SLES9: Security update for Java2

{"id": "OPENVAS:65109", "bulletinFamily": "scanner", "title": "SLES9: Security update for Java2", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n java2-jre\n java2\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5021170 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "published": "2009-10-10T00:00:00", "modified": "2017-07-11T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=65109", "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "references": [], "cvelist": ["CVE-2005-1974", "CVE-2005-0836"], "type": "openvas", "lastseen": "2017-07-26T08:55:58", "history": [{"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2005-1974", "CVE-2005-0836"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n java2-jre\n java2\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5021170 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "edition": 1, "enchantments": {}, "hash": "2cd52b88053e30986a7638cc4d05c2fd8ccf4c414d363aa15c593a821d0792e3", "hashmap": [{"hash": "407db853f927d513560b3a7c487c3081", "key": "pluginID"}, {"hash": "52bf0b62a1439f57e03a4ca5eb6fa362", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b778055b37159119ce97e96620d4ff56", "key": "reporter"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "188ffbf3382f544df1d8acfd809cd387", "key": "modified"}, {"hash": "c8813c3c0549d5d3b27e3cd8c81ff2d1", "key": "sourceData"}, {"hash": "6bf018f50da5ded8d4205866a2f4f842", "key": "description"}, {"hash": "b5690f93a9a8de1997d799545818941e", "key": "published"}, {"hash": "3d13e5726e24a485587a8948c5fdbe22", "key": "title"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "84674b19e3078b0666263739158487b5", "key": "cvelist"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=65109", "id": "OPENVAS:65109", "lastseen": "2017-07-02T21:14:09", "modified": "2017-02-06T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "65109", "published": "2009-10-10T00:00:00", "references": [], "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5021170.nasl 5212 2017-02-06 16:45:27Z teissa $\n# Description: Security update for Java2\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n java2-jre\n java2\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5021170 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_id(65109);\n script_version(\"$Revision: 5212 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-06 17:45:27 +0100 (Mon, 06 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2005-0836\", \"CVE-2005-1974\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"SLES9: Security update for Java2\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"login/SSH/success\", \"HostDetails/OS/cpe:/o:suse:linux_enterprise_server\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"java2-jre\", rpm:\"java2-jre~1.4.2~129.14\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "title": "SLES9: Security update for Java2", "type": "openvas", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 1, "lastseen": "2017-07-02T21:14:09"}], "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "84674b19e3078b0666263739158487b5"}, {"key": "cvss", "hash": "2bdabeb49c44761f9565717ab0e38165"}, {"key": "description", "hash": "6bf018f50da5ded8d4205866a2f4f842"}, {"key": "href", "hash": "52bf0b62a1439f57e03a4ca5eb6fa362"}, {"key": "modified", "hash": "bf6febede5ca68e35fdf4a0f47b4ef18"}, {"key": "naslFamily", "hash": "71a40666da62ba38d22539c8277870c7"}, {"key": "pluginID", "hash": "407db853f927d513560b3a7c487c3081"}, {"key": "published", "hash": "b5690f93a9a8de1997d799545818941e"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b778055b37159119ce97e96620d4ff56"}, {"key": "sourceData", "hash": "70182c5be62e19ab1b0f3fc03a37ab15"}, {"key": "title", "hash": "3d13e5726e24a485587a8948c5fdbe22"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "hash": "6ddb656361f3485dc9d47e25d0736654f1c782029cc51eec55d093d35881bcee", "viewCount": 0, "enchantments": {"vulnersScore": 7.1}, "objectVersion": "1.3", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5021170.nasl 6666 2017-07-11 13:13:36Z cfischer $\n# Description: Security update for Java2\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n java2-jre\n java2\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5021170 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_id(65109);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2005-0836\", \"CVE-2005-1974\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"SLES9: Security update for Java2\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"java2-jre\", rpm:\"java2-jre~1.4.2~129.14\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "naslFamily": "SuSE Local Security Checks", "pluginID": "65109"}

{"result": {"cve": [{"id": "CVE-2005-1974", "type": "cve", "title": "CVE-2005-1974", "description": "Unspecified vulnerability in Java 2 Platform, Standard Edition (J2SE) 5.0 and 5.0 Update 1 and J2SE 1.4.2 up to 1.4.2_07, as used in multiple products and platforms including (1) HP-UX and (2) APC PowerChute, allows applications to assign permissions to themselves and gain privileges.", "published": "2005-06-16T00:00:00", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1974", "cvelist": ["CVE-2005-1974"], "lastseen": "2017-04-18T15:51:14"}, {"id": "CVE-2005-0836", "type": "cve", "title": "CVE-2005-0836", "description": "Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.", "published": "2005-05-02T00:00:00", "cvss": {"score": 10, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0836", "cvelist": ["CVE-2005-0836"], "lastseen": "2017-04-18T15:51:00"}], "osvdb": [{"id": "OSVDB:17340", "type": "osvdb", "title": "Sun JRE Untrusted Applet Privilege Escalation", "description": "## Vulnerability Description\nJava 2 Platform Standard Edition (J2SE) contains a flaw that may allow a remote attacker to gain access to unauthorized privileges. The issue is triggered due to an unspecified flaw, which may allow an untrusted applet to grant itself permissions to arbitrary read and write files and/or execute arbitrary applications resulting in a loss of integrty.\n## Solution Description\nUpgrade to version 5.0 Update 2 or 1.4.2_08 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nJava 2 Platform Standard Edition (J2SE) contains a flaw that may allow a remote attacker to gain access to unauthorized privileges. The issue is triggered due to an unspecified flaw, which may allow an untrusted applet to grant itself permissions to arbitrary read and write files and/or execute arbitrary applications resulting in a loss of integrty.\n## References:\nVendor URL: http://www.sun.com/\nVendor Specific News/Changelog Entry: http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=7638\n[Vendor Specific Advisory URL](http://sunsolve.sun.com/search/document.do?assetkey=1-26-101749-1)\n[Vendor Specific Advisory URL](http://itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01215)\n[Vendor Specific Advisory URL](http://itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01214)\nSecurity Tracker: 1014192\nSecurity Tracker: 1015643\n[Secunia Advisory ID:15671](https://secuniaresearch.flexerasoftware.com/advisories/15671/)\n[Secunia Advisory ID:15750](https://secuniaresearch.flexerasoftware.com/advisories/15750/)\n[Secunia Advisory ID:15777](https://secuniaresearch.flexerasoftware.com/advisories/15777/)\n[Secunia Advisory ID:17272](https://secuniaresearch.flexerasoftware.com/advisories/17272/)\n[Secunia Advisory ID:15755](https://secuniaresearch.flexerasoftware.com/advisories/15755/)\n[Secunia Advisory ID:16658](https://secuniaresearch.flexerasoftware.com/advisories/16658/)\n[Related OSVDB ID: 17299](https://vulners.com/osvdb/OSVDB:17299)\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200506-14.xml\nOther Advisory URL: http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.394829\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-10/0227.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-08/0432.html\nKeyword: SSRT051052\n[CVE-2005-1974](https://vulners.com/cve/CVE-2005-1974)\n", "published": "2005-06-13T08:12:19", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:17340", "cvelist": ["CVE-2005-1974"], "lastseen": "2017-04-28T13:20:13"}, {"id": "OSVDB:14899", "type": "osvdb", "title": "Java Web Start JNLP File Arbitrary Command Execution", "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://sunsolve.sun.com/search/document.do?assetkey=1-26-57740-1)\n[Secunia Advisory ID:15777](https://secuniaresearch.flexerasoftware.com/advisories/15777/)\n[Secunia Advisory ID:14640](https://secuniaresearch.flexerasoftware.com/advisories/14640/)\n[Secunia Advisory ID:14695](https://secuniaresearch.flexerasoftware.com/advisories/14695/)\nOther Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200503-28.xml\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-03/0574.html\n[CVE-2005-0836](https://vulners.com/cve/CVE-2005-0836)\nBugtraq ID: 12847\n", "published": "2005-03-16T22:17:03", "cvss": {"score": 10, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/osvdb/OSVDB:14899", "cvelist": ["CVE-2005-0836"], "lastseen": "2017-04-28T13:20:10"}], "nessus": [{"id": "HPUX_PHSS_33627.NASL", "type": "nessus", "title": "HP-UX PHSS_33627 : HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE), Remote Privileged Access (HPSBMA01234 SSRT051052 rev.2)", "description": "s700_800 11.X OV OVO8.1X PARISC JavaGUI client A.08.14 : \n\nA potential security vulnerability has been identified with the HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE). This vulnerability may allow an untrusted remote applet to elevate its privileges.", "published": "2005-10-25T00:00:00", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=20085", "cvelist": ["CVE-2005-1974"], "lastseen": "2016-09-26T17:23:06"}, {"id": "HPUX_PHSS_32406.NASL", "type": "nessus", "title": "HP-UX PHSS_32406 : HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE), Remote Privileged Access (HPSBMA01234 SSRT051052 rev.2)", "description": "s700_800 11.X OV ITO7.1X JavaGUI client A.07.20.1 : \n\nA potential security vulnerability has been identified with the HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE). This vulnerability may allow an untrusted remote applet to elevate its privileges.", "published": "2005-10-25T00:00:00", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=20084", "cvelist": ["CVE-2005-1974"], "lastseen": "2016-09-26T17:25:13"}, {"id": "HPUX_PHSS_33866.NASL", "type": "nessus", "title": "HP-UX PHSS_33866 : HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE), Remote Privileged Access (HPSBMA01234 SSRT051052 rev.2)", "description": "s700_800 11.00 OV ITO6.0X OVO JavaGUI client A.07.20.1 : \n\nA potential security vulnerability has been identified with the HP OpenView Operations and OpenView VantagePoint Java Runtime Environment (JRE). This vulnerability may allow an untrusted remote applet to elevate its privileges.", "published": "2005-10-25T00:00:00", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=20086", "cvelist": ["CVE-2005-1974"], "lastseen": "2016-09-26T17:26:18"}, {"id": "JAVA_JRE_PLUGIN_SECURITY_BYPASS2_UNIX.NASL", "type": "nessus", "title": "Sun Java JRE / Web Start Java Plug-in Untrusted Applet Privilege Escalation (Unix)", "description": "The remote host is using an unmanaged version of Sun Java Runtime Environment that has vulnerabilities in its Java Runtime Plug-in, a web browser add-on used to display Java applets.\n\nThe JRE Plug-in security can be bypassed by tricking a user into viewing a maliciously crafted web page.\n\nAdditionally, a denial of service vulnerability is present in this version of the JVM. This issue is triggered by viewing an applet that misuses the serialization API.", "published": "2013-02-22T00:00:00", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=64836", "cvelist": ["CVE-2005-1974", "CVE-2005-1973"], "lastseen": "2016-09-26T17:25:09"}, {"id": "JAVA_JRE_PLUGIN_SECURITY_BYPASS2.NASL", "type": "nessus", "title": "Sun Java JRE / Web Start Java Plug-in Untrusted Applet Privilege Escalation", "description": "The remote host is using a vulnerable version of Sun Java Runtime Plug-in, an web browser addon used to display Java applets.\n\nIt has been reported that the JRE Plug-in Security can be bypassed.\nA remote attacker could exploit this by tricking a user into viewing a maliciously crafted web page.\n\nAdditionally, a denial of service vulnerability is present in this version of the JVM. This issue is triggered by viewing an applet that misuses the serialization API.", "published": "2005-06-14T00:00:00", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=18480", "cvelist": ["CVE-2005-1974", "CVE-2005-1973"], "lastseen": "2016-09-26T17:24:20"}, {"id": "GENTOO_GLSA-200503-28.NASL", "type": "nessus", "title": "GLSA-200503-28 : Sun Java: Web Start argument injection vulnerability", "description": "The remote host is affected by the vulnerability described in GLSA-200503-28 (Sun Java: Web Start argument injection vulnerability)\n\n Jouko Pynnonen discovered that Java Web Start contains a vulnerability in the way it handles property tags in JNLP files.\n Impact :\n\n By enticing a user to open a malicious JNLP file, a remote attacker could pass command line arguments to the Java Virtual machine, which can be used to bypass the Java 'sandbox' and to execute arbitrary code with the permissions of the user running the application.\n Workaround :\n\n There is no known workaround at this time.", "published": "2005-03-25T00:00:00", "cvss": {"score": 10, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=17615", "cvelist": ["CVE-2005-0836"], "lastseen": "2016-09-26T17:24:30"}], "suse": [{"id": "SUSE-SA:2005:032", "type": "suse", "title": "remote code execution in java2", "description": "Two security bugs in the SUN Java implementation have been fixed.\n#### Solution\nInstall the updated packages. A possible workaround is to disable Java Applets in your web browser.", "published": "2005-06-22T12:11:10", "cvss": {"score": 10, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2005-06/msg00020.html", "cvelist": ["CVE-2005-1974", "CVE-2005-0836"], "lastseen": "2016-09-04T12:37:04"}], "openvas": [{"id": "OPENVAS:65374", "type": "openvas", "title": "SLES9: Security update for Java2", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n java2\n java2-jre\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5011515 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "published": "2009-10-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=65374", "cvelist": ["CVE-2005-1974", "CVE-2005-0836"], "lastseen": "2017-07-26T08:55:55"}, {"id": "OPENVAS:54893", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200503-28 (Java)", "description": "The remote host is missing updates announced in\nadvisory GLSA 200503-28.", "published": "2008-09-24T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=54893", "cvelist": ["CVE-2005-0836"], "lastseen": "2017-07-24T12:50:23"}], "gentoo": [{"id": "GLSA-200503-28", "type": "gentoo", "title": "Sun Java: Web Start argument injection vulnerability", "description": "### Background\n\nSun provides implementations of Java Development Kits (JDK) and Java Runtime Environments (JRE). These implementations provide the Java Web Start technology that can be used for easy client-side deployment of Java applications. \n\n### Description\n\nJouko Pynnonen discovered that Java Web Start contains a vulnerability in the way it handles property tags in JNLP files. \n\n### Impact\n\nBy enticing a user to open a malicious JNLP file, a remote attacker could pass command line arguments to the Java Virtual machine, which can be used to bypass the Java \"sandbox\" and to execute arbitrary code with the permissions of the user running the application. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll Sun JDK users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/sun-jdk-1.4.2.07\"\n\nAll Sun JRE users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/sun-jre-bin-1.4.2.07\"", "published": "2005-03-24T00:00:00", "cvss": {"score": 10, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://security.gentoo.org/glsa/200503-28", "cvelist": ["CVE-2005-0836"], "lastseen": "2016-09-06T19:46:30"}]}}