The version of Sun Java Runtime Environment (JRE) J2SE 1.4.2 installed on the remote host is affected by multiple security issues :

  - A buffer overflow vulnerability in the font processing     module of the JRE could allow an untrusted     applet/application to elevate its privileges to read,     write and execute local applications with the privileges     of the user running an untrusted applet (238666).

  - A vulnerability in the JRE could allow an untrusted     applet/application to elevate its privileges to read,     write and execute local applications with the privileges     of the user running an untrusted applet (238967).

  - A buffer overflow vulnerability in Java Web Start could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start, could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start, may disclose the     location of Java Web Start cache (238905).

  - A vulnerability in the JRE may allow an untrusted applet     to establish connections to services running on the     local host and potentially exploit vulnerabilities     existing in the underlying JRE (238968).

  - It should be noted that J2SE 1.4.2 is in its EOL period,     and the transition is set to complete on Oct 30th 2008.

The version of Sun Java Runtime Environment (JRE) 6.0 installed on the remote host is affected by multiple security issues :

  - A vulnerability in the JRE could allow unauthorized     access to certain URL resources or cause a denial of     service condition while processing XML data. In order to     successfully exploit this issue, a JAX-WS client/service     included with a trusted application should process the     malicious XML content (238628).

  - A vulnerability in the JRE may allow an untrusted applet     to access information from another applet (238687).

  - A buffer overflow vulnerability in Java Web Start could     allow an untrusted applet to elevate its privileges to     read, write and execute local applications available to     users running an untrusted application (238905).

  - A vulnerability in Java Web Start could allow an     untrusted application to create or delete arbitrary     files subject to the privileges of the user running the     application (238905).

  - A vulnerability in Java Web Start may disclose the     location of Java Web Start cache (238905).

  - A vulnerability in Sun Java Management Extensions (JMX)     could allow a JMX client running on a remote host to     perform unauthorized actions on a host running JMX with     local monitoring enabled (238965).

  - A vulnerability in the JRE could allow an untrusted     applet / application to elevate its privileges to     read, write and execute local applications with the     privileges of the user running an untrusted applet     (238967, 238687).

  - A vulnerability in the JRE may allow an untrusted     applet to establish connections to services running on     the localhost and potentially exploit vulnerabilities     existing in the underlying JRE (238968).

Updated java-1.6.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Java Runtime Environment (JRE) contains the software and tools that users need to run applets and applications written using the Java programming language.

A vulnerability was found in the Java Management Extensions (JMX) management agent, when local monitoring is enabled. This allowed remote attackers to perform illegal operations. (CVE-2008-3103)

Multiple vulnerabilities with unsigned applets were reported. A remote attacker could misuse an unsigned applet to connect to localhost services running on the host running the applet. (CVE-2008-3104)

Several vulnerabilities in the Java API for XML Web Services (JAX-WS) client and service implementation were found. A remote attacker who caused malicious XML to be processed by a trusted or untrusted application was able access URLs or cause a denial of service.
(CVE-2008-3105, CVE-2008-3106)

A JRE vulnerability could be triggered by an untrusted application or applet. A remote attacker could grant an untrusted applet or application extended privileges such as being able to read and write local files, or execute local programs. (CVE-2008-3107)

Several vulnerabilities within the JRE scripting support were reported. A remote attacker could grant an untrusted applet extended privileges such as reading and writing local files, executing local programs, or querying the sensitive data of other applets.
(CVE-2008-3109, CVE-2008-3110)

A vulnerability in Java Web Start was found. A remote attacker was able to create arbitrary files with the permissions of the user running the untrusted Java Web Start application. (CVE-2008-3112)

Another vulnerability in Java Web Start when processing untrusted applications was reported. An attacker was able to acquire sensitive information, such as the cache location. (CVE-2008-3114)

Users of java-1.6.0-sun should upgrade to these updated packages, which correct these issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
64817	Sun Java J2SE 1.4.2 < Update 18 Multiple Vulnerabilities (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	critical
64833	Sun Java JDK/JRE 6 < Update 7 Multiple Vulnerabilities (Unix)	Nessus	Misc.	2013/2/22	2022/4/11	critical
63858	RHEL 5 : java-1.6.0-sun (RHSA-2008:0594)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	critical

偵測

搜尋 Plugin

critical

critical

critical