to fix the 6664509.patch\n- Resolves: rhbz#906705\n[1:1.6.0.0-1.32.1.11.6]\n- added patch9 revertTwoWrongSecurityPatches2013-02-06.patch\n to remove 6664509 and 7201064 from 1.11.6 tarball\n- Resolves: rhbz#906705\n[1:1.6.0.0-1.31.1.11.6]\n- Updated to icedtea6 1.11.6\n- Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch\n- Resolves: rhbz#906705", "edition": 4, "modified": "2013-02-08T00:00:00", "published": "2013-02-08T00:00:00", "id": "ELSA-2013-0246", "href": "http://linux.oracle.com/errata/ELSA-2013-0246.html", "title": "java-1.6.0-openjdk security update", "type": "oraclelinux", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:38:34", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0431", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0444", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "[1.7.0.9-2.3.5.3.0.1.el6_3]\n- Update DISTRO_NAME in specfile\n[1.7.0.9-2.3.5.3.el6_3]\n- Sync logging fixes with upstream (icedtea7-forest and jdk7u)\n[1.7.0.9-2.3.5.1.el6_3]\n- Removed 6664509 backout and added 8005615 to fix the issue\n[1.7.0.9-2.3.5.el6_3.1]\n- Backed out 6664509 and 7201064.patch which cause regressions\n[1.7.0.9-2.3.5.el6_3]\n- Bumped to 2.3.5\n- Changed BR to java7-devel >= 1:1.7.0 as required by CORBA changes in 2.3.5\n- Resolves: rhbz#906707", "edition": 4, "modified": "2013-02-08T00:00:00", "published": "2013-02-08T00:00:00", "id": "ELSA-2013-0247", "href": "http://linux.oracle.com/errata/ELSA-2013-0247.html", "title": "java-1.7.0-openjdk security update", "type": "oraclelinux", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "amazon": [{"lastseen": "2020-11-10T12:37:27", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0431", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0444", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-1476", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0450", "CVE-2013-0440", "CVE-2013-0425", "CVE-2013-0441"], "description": "**Issue Overview:**\n\nMultiple improper permission check issues were discovered in the AWT, CORBA, JMX, Libraries, and Beans components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. ([CVE-2013-0442 __](<https://access.redhat.com/security/cve/CVE-2013-0442>), [CVE-2013-0445 __](<https://access.redhat.com/security/cve/CVE-2013-0445>), [CVE-2013-0441 __](<https://access.redhat.com/security/cve/CVE-2013-0441>), [CVE-2013-1475 __](<https://access.redhat.com/security/cve/CVE-2013-1475>), [CVE-2013-1476 __](<https://access.redhat.com/security/cve/CVE-2013-1476>), [CVE-2013-0429 __](<https://access.redhat.com/security/cve/CVE-2013-0429>), [CVE-2013-0450 __](<https://access.redhat.com/security/cve/CVE-2013-0450>), [CVE-2013-0425 __](<https://access.redhat.com/security/cve/CVE-2013-0425>), [CVE-2013-0426 __](<https://access.redhat.com/security/cve/CVE-2013-0426>), [CVE-2013-0428 __](<https://access.redhat.com/security/cve/CVE-2013-0428>), [CVE-2013-0444 __](<https://access.redhat.com/security/cve/CVE-2013-0444>))\n\nMultiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially-crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges. ([CVE-2013-1478 __](<https://access.redhat.com/security/cve/CVE-2013-1478>), [CVE-2013-1480 __](<https://access.redhat.com/security/cve/CVE-2013-1480>))\n\nA flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions. ([CVE-2013-0432 __](<https://access.redhat.com/security/cve/CVE-2013-0432>))\n\nThe default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted. ([CVE-2013-0435 __](<https://access.redhat.com/security/cve/CVE-2013-0435>))\n\nMultiple improper permission check issues were discovered in the JMX, Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. ([CVE-2013-0431 __](<https://access.redhat.com/security/cve/CVE-2013-0431>), [CVE-2013-0427 __](<https://access.redhat.com/security/cve/CVE-2013-0427>), [CVE-2013-0433 __](<https://access.redhat.com/security/cve/CVE-2013-0433>), [CVE-2013-0434 __](<https://access.redhat.com/security/cve/CVE-2013-0434>))\n\nIt was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack. ([CVE-2013-0424 __](<https://access.redhat.com/security/cve/CVE-2013-0424>))\n\nIt was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake. ([CVE-2013-0440 __](<https://access.redhat.com/security/cve/CVE-2013-0440>))\n\nIt was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack. ([CVE-2013-0443 __](<https://access.redhat.com/security/cve/CVE-2013-0443>))\n\n \n**Affected Packages:** \n\n\njava-1.7.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.7.0-openjdk_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n java-1.7.0-openjdk-demo-1.7.0.9-2.3.5.3.17.amzn1.i686 \n java-1.7.0-openjdk-devel-1.7.0.9-2.3.5.3.17.amzn1.i686 \n java-1.7.0-openjdk-debuginfo-1.7.0.9-2.3.5.3.17.amzn1.i686 \n java-1.7.0-openjdk-src-1.7.0.9-2.3.5.3.17.amzn1.i686 \n java-1.7.0-openjdk-1.7.0.9-2.3.5.3.17.amzn1.i686 \n \n noarch: \n java-1.7.0-openjdk-javadoc-1.7.0.9-2.3.5.3.17.amzn1.noarch \n \n src: \n java-1.7.0-openjdk-1.7.0.9-2.3.5.3.17.amzn1.src \n \n x86_64: \n java-1.7.0-openjdk-devel-1.7.0.9-2.3.5.3.17.amzn1.x86_64 \n java-1.7.0-openjdk-1.7.0.9-2.3.5.3.17.amzn1.x86_64 \n java-1.7.0-openjdk-debuginfo-1.7.0.9-2.3.5.3.17.amzn1.x86_64 \n java-1.7.0-openjdk-demo-1.7.0.9-2.3.5.3.17.amzn1.x86_64 \n java-1.7.0-openjdk-src-1.7.0.9-2.3.5.3.17.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2013-02-17T15:35:00", "published": "2013-02-17T15:35:00", "id": "ALAS-2013-156", "href": "https://alas.aws.amazon.com/ALAS-2013-156.html", "title": "Important: java-1.7.0-openjdk", "type": "amazon", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-11-10T12:37:31", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0435", "CVE-2013-0442", "CVE-2013-0443", "CVE-2013-0432", "CVE-2013-0424", "CVE-2013-0440"], "description": "**Issue Overview:**\n\nMultiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.\n\nMultiple flaws were found in the way image parsers in the 2D and AWT components handled image raster parameters. A specially-crafted image could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the virtual machine privileges.\n\nA flaw was found in the AWT component's clipboard handling code. An untrusted Java application or applet could use this flaw to access clipboard data, bypassing Java sandbox restrictions.\n\nThe default Java security properties configuration did not restrict access to certain com.sun.xml.internal packages. An untrusted Java application or applet could use this flaw to access information, bypassing certain Java sandbox restrictions. This update lists the whole package as restricted.\n\nMultiple improper permission check issues were discovered in the Libraries, Networking, and JAXP components. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.\n\nIt was discovered that the RMI component's CGIHandler class used user inputs in error messages without any sanitization. An attacker could use this flaw to perform a cross-site scripting (XSS) attack.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component did not properly enforce handshake message ordering, allowing an unlimited number of handshake restarts. A remote attacker could use this flaw to make an SSL/TLS server using JSSE consume an excessive amount of CPU by continuously restarting the handshake.\n\nIt was discovered that the JSSE component did not properly validate Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw to perform a small subgroup attack.\n\n \n**Affected Packages:** \n\n\njava-1.6.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.6.0-openjdk_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n java-1.6.0-openjdk-src-1.6.0.0-54.1.11.6.48.amzn1.i686 \n java-1.6.0-openjdk-demo-1.6.0.0-54.1.11.6.48.amzn1.i686 \n java-1.6.0-openjdk-javadoc-1.6.0.0-54.1.11.6.48.amzn1.i686 \n java-1.6.0-openjdk-devel-1.6.0.0-54.1.11.6.48.amzn1.i686 \n java-1.6.0-openjdk-1.6.0.0-54.1.11.6.48.amzn1.i686 \n java-1.6.0-openjdk-debuginfo-1.6.0.0-54.1.11.6.48.amzn1.i686 \n \n src: \n java-1.6.0-openjdk-1.6.0.0-54.1.11.6.48.amzn1.src \n \n x86_64: \n java-1.6.0-openjdk-1.6.0.0-54.1.11.6.48.amzn1.x86_64 \n java-1.6.0-openjdk-javadoc-1.6.0.0-54.1.11.6.48.amzn1.x86_64 \n java-1.6.0-openjdk-demo-1.6.0.0-54.1.11.6.48.amzn1.x86_64 \n java-1.6.0-openjdk-debuginfo-1.6.0.0-54.1.11.6.48.amzn1.x86_64 \n java-1.6.0-openjdk-src-1.6.0.0-54.1.11.6.48.amzn1.x86_64 \n java-1.6.0-openjdk-devel-1.6.0.0-54.1.11.6.48.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2013-02-17T15:35:00", "published": "2013-02-17T15:35:00", "id": "ALAS-2013-155", "href": "https://alas.aws.amazon.com/ALAS-2013-155.html", "title": "Important: java-1.6.0-openjdk", "type": "amazon", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-07-02T11:33:29", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0426", "CVE-2012-1541", "CVE-2013-0427", "CVE-2013-1478", "CVE-2013-0428", "CVE-2013-0448", "CVE-2013-0429", "CVE-2013-1475", "CVE-2013-0435", "CVE-2013-0442", "CVE-2012-3342", "CVE-2013-1473", "CVE-2013-0434", "CVE-2013-0443", "CVE-2013-0351", "CVE-2013-0444", "CVE-2013-0433", "CVE-2013-1480", "CVE-2013-0409", "CVE-2013-0438", "CVE-2013-1476", "CVE-2013-0430", "CVE-2013-0445", "CVE-2013-0432", "CVE-2013-0424", "CVE-2012-3213", "CVE-2013-0450", "CVE-2013-0446", "CVE-2013-0440", "CVE-2013-1481", "CVE-2013-0425", "CVE-2013-0441", "CVE-2013-0449", "CVE-2013-0423", "CVE-2013-0419"], "description": "Several vulnerabilities were discovered in the OpenJDK JRE related to \ninformation disclosure and data integrity. An attacker could exploit these \nto cause a denial of service. (CVE-2012-1541, CVE-2012-3342, CVE-2013-0351, \nCVE-2013-0419, CVE-2013-0423, CVE-2013-0446, CVE-2012-3213, CVE-2013-0425, \nCVE-2013-0426, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0441, \nCVE-2013-0442, CVE-2013-0445, CVE-2013-0450, CVE-2013-1475, CVE-2013-1476, \nCVE-2013-1478, CVE-2013-1480)\n\nVulnerabilities were discovered in the OpenJDK JRE related to information \ndisclosure. (CVE-2013-0409, CVE-2013-0434, CVE-2013-0438)\n\nSeveral data integrity vulnerabilities were discovered in the OpenJDK JRE. \n(CVE-2013-0424, CVE-2013-0427, CVE-2013-0433, CVE-2013-1473)\n\nSeveral vulnerabilities were discovered in the OpenJDK JRE related to \ninformation disclosure and data integrity. (CVE-2013-0432, CVE-2013-0435, \nCVE-2013-0443)\n\nA vulnerability was discovered in the OpenJDK JRE related to availability. \nAn attacker could exploit this to cause a denial of service. \n(CVE-2013-0440)\n\nA vulnerability was discovered in the OpenJDK JRE related to information \ndisclosure and data integrity. An attacker could exploit this to cause a \ndenial of service. This issue only affected Ubuntu 12.10. (CVE-2013-0444)\n\nA data integrity vulnerability was discovered in the OpenJDK JRE. This \nissue only affected Ubuntu 12.10. (CVE-2013-0448)\n\nAn information disclosure vulnerability was discovered in the OpenJDK JRE. \nThis issue only affected Ubuntu 12.10. (CVE-2013-0449)\n\nA vulnerability was discovered in the OpenJDK JRE related to information \ndisclosure and data integrity. An attacker could exploit this to cause a \ndenial of service. This issue did not affect Ubuntu 12.10. (CVE-2013-1481)", "edition": 5, "modified": "2013-02-14T00:00:00", "published": "2013-02-14T00:00:00", "id": "USN-1724-1", "href": "https://ubuntu.com/security/notices/USN-1724-1", "title": "OpenJDK vulnerabilities", "type": "ubuntu", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2020-12-09T19:52:36", "description": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.\nPer http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html \r\n\r\n\"Applies to server deployments of JSSE.\"", "edition": 5, "cvss3": {}, "published": "2013-02-02T00:55:00", "title": "CVE-2013-0440", "type": "cve", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-0440"], "modified": "2017-09-19T01:35:00", "cpe": ["cpe:/a:sun:jre:1.4.2_4", "cpe:/a:oracle:jdk:1.4.2_38", "cpe:/a:sun:jre:1.4.2_21", "cpe:/a:sun:jdk:1.4.2_9", "cpe:/a:sun:jre:1.4.2_31", "cpe:/a:sun:jre:1.4.2_17", "cpe:/a:sun:jdk:1.4.2_23", "cpe:/a:sun:jre:1.4.2_7", "cpe:/a:sun:jdk:1.6.0", "cpe:/a:sun:jdk:1.4.2_14", "cpe:/a:oracle:jre:1.6.0", "cpe:/a:sun:jre:1.4.2_10", "cpe:/a:sun:jre:1.4.2_9", "cpe:/a:sun:jre:1.4.2_19", "cpe:/a:sun:jdk:1.4.2_26", "cpe:/a:oracle:jdk:1.5.0", "cpe:/a:sun:jre:1.4.2_5", "cpe:/a:sun:jdk:1.4.2_7", "cpe:/a:sun:jre:1.6.0", "cpe:/a:sun:jdk:1.4.2_29", "cpe:/a:sun:jre:1.4.2_11", "cpe:/a:sun:jre:1.4.2_12", "cpe:/a:sun:jre:1.4.2_16", "cpe:/a:sun:jdk:1.4.2_11", "cpe:/a:sun:jre:1.4.2_14", "cpe:/a:sun:jre:1.4.2_18", "cpe:/a:sun:jdk:1.4.2_28", "cpe:/a:sun:jdk:1.4.2_31", "cpe:/a:sun:jre:1.4.2_3", "cpe:/a:sun:jre:1.4.2_6", "cpe:/a:sun:jdk:1.4.2_27", "cpe:/a:sun:jdk:1.4.2_6", "cpe:/a:oracle:jdk:1.6.0", "cpe:/a:sun:jdk:1.4.2_15", "cpe:/a:sun:jre:1.4.2_25", "cpe:/a:sun:jdk:1.4.2_4", "cpe:/a:sun:jdk:1.4.2_37", "cpe:/a:sun:jdk:1.4.2_32", "cpe:/a:oracle:jdk:1.7.0", "cpe:/a:sun:jre:1.4.2_1", "cpe:/a:sun:jdk:1.4.2_33", "cpe:/a:sun:jdk:1.4.2_16", "cpe:/a:sun:jre:1.4.2_29", "cpe:/a:sun:jdk:1.5.0", "cpe:/a:sun:jre:1.5.0", "cpe:/a:sun:jre:1.4.2_20", "cpe:/a:sun:jdk:1.4.2_3", "cpe:/a:sun:jre:1.4.2_26", "cpe:/a:sun:jre:1.4.2_27", "cpe:/a:oracle:jre:1.4.2_38", "cpe:/a:sun:jdk:1.4.2", "cpe:/a:oracle:jre:1.7.0", "cpe:/a:sun:jre:1.4.2_30", "cpe:/a:sun:jre:1.4.2_35", "cpe:/a:sun:jre:1.4.2_15", "cpe:/a:sun:jre:1.4.2_28", "cpe:/a:sun:jdk:1.4.2_30", "cpe:/a:sun:jdk:1.4.2_18", "cpe:/a:oracle:jre:1.5.0", "cpe:/a:sun:jre:1.4.2_8", "cpe:/a:sun:jdk:1.4.2_35", "cpe:/a:sun:jdk:1.4.2_5", "cpe:/a:sun:jdk:1.4.2_8", "cpe:/a:sun:jre:1.4.2", "cpe:/a:sun:jdk:1.4.2_17", "cpe:/a:sun:jdk:1.4.2_1", "cpe:/a:sun:jre:1.4.2_34", "cpe:/a:sun:jdk:1.4.2_25", "cpe:/a:sun:jdk:1.4.2_10", "cpe:/a:sun:jre:1.4.2_32", "cpe:/a:sun:jre:1.4.2_22", "cpe:/a:sun:jdk:1.4.2_13", "cpe:/a:sun:jdk:1.4.2_36", "cpe:/a:sun:jdk:1.4.2_19", "cpe:/a:oracle:jdk:1.4.2_40", "cpe:/a:sun:jdk:1.4.2_22", "cpe:/a:sun:jdk:1.4.2_12", "cpe:/a:sun:jre:1.4.2_23", "cpe:/a:oracle:jre:1.4.2_40", "cpe:/a:sun:jre:1.4.2_37", "cpe:/a:sun:jre:1.4.2_33", "cpe:/a:sun:jre:1.4.2_36", "cpe:/a:sun:jre:1.4.2_2", "cpe:/a:sun:jre:1.4.2_24", "cpe:/a:sun:jre:1.4.2_13", "cpe:/a:sun:jdk:1.4.2_2", "cpe:/a:sun:jdk:1.4.2_34"], "id": "CVE-2013-0440", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0440", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_25:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_30:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_29:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_22:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_37:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_15:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update31:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.4.2_38:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_26:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_22:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_36:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_6:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_26:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_32:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_36:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_37:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.5.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_28:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_27:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_37:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_28:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_31:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_35:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.5.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_30:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update26:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_10:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_7:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_29:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_8:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_25:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_35:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_33:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update33:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_24:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_25:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_27:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_35:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.4.2_40:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_31:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_27:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_33:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_19:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_32:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_23:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_24:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update29:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_30:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_23:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_23:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_3:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_29:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_18:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_34:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.5.0:update_36:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_31:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_35:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_37:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_27:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_26:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_31:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_29:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_14:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update31:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.4.2_38:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_25:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_16:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.5.0:update_36:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_13:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_32:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_26:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_23:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_33:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_11:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_34:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_33:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.4.2_40:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_24:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_4:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update28:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update28:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_12:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update33:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_22:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_34:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_30:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_5:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update27:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_1:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_32:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_9:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_34:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_17:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T19:52:36", "description": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a \"small subgroup attack\" to force the use of weak session keys or obtain sensitive information about the private key.\nPer http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html\r\n\r\n\"Applies to server deployments of JSSE.\"", "edition": 5, "cvss3": {}, "published": "2013-02-02T00:55:00", "title": "CVE-2013-0443", "type": "cve", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.0, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-0443"], "modified": "2017-09-19T01:35:00", "cpe": ["cpe:/a:sun:jre:1.4.2_4", "cpe:/a:oracle:jdk:1.4.2_38", "cpe:/a:sun:jre:1.4.2_21", "cpe:/a:sun:jdk:1.4.2_9", "cpe:/a:sun:jre:1.4.2_31", "cpe:/a:sun:jre:1.4.2_17", "cpe:/a:sun:jdk:1.4.2_23", "cpe:/a:sun:jre:1.4.2_7", "cpe:/a:sun:jdk:1.6.0", "cpe:/a:sun:jdk:1.4.2_14", "cpe:/a:oracle:jre:1.6.0", "cpe:/a:sun:jre:1.4.2_10", "cpe:/a:sun:jre:1.4.2_9", "cpe:/a:sun:jre:1.4.2_19", "cpe:/a:sun:jdk:1.4.2_26", "cpe:/a:oracle:jdk:1.5.0", "cpe:/a:sun:jre:1.4.2_5", "cpe:/a:sun:jdk:1.4.2_7", "cpe:/a:sun:jre:1.6.0", "cpe:/a:sun:jdk:1.4.2_29", "cpe:/a:sun:jre:1.4.2_11", "cpe:/a:sun:jre:1.4.2_12", "cpe:/a:sun:jre:1.4.2_16", "cpe:/a:sun:jdk:1.4.2_11", "cpe:/a:sun:jre:1.4.2_14", "cpe:/a:sun:jre:1.4.2_18", "cpe:/a:sun:jdk:1.4.2_28", "cpe:/a:sun:jdk:1.4.2_31", "cpe:/a:sun:jre:1.4.2_3", "cpe:/a:sun:jre:1.4.2_6", "cpe:/a:sun:jdk:1.4.2_27", "cpe:/a:sun:jdk:1.4.2_6", "cpe:/a:oracle:jdk:1.6.0", "cpe:/a:sun:jdk:1.4.2_15", "cpe:/a:sun:jre:1.4.2_25", "cpe:/a:sun:jdk:1.4.2_4", "cpe:/a:sun:jdk:1.4.2_37", "cpe:/a:sun:jdk:1.4.2_32", "cpe:/a:oracle:jdk:1.7.0", "cpe:/a:sun:jre:1.4.2_1", "cpe:/a:sun:jdk:1.4.2_33", "cpe:/a:sun:jdk:1.4.2_16", "cpe:/a:sun:jre:1.4.2_29", "cpe:/a:sun:jdk:1.5.0", "cpe:/a:sun:jre:1.5.0", "cpe:/a:sun:jre:1.4.2_20", "cpe:/a:sun:jdk:1.4.2_3", "cpe:/a:sun:jre:1.4.2_26", "cpe:/a:sun:jre:1.4.2_27", "cpe:/a:oracle:jre:1.4.2_38", "cpe:/a:sun:jdk:1.4.2", "cpe:/a:oracle:jre:1.7.0", "cpe:/a:sun:jre:1.4.2_30", "cpe:/a:sun:jre:1.4.2_35", "cpe:/a:sun:jre:1.4.2_15", "cpe:/a:sun:jre:1.4.2_28", "cpe:/a:sun:jdk:1.4.2_30", "cpe:/a:sun:jdk:1.4.2_18", "cpe:/a:oracle:jre:1.5.0", "cpe:/a:sun:jre:1.4.2_8", "cpe:/a:sun:jdk:1.4.2_35", "cpe:/a:sun:jdk:1.4.2_5", "cpe:/a:sun:jdk:1.4.2_8", "cpe:/a:sun:jre:1.4.2", "cpe:/a:sun:jdk:1.4.2_17", "cpe:/a:sun:jdk:1.4.2_1", "cpe:/a:sun:jre:1.4.2_34", "cpe:/a:sun:jdk:1.4.2_25", "cpe:/a:sun:jdk:1.4.2_10", "cpe:/a:sun:jre:1.4.2_32", "cpe:/a:sun:jre:1.4.2_22", "cpe:/a:sun:jdk:1.4.2_13", "cpe:/a:sun:jdk:1.4.2_36", "cpe:/a:sun:jdk:1.4.2_19", "cpe:/a:oracle:jdk:1.4.2_40", "cpe:/a:sun:jdk:1.4.2_22", "cpe:/a:sun:jdk:1.4.2_12", "cpe:/a:sun:jre:1.4.2_23", "cpe:/a:oracle:jre:1.4.2_40", "cpe:/a:sun:jre:1.4.2_37", "cpe:/a:sun:jre:1.4.2_33", "cpe:/a:sun:jre:1.4.2_36", "cpe:/a:sun:jre:1.4.2_2", "cpe:/a:sun:jre:1.4.2_24", "cpe:/a:sun:jre:1.4.2_13", "cpe:/a:sun:jdk:1.4.2_2", "cpe:/a:sun:jdk:1.4.2_34"], "id": "CVE-2013-0443", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0443", "cvss": {"score": 4.0, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_25:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_30:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_29:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_22:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_37:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_15:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update31:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.4.2_38:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_26:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_22:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_36:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_6:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_26:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_32:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_36:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_37:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.5.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_28:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_27:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_37:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_28:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_31:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_35:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.5.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_30:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update26:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_10:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_7:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_29:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_8:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_25:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_35:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_33:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update33:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_24:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_25:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_27:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_35:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.4.2_40:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_31:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_27:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_33:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_19:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_32:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_23:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_24:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update29:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_30:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_23:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_23:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_3:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_29:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_18:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_34:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.5.0:update_36:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_31:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_35:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_37:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_27:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_26:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_31:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_29:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_14:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update31:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.4.2_38:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_25:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_38:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_16:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.5.0:update_36:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_13:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_32:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_26:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_23:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.6.0:update_33:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_11:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_34:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_33:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.4.2_40:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_24:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_4:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update28:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update28:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_12:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update33:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_22:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_34:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_30:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_5:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update27:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_1:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.6.0:update_32:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_9:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.4.2_34:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.4.2_17:*:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*", "cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*", "cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*", "cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*"]}]}