IBM Java 5 SR16-FP4 has been released which fixes lots of bugs and security issues.

More information can be found on :

http://www.ibm.com/developerworks/java/jdk/alerts/

CVEs fixed: CVE-2013-4041, CVE-2013-5375, CVE-2013-5372, CVE-2013-5843, CVE-2013-5830, CVE-2013-5829, CVE-2013-5842, CVE-2013-5782, CVE-2013-5817, CVE-2013-5809, CVE-2013-5814, CVE-2013-5802, CVE-2013-5804, CVE-2013-5783, CVE-2013-3829, CVE-2013-4002, CVE-2013-5774, CVE-2013-5825, CVE-2013-5840, CVE-2013-5801, CVE-2013-5778, CVE-2013-5849, CVE-2013-5790, CVE-2013-5780, CVE-2013-5797, CVE-2013-5803

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IBM WebSphere Application Server 8.5 prior to Fix Pack 8.5.5.2 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - Numerous errors exist related to the included IBM SDK     for Java (based on the Oracle JDK) that could allow     denial of service attacks and information disclosure.
    (CVE-2013-5372, CVE-2013-5780, CVE-2013-5803)

  - User input validation errors exist related to the     Administrative console and the Oauth component that     could allow cross-site scripting attacks.
    (CVE-2013-6725 / PM98132, CVE-2013-6323 / PI04777,     CVE-2013-6738 / PI05661)

  - An error exists due to a failure to properly     handle by web services endpoint requests that     could allow denial of service attacks.
    (CVE-2013-6325 / PM99450, PI08267)

  - An error exists in the included IBM Global Security     Kit related to SSL handling that could allow denial     of service attacks. (CVE-2013-6329 / PI05309)

  - A flaw exists with the 'mod_dav' module that is caused     when tracking the length of CDATA that has leading     white space. A remote attacker with a specially crafted     DAV WRITE request can cause the service to stop     responding. (CVE-2013-6438 / PI09345)

  - An error exists in the included IBM Global Security     Kit related to malformed X.509 certificate chain     handling that could allow denial of service attacks.
    (CVE-2013-6747 / PI09443)

  - An error exists in the included Apache Tomcat version     related to handling 'Content-Type' HTTP headers and     multipart requests such as file uploads that could     allow denial of service attacks. (CVE-2014-0050 /     PI12648, PI12926)

  - An unspecified error exists that could allow file     disclosures to remote unauthenticated attackers.
    (CVE-2014-0823 / PI05324)

  - An unspecified error exists related to the     Administrative console that could allow a security     bypass. (CVE-2014-0857 / PI07808)

  - An error exists related to a web server plugin and     retrying failed POST requests that could allow denial     of service attacks. (CVE-2014-0859 / PI08892)

  - An error exists related to the Proxy and ODR components     that could allow information disclosure. (CVE-2014-0891     / PI09786)

  - An unspecified error exists related to the 'Liberty     Profile' that could allow information disclosure.
    (CVE-2014-0896 / PI10134)

ID	名稱	產品	系列	已發布	已更新	嚴重性
83601	SUSE SLES10 Security Update : IBM Java 5 (SUSE-SU-2013:1669-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	critical
74235	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.2 Multiple Vulnerabilities	Nessus	Web Servers	2014/5/29	2019/11/26	high

偵測

搜尋 Plugin

critical

high