Vulnerabilities > CVE-2013-4002

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

Vulnerable Configurations

Part	Description	Count
Application	Ibm IBM Java 5.0.12.2 IBM Java 5.0.12.3 IBM Java 5.0.0.0 IBM Java 5.0.14.0 IBM Java 5.0.11.0 IBM Java 5.0.16.0 IBM Java 5.0.12.1 IBM Java 5.0.13.0 IBM Java 5.0.16.2 IBM Java 5.0.12.4 IBM Java 5.0.11.2 IBM Java 5.0.11.1 IBM Java 5.0.16.1 IBM Java 5.0.12.0 IBM Java 5.0.12.5 IBM Java 5.0.15.0 IBM Java 6.0.3.0 IBM Java 6.0.9.0 IBM Java 6.0.13.0 IBM Java 6.0.10.1 IBM Java 6.0.10.0 IBM Java 6.0.13.2 IBM Java 6.0.6.0 IBM Java 6.0.1.0 IBM Java 6.0.9.1 IBM Java 6.0.12.0 IBM Java 6.0.8.1 IBM Java 6.0.11.0 IBM Java 6.0.5.0 IBM Java 6.0.7.0 IBM Java 6.0.2.0 IBM Java 6.0.13.1 IBM Java 6.0.4.0 IBM Java 6.0.9.2 IBM Java 6.0.8.0 IBM Java 6.0.0.0 IBM Java 7.0.0.0 IBM Java 7.0.2.0 IBM Java 7.0.4.2 IBM Java 7.0.1.0 IBM Java 7.0.4.1 IBM Java 7.0.3.0 IBM Java 7.0.4.0 IBM Sterling B2B Integrator 5.2.4 IBM Sterling B2B Integrator 5.1 IBM Sterling B2B Integrator 5.2 IBM Host ON Demand 11.0 IBM Host ON Demand 11.0.1 IBM Host ON Demand 11.0.2 IBM Host ON Demand 11.0.3 IBM Host ON Demand 11.0.4 IBM Host ON Demand 11.0.5 IBM Host ON Demand 11.0.5.1 IBM Host ON Demand 11.0.6 IBM Host ON Demand 11.0.6.1 IBM Host ON Demand 11.0.7 IBM Host ON Demand 11.0.8 IBM Tivoli Application Dependency Discovery Manager 7.2.2 IBM Sterling File Gateway 2.1 IBM Sterling File Gateway 2.2	60
Application	Oracle Oracle JRE 1.7.0 Oracle JRE 1.5.0 Oracle JRE 1.6.0 Oracle JDK 1.7.0 Oracle JDK 1.5.0 Oracle JDK 1.6.0 Oracle Jrockit R27.7.0 Oracle Jrockit R27.7.1 Oracle Jrockit R27.7.2 Oracle Jrockit R27.7.3 Oracle Jrockit R27.7.4 Oracle Jrockit R27.7.5 Oracle Jrockit R27.7.6 Oracle Jrockit R28.0.0 Oracle Jrockit R28.0.1 Oracle Jrockit R28.0.2 Oracle Jrockit R28.1.0 Oracle Jrockit R28.1.1 Oracle Jrockit R28.1.3 Oracle Jrockit R28.1.4 Oracle Jrockit R28.1.5 Oracle Jrockit R28.2.0 Oracle Jrockit R28.2.2 Oracle Jrockit R28.2.3 Oracle Jrockit R28.2.4 Oracle Jrockit R28.2.5 Oracle Jrockit R28.2.6 Oracle Jrockit R28.2.7 Oracle Jrockit R28.2.8	29
Application	Apache Apache Xerces2 Java 2.9.1 Apache Xerces2 Java 2.10.0 Apache Xerces2 Java 2.11.0	3
OS	Microsoft Microsoft Windows -	1
OS	Ibm IBM AIX - IBM I -	2
OS	Linux Linux Linux Kernel -	1
OS	Oracle Oracle Solaris -	1
OS	Hp HP HP UX -	1
OS	Suse Suse Linux Enterprise Desktop 11 Suse Linux Enterprise Desktop 10 Suse Linux Enterprise Server 11 Suse Linux Enterprise Server 9 Suse Linux Enterprise Server 10 Suse Linux Enterprise SDK 11 Suse Linux Enterprise Java 11 Suse Linux Enterprise Java 10	14
OS	Opensuse Opensuse Opensuse 12.3 Opensuse Opensuse 12.2	2
OS	Canonical Canonical Ubuntu Linux 13.04 Canonical Ubuntu Linux 13.10 Canonical Ubuntu Linux 12.10 Canonical Ubuntu Linux 10.04 Canonical Ubuntu Linux 12.04	5

Nessus

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_JAVA-1_6_0-IBM-130723.NASL
description	IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ Also the following bugs have been fixed : - add Europe/Busingen to tzmappings. (bnc#817062) - mark files in jre/bin and bin/ as executable (bnc#823034)
last seen	2020-06-05
modified	2013-07-26
plugin id	69069
published	2013-07-26
reporter	This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/69069
title	SuSE 11.2 / 11.3 Security Update : java-1_6_0-ibm (SAT Patch Numbers 8105 / 8107)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SuSE 11 update information. The text itself is # copyright (C) Novell, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(69069); script_version("1.13"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2013-1500", "CVE-2013-1571", "CVE-2013-2407", "CVE-2013-2412", "CVE-2013-2437", "CVE-2013-2442", "CVE-2013-2443", "CVE-2013-2444", "CVE-2013-2446", "CVE-2013-2447", "CVE-2013-2448", "CVE-2013-2450", "CVE-2013-2451", "CVE-2013-2452", "CVE-2013-2453", "CVE-2013-2454", "CVE-2013-2455", "CVE-2013-2456", "CVE-2013-2457", "CVE-2013-2459", "CVE-2013-2463", "CVE-2013-2464", "CVE-2013-2465", "CVE-2013-2466", "CVE-2013-2468", "CVE-2013-2469", "CVE-2013-2470", "CVE-2013-2471", "CVE-2013-2472", "CVE-2013-2473", "CVE-2013-3009", "CVE-2013-3011", "CVE-2013-3012", "CVE-2013-3743", "CVE-2013-4002"); script_name(english:"SuSE 11.2 / 11.3 Security Update : java-1_6_0-ibm (SAT Patch Numbers 8105 / 8107)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 11 host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ Also the following bugs have been fixed : - add Europe/Busingen to tzmappings. (bnc#817062) - mark files in jre/bin and bin/ as executable (bnc#823034)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=817062" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=823034" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=829212" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-1500.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-1571.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2407.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2412.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2437.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2442.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2443.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2444.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2446.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2447.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2448.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2450.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2451.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2452.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2453.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2454.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2455.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2456.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2457.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2459.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2463.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2464.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2465.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2466.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2468.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2469.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2470.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2471.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2472.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2473.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-3009.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-3011.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-3012.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-3743.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-4002.html" ); script_set_attribute( attribute:"solution", value:"Apply SAT patch number 8105 / 8107 as appropriate." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Java storeImageArray() Invalid Array Indexing Vulnerability'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:java-1_6_0-ibm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:java-1_6_0-ibm-alsa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:java-1_6_0-ibm-fonts"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:java-1_6_0-ibm-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:java-1_6_0-ibm-plugin"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11"); script_set_attribute(attribute:"patch_publication_date", value:"2013/07/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/26"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11"); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu); flag = 0; if (rpm_check(release:"SLES11", sp:2, reference:"java-1_6_0-ibm-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:2, reference:"java-1_6_0-ibm-fonts-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:2, reference:"java-1_6_0-ibm-jdbc-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:2, cpu:"i586", reference:"java-1_6_0-ibm-alsa-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:2, cpu:"i586", reference:"java-1_6_0-ibm-plugin-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:2, cpu:"x86_64", reference:"java-1_6_0-ibm-plugin-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:3, reference:"java-1_6_0-ibm-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:3, reference:"java-1_6_0-ibm-fonts-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:3, reference:"java-1_6_0-ibm-jdbc-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"java-1_6_0-ibm-alsa-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"java-1_6_0-ibm-plugin-1.6.0_sr14.0-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"java-1_6_0-ibm-plugin-1.6.0_sr14.0-0.3.1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_JAVA-1_6_0-OPENJDK-131129.NASL
description	OpenJDK 1.6 was updated to the new Icedtea release 1.12.7, which includes many fixes for bugs and security issues : - S8006900, CVE-2013-3829: Add new date/time capability - S8008589: Better MBean permission validation - S8011071, CVE-2013-5780: Better crypto provider handling - S8011081, CVE-2013-5772: Improve jhat - S8011157, CVE-2013-5814: Improve CORBA portablility - S8012071, CVE-2013-5790: Better Building of Beans - S8012147: Improve tool support - S8012277: CVE-2013-5849: Improve AWT DataFlavor - S8012425, CVE-2013-5802: Transform TransformerFactory - S8013503, CVE-2013-5851: Improve stream factories - S8013506: Better Pack200 data handling - S8013510, CVE-2013-5809: Augment image writing code - S8013514: Improve stability of cmap class - S8013739, CVE-2013-5817: Better LDAP resource management - S8013744, CVE-2013-5783: Better tabling for AWT - S8014085: Better serialization support in JMX classes - S8014093, CVE-2013-5782: Improve parsing of images - S8014102, CVE-2013-5778: Improve image conversion - S8014341, CVE-2013-5803: Better service from Kerberos servers - S8014349, CVE-2013-5840: (cl) Class.getDeclaredClass problematic in some class loader configurations - S8014530, CVE-2013-5825: Better digital signature processing - S8014534: Better profiling support - S8014987, CVE-2013-5842: Augment serialization handling - S8015614: Update build settings - S8015731: Subject java.security.auth.subject to improvements - S8015743, CVE-2013-5774: Address internet addresses - S8016256: Make finalization final - S8016653, CVE-2013-5804: javadoc should ignore ignoreable characters in names - S8016675, CVE-2013-5797: Make Javadoc pages more robust - S8017196, CVE-2013-5850: Ensure Proxies are handled appropriately - S8017287, CVE-2013-5829: Better resource disposal - S8017291, CVE-2013-5830: Cast Proxies Aside - S8017298, CVE-2013-4002: Better XML support - S8017300, CVE-2013-5784: Improve Interface Implementation - S8017505, CVE-2013-5820: Better Client Service - S8019292: Better Attribute Value Exceptions - S8019617: Better view of objects - S8020293: JVM crash - S8021290, CVE-2013-5823: Better signature validation - S8022940: Enhance CORBA translations - S8023683: Enhance class file parsing
last seen	2020-06-05
modified	2013-12-03
plugin id	71171
published	2013-12-03
reporter	This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/71171
title	SuSE 11.2 Security Update : OpenJDK 1.6 (SAT Patch Number 8598)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2014-1319.NASL
description	From Red Hat Security Advisory 2014:1319 : Updated xerces-j2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Apache Xerces for Java (Xerces-J) is a high performance, standards compliant, validating XML parser written in Java. The xerces-j2 packages provide Xerces-J version 2. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) All xerces-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the Xerces-J must be restarted for this update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	77978
published	2014-09-30
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/77978
title	Oracle Linux 6 / 7 : xerces-j2 (ELSA-2014-1319)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2014-1319.NASL
description	Updated xerces-j2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Apache Xerces for Java (Xerces-J) is a high performance, standards compliant, validating XML parser written in Java. The xerces-j2 packages provide Xerces-J version 2. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) All xerces-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the Xerces-J must be restarted for this update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	77994
published	2014-10-01
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/77994
title	CentOS 6 / 7 : xerces-j2 (CESA-2014:1319)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2013-1451.NASL
description	From Red Hat Security Advisory 2013:1451 : Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70551
published	2013-10-23
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70551
title	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2013-1451)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2014-1822.NASL
description	Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) This release of JBoss Enterprise Application Platform also includes bug fixes and enhancements. A list of these changes is available from the JBoss Enterprise Application Platform 6.3.2 Downloads page on the Customer Portal. All users of Red Hat JBoss Enterprise Application Platform 6.3 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	79117
published	2014-11-11
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/79117
title	RHEL 7 : JBoss EAP (RHSA-2014:1822)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2013-1451.NASL
description	Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70571
published	2013-10-24
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70571
title	CentOS 6 : java-1.7.0-openjdk (CESA-2013:1451)

NASL family	Windows
NASL id	LOTUS_DOMINO_8_5_3_FP5.NASL
description	The remote host has a version of IBM Domino (formerly Lotus Domino) 8.5.x prior to 8.5.3 Fix Pack 5 installed. It is, therefore, reportedly affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of the IBM JRE that contains numerous security issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436, CVE-2013-2455, CVE-2013-3006, CVE-2013-3007, CVE-2013-3008, CVE-2013-3009, CVE-2013-3010, CVE-2013-3011, CVE-2013-3012) - Note also that fixes in the Oracle Java CPUs for February, April and June 2013 are included in the fixed IBM Java release, which is itself included in the fixed IBM Domino release. (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0401, CVE-2013-0402, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0448, CVE-2013-0449, CVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478, CVE-2013-1479, CVE-2013-1480, CVE-2013-1481, CVE-2013-1488, CVE-2013-1489, CVE-2013-1491, CVE-2013-1500, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2400, CVE-2013-2407, CVE-2013-2412, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2437, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2462, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2467, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)
last seen	2020-06-01
modified	2020-06-02
plugin id	70743
published	2013-11-04
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70743
title	IBM Domino 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_JAVA-1_7_0-IBM-130723.NASL
description	IBM Java 1.7.0 has been updated to SR5 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ Also the following bugs have been fixed : - add Europe/Busingen to tzmappings. (bnc#817062) - mark files in jre/bin and bin/ as executable (bnc#823034)
last seen	2020-06-05
modified	2013-07-26
plugin id	69070
published	2013-07-26
reporter	This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/69070
title	SuSE 11.2 / 11.3 Security Update : java-1_7_0-ibm (SAT Patch Numbers 8106 / 8108)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2014-193.NASL
description	A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU (CVE-2013-4002).
last seen	2020-06-01
modified	2020-06-02
plugin id	78019
published	2014-10-02
reporter	This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/78019
title	Mandriva Linux Security Advisory : xerces-j2 (MDVSA-2014:193)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_JAVA-1_7_0-OPENJDK-131104.NASL
description	This release updates our OpenJDK 7 support in the 2.4.x series with a number of security fixes and synchronises it with upstream development. The security issues fixed (a long list) can be found in the following link : http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-October/025 087.html
last seen	2020-06-05
modified	2013-11-13
plugin id	70873
published	2013-11-13
reporter	This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/70873
title	SuSE 11.3 Security Update : OpenJDK 7 (SAT Patch Number 8494)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20131021_JAVA_1_7_0_OPENJDK_ON_SL5_X.NASL
description	Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross- site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-03-18
modified	2013-10-22
plugin id	70537
published	2013-10-22
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70537
title	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x i386/x86_64 (20131021)

NASL family	Misc.
NASL id	DOMINO_9_0_1.NASL
description	According to its banner, the version of IBM Domino (formerly IBM Lotus Domino) on the remote host is 9.x earlier than 9.0.1. It is, therefore, affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of IBM JRE that contains numerous security issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436, CVE-2013-2455, CVE-2013-3006, CVE-2013-3007, CVE-2013-3008, CVE-2013-3009, CVE-2013-3010, CVE-2013-3011, CVE-2013-3012) - An input validation error exists related to handling content in email messages that could allow cross-site scripting attacks. (CVE-2013-4063) - An input validation error exists related to iNotes when running in
last seen	2020-06-01
modified	2020-06-02
plugin id	71859
published	2014-01-08
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/71859
title	IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (uncredentialed check)

NASL family	Windows
NASL id	LOTUS_DOMINO_9_0_1.NASL
description	The remote host has a version of IBM Domino (formerly Lotus Domino) 9.x prior to 9.0.1 installed. It is, therefore, reportedly affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of IBM JRE that contains numerous security issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436, CVE-2013-2455, CVE-2013-3006, CVE-2013-3007, CVE-2013-3008, CVE-2013-3009, CVE-2013-3010, CVE-2013-3011, CVE-2013-3012) - An input validation error exists related to handling content in email messages that could allow cross-site scripting attacks. (CVE-2013-4063) - An input validation error exists related to iNotes when running in
last seen	2020-06-01
modified	2020-06-02
plugin id	71861
published	2014-01-08
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/71861
title	IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (credentialed check)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1505.NASL
description	Updated java-1.6.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70771
published	2013-11-06
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70771
title	RHEL 5 / 6 : java-1.6.0-openjdk (RHSA-2013:1505)

NASL family	Misc.
NASL id	DOMINO_8_5_3FP5.NASL
description	According to its banner, the version of IBM Domino (formerly IBM Lotus Domino) on the remote host is 8.5.x earlier than 8.5.3 FP5. It is, therefore, affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of the IBM JRE that contains numerous security issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436, CVE-2013-2455, CVE-2013-3006, CVE-2013-3007, CVE-2013-3008, CVE-2013-3009, CVE-2013-3010, CVE-2013-3011, CVE-2013-3012) - Note also that fixes in the Oracle Java CPUs for February, April and June 2013 are included in the fixed IBM Java release, which is included in the fixed IBM Domino release. (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0401, CVE-2013-0402, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0448, CVE-2013-0449, CVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478, CVE-2013-1479, CVE-2013-1480, CVE-2013-1481, CVE-2013-1488, CVE-2013-1489, CVE-2013-1491, CVE-2013-1500, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2400, CVE-2013-2407, CVE-2013-2412, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2437, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2462, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2467, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)
last seen	2020-06-01
modified	2020-06-02
plugin id	70742
published	2013-11-04
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70742
title	IBM Domino 8.5.x < 8.5.3 FP 5 Multiple Vulnerabilities

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2014-0414.NASL
description	Updated java-1.6.0-sun packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. [Updated 12th May 2014] The package list in this erratum has been updated to make the packages available in the Oracle Java for Red Hat Enterprise Linux 6 Workstation x86_64 channels on the Red Hat Network. Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory pages, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2461, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5852, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 75 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	79011
published	2014-11-08
reporter	This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/79011
title	RHEL 5 / 6 : java-1.6.0-sun (RHSA-2014:0414)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-2089-1.NASL
description	Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-3829, CVE-2013-5783, CVE-2013-5804, CVE-2014-0411) Several vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2013-4002, CVE-2013-5803, CVE-2013-5823, CVE-2013-5825, CVE-2013-5896, CVE-2013-5910) Several vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2013-5772, CVE-2013-5774, CVE-2013-5784, CVE-2013-5797, CVE-2013-5820, CVE-2014-0376, CVE-2014-0416) Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-5778, CVE-2013-5780, CVE-2013-5790, CVE-2013-5800, CVE-2013-5840, CVE-2013-5849, CVE-2013-5851, CVE-2013-5884, CVE-2014-0368) Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2013-5782, CVE-2013-5802, CVE-2013-5809, CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5830, CVE-2013-5842, CVE-2013-5850, CVE-2013-5878, CVE-2013-5893, CVE-2013-5907, CVE-2014-0373, CVE-2014-0408, CVE-2014-0422, CVE-2014-0428) A vulnerability was discovered in the OpenJDK JRE related to information disclosure and availability. An attacker could exploit this to expose sensitive data over the network or cause a denial of service. (CVE-2014-0423). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2014-01-24
plugin id	72117
published	2014-01-24
reporter	Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/72117
title	Ubuntu 12.10 / 13.04 / 13.10 : openjdk-7 vulnerabilities (USN-2089-1)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2013-246.NASL
description	Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829 , CVE-2013-5814 , CVE-2013-5817 , CVE-2013-5842 , CVE-2013-5850) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825 , CVE-2013-4002 , CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829 , CVE-2013-5840 , CVE-2013-5774 , CVE-2013-5783 , CVE-2013-5820 , CVE-2013-5849 , CVE-2013-5790 , CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804 , CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803)
last seen	2020-06-01
modified	2020-06-02
plugin id	70908
published	2013-11-14
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70908
title	Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2013-246)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1451.NASL
description	Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70554
published	2013-10-23
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70554
title	RHEL 6 : java-1.7.0-openjdk (RHSA-2013:1451)

NASL family	Windows
NASL id	LOTUS_NOTES_8_5_3_FP5.NASL
description	The remote host has a version of IBM Notes (formerly Lotus Notes) 8.5.x prior to 8.5.3 Fix Pack 5 installed. It is, therefore, reportedly affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of the IBM JRE that contains numerous security issues. (CVE-2013-0809, CVE-2013-1493, CVE-2013-2436, CVE-2013-2455, CVE-2013-3006, CVE-2013-3007, CVE-2013-3008, CVE-2013-3009, CVE-2013-3010, CVE-2013-3011, CVE-2013-3012) - Note also that fixes in the Oracle Java CPUs for February, April and June 2013 are included in the fixed IBM Java release, which is included in the fixed IBM Notes release. (CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0351, CVE-2013-0401, CVE-2013-0402, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0448, CVE-2013-0449, CVE-2013-0450, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478, CVE-2013-1479, CVE-2013-1480, CVE-2013-1481, CVE-2013-1488, CVE-2013-1489, CVE-2013-1491, CVE-2013-1500, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-1571, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2400, CVE-2013-2407, CVE-2013-2412, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2437, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2462, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2467, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3744, CVE-2013-4002)
last seen	2020-06-01
modified	2020-06-02
plugin id	70744
published	2013-11-04
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70744
title	IBM Notes 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities

NASL family	Windows
NASL id	ORACLE_JAVA_CPU_OCT_2013.NASL
description	The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 45, 6 Update 65, or 5 Update 55. It is, therefore, potentially affected by security issues in the following components : - 2D - AWT - BEANS - CORBA - Deployment - JAX-WS - JAXP - JGSS - jhat - JNDI - JavaFX - Javadoc - Libraries - SCRIPTING - Security - Swing
last seen	2020-06-01
modified	2020-06-02
plugin id	70472
published	2013-10-17
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70472
title	Oracle Java SE Multiple Vulnerabilities (October 2013 CPU)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2014-1818.NASL
description	Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) This release of JBoss Enterprise Application Platform also includes bug fixes and enhancements. A list of these changes is available from the JBoss Enterprise Application Platform 6.3.2 Downloads page on the Customer Portal. All users of Red Hat JBoss Enterprise Application Platform 6.3 on Red Hat Enterprise Linux 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	79115
published	2014-11-11
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/79115
title	RHEL 6 : JBoss EAP (RHSA-2014:1818)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1059.NASL
description	Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743) Red Hat would like to thank Tim Brown for reporting CVE-2013-1500, and US-CERT for reporting CVE-2013-1571. US-CERT acknowledges Oracle as the original reporter of CVE-2013-1571. All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR14 release. All running instances of IBM Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	68900
published	2013-07-16
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68900
title	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2013:1059)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-2033-1.NASL
description	Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-3829, CVE-2013-5783, CVE-2013-5804) Several vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2013-4002, CVE-2013-5803, CVE-2013-5823, CVE-2013-5825) Several vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2013-5772, CVE-2013-5774, CVE-2013-5784, CVE-2013-5797, CVE-2013-5820) Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2013-5778, CVE-2013-5780, CVE-2013-5790, CVE-2013-5840, CVE-2013-5849, CVE-2013-5851) Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2013-5782, CVE-2013-5802, CVE-2013-5809, CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5830, CVE-2013-5842, CVE-2013-5850). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	71037
published	2013-11-22
reporter	Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/71037
title	Ubuntu 10.04 LTS / 12.04 LTS : openjdk-6 vulnerabilities (USN-2033-1)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2013-1505.NASL
description	Updated java-1.6.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70769
published	2013-11-06
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70769
title	CentOS 5 / 6 : java-1.6.0-openjdk (CESA-2013:1505)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2013-267.NASL
description	Updated java-1.7.0-openjdk packages fix security vulnerabilities : Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine (CVE-2013-5782). The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine (CVE-2013-5830). Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838). Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions (CVE-2013-5809). The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions (CVE-2013-5802). Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823). Multiple improper permission check issues were discovered in the Libraries Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784). It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory (CVE-2013-5778). Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks (CVE-2013-5804, CVE-2013-5797). Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data (CVE-2013-5780). The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks (CVE-2013-5772). The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit (CVE-2013-5803). This updates IcedTea to version 2.4.3, which fixes these issues, as well as several others.
last seen	2020-06-01
modified	2020-06-02
plugin id	70967
published	2013-11-20
reporter	This script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/70967
title	Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:267)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2013-1447.NASL
description	Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70547
published	2013-10-23
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70547
title	CentOS 5 : java-1.7.0-openjdk (CESA-2013:1447)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2014-436.NASL
description	A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.
last seen	2020-06-01
modified	2020-06-02
plugin id	78779
published	2014-11-03
reporter	This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/78779
title	Amazon Linux AMI : xerces-j2 (ALAS-2014-436)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2013-847.NASL
description	Update to icedtea 2.4.3 (bnc#846999) synchronized OpenJDK 7 support with the upstream u45 b31 fixes the following issues : - S8006900, CVE-2013-3829: Add new date/time capability - S8008589: Better MBean permission validation - S8011071, CVE-2013-5780: Better crypto provider handling - S8011081, CVE-2013-5772: Improve jhat - S8011157, CVE-2013-5814: Improve CORBA portablility - S8012071, CVE-2013-5790: Better Building of Beans - S8012147: Improve tool support - S8012277: CVE-2013-5849: Improve AWT DataFlavor - S8012425, CVE-2013-5802: Transform TransformerFactory - S8013503, CVE-2013-5851: Improve stream factories - S8013506: Better Pack200 data handling - S8013510, CVE-2013-5809: Augment image writing code - S8013514: Improve stability of cmap class - S8013739, CVE-2013-5817: Better LDAP resource management - S8013744, CVE-2013-5783: Better tabling for AWT - S8014085: Better serialization support in JMX classes - S8014093, CVE-2013-5782: Improve parsing of images - S8014098: Better profile validation - S8014102, CVE-2013-5778: Improve image conversion - S8014341, CVE-2013-5803: Better service from Kerberos servers - S8014349, CVE-2013-5840: (cl) Class.getDeclaredClass problematic in some class loader configurations - S8014530, CVE-2013-5825: Better digital signature processing - S8014534: Better profiling support - S8014987, CVE-2013-5842: Augment serialization handling - S8015614: Update build settings - S8015731: Subject java.security.auth.subject to improvements - S8015743, CVE-2013-5774: Address internet addresses - S8016256: Make finalization final - S8016653, CVE-2013-5804: javadoc should ignore ignoreable characters in names - S8016675, CVE-2013-5797: Make Javadoc pages more robust - S8017196, CVE-2013-5850: Ensure Proxies are handled appropriately - S8017287, CVE-2013-5829: Better resource disposal - S8017291, CVE-2013-5830: Cast Proxies Aside - S8017298, CVE-2013-4002: Better XML support - S8017300, CVE-2013-5784: Improve Interface Implementation - S8017505, CVE-2013-5820: Better Client Service - S8019292: Better Attribute Value Exceptions - S8019617: Better view of objects - S8020293: JVM crash - S8021275, CVE-2013-5805: Better screening for ScreenMenu - S8021282, CVE-2013-5806: Better recycling of object instances - S8021286: Improve MacOS resourcing - S8021290, CVE-2013-5823: Better signature validation - S8022931, CVE-2013-5800: Enhance Kerberos exceptions - S8022940: Enhance CORBA translations - S8023683: Enhance class file parsing - Backports - S6614237: missing codepage Cp290 at java runtime - S8005932: Java 7 on mac os x only provides text clipboard formats - S8014046: (process) Runtime.exec(String) fails if command contains spaces [win] - S8015144: Performance regression in ICU OpenType Layout library - S8015965: (process) Typo in name of property to allow ambiguous commands - S8015978: Incorrect transformation of XPath expression
last seen	2020-06-05
modified	2014-06-13
plugin id	75196
published	2014-06-13
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/75196
title	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:1663-1)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2014-10626.NASL
description	Security fix for CVE-2013-4002 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2014-09-26
plugin id	77867
published	2014-09-26
reporter	This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/77867
title	Fedora 20 : xerces-j2-2.11.0-17.fc20 (2014-10626)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_JAVA_10_6_UPDATE17.NASL
description	The remote Mac OS X host has a version of Java for Mac OS X 10.6 that is missing Update 17, which updates the Java version to 1.6.0_65. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.
last seen	2019-10-28
modified	2013-10-16
plugin id	70459
published	2013-10-16
reporter	This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/70459
title	Mac OS X : Java for Mac OS X 10.6 Update 17

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_JAVA_2013-005.NASL
description	The remote Mac OS X 10.7 or 10.8 host has a Java runtime that is missing the Java for OS X 2013-005 update, which updates the Java version to 1.6.0_65. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox.
last seen	2019-10-28
modified	2013-10-16
plugin id	70458
published	2013-10-16
reporter	This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/70458
title	Mac OS X : Java for OS X 2013-005

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2014-10617.NASL
description	Security fix for CVE-2013-4002 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2014-09-23
plugin id	77791
published	2014-09-23
reporter	This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/77791
title	Fedora 21 : xerces-j2-2.11.0-22.fc21 (2014-10617)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2013-1256-1.NASL
description	IBM Java 1.7.0 has been updated to SR5 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ Also the following bugs have been fixed : - add Europe/Busingen to tzmappings (bnc#817062) - mark files in jre/bin and bin/ as executable (bnc#823034) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2015-05-20
plugin id	83595
published	2015-05-20
reporter	This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/83595
title	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2013:1256-1)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1440.NASL
description	Updated java-1.7.0-oracle packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5775, CVE-2013-5776, CVE-2013-5777, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5788, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5800, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5810, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5838, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5844, CVE-2013-5846, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5851, CVE-2013-5852, CVE-2013-5854) All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 45 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70488
published	2013-10-18
reporter	This script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/70488
title	RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2013:1440)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20131105_JAVA_1_6_0_OPENJDK_ON_SL5_X.NASL
description	Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross- site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-03-18
modified	2013-11-06
plugin id	70772
published	2013-11-06
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70772
title	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x i386/x86_64 (20131105)

NASL family	SuSE Local Security Checks
NASL id	SUSE_JAVA-1_5_0-IBM-8653.NASL
description	IBM Java 1.5.0 has been updated to SR16-FP3 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ Also the following bug has been fixed : - add Europe/Busingen to tzmappings. (bnc#817062) - mark files in jre/bin and bin/ as executable (bnc#823034)
last seen	2020-06-05
modified	2013-07-28
plugin id	69093
published	2013-07-28
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/69093
title	SuSE 10 Security Update : java-1_5_0-ibm (ZYPP Patch Number 8653)

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL16872.NASL
description	Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect availability via unknown vectors.
last seen	2020-06-01
modified	2020-06-02
plugin id	85918
published	2015-09-14
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/85918
title	F5 Networks BIG-IP : Java Runtime Environment vulnerability (SOL16872)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2014-10649.NASL
description	Security fix for CVE-2013-4002 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2014-09-26
plugin id	77868
published	2014-09-26
reporter	This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/77868
title	Fedora 19 : xerces-j2-2.11.0-15.fc19 (2014-10649)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1081.NASL
description	Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2443, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2452, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743) Red Hat would like to thank Tim Brown for reporting CVE-2013-1500, and US-CERT for reporting CVE-2013-1571. US-CERT acknowledges Oracle as the original reporter of CVE-2013-1571. All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR16-FP3 release. All running instances of IBM Java must be restarted for this update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	68922
published	2013-07-17
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68922
title	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2013:1081)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2013-235.NASL
description	Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829 , CVE-2013-5814 , CVE-2013-5817 , CVE-2013-5842 , CVE-2013-5850 , CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825 , CVE-2013-4002 , CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829 , CVE-2013-5840 , CVE-2013-5774 , CVE-2013-5783 , CVE-2013-5820 , CVE-2013-5851 , CVE-2013-5800 , CVE-2013-5849 , CVE-2013-5790 , CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804 , CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803)
last seen	2020-06-01
modified	2020-06-02
plugin id	70897
published	2013-11-14
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70897
title	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2013-235)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2014-1821.NASL
description	Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) This release of JBoss Enterprise Application Platform also includes bug fixes and enhancements. A list of these changes is available from the JBoss Enterprise Application Platform 6.3.2 Downloads page on the Customer Portal. All users of Red Hat JBoss Enterprise Application Platform 6.3 on Red Hat Enterprise Linux 5 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	79116
published	2014-11-11
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/79116
title	RHEL 5 : JBoss EAP (RHSA-2014:1821)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2013-1669-1.NASL
description	IBM Java 5 SR16-FP4 has been released which fixes lots of bugs and security issues. More information can be found on : http://www.ibm.com/developerworks/java/jdk/alerts/ CVEs fixed: CVE-2013-4041, CVE-2013-5375, CVE-2013-5372, CVE-2013-5843, CVE-2013-5830, CVE-2013-5829, CVE-2013-5842, CVE-2013-5782, CVE-2013-5817, CVE-2013-5809, CVE-2013-5814, CVE-2013-5802, CVE-2013-5804, CVE-2013-5783, CVE-2013-3829, CVE-2013-4002, CVE-2013-5774, CVE-2013-5825, CVE-2013-5840, CVE-2013-5801, CVE-2013-5778, CVE-2013-5849, CVE-2013-5790, CVE-2013-5780, CVE-2013-5797, CVE-2013-5803 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2015-05-20
plugin id	83601
published	2015-05-20
reporter	This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/83601
title	SUSE SLES10 Security Update : IBM Java 5 (SUSE-SU-2013:1669-1)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201406-32.NASL
description	The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the IcedTea JDK. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, bypass intended security policies, or have other unspecified impact. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	76303
published	2014-06-30
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/76303
title	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)

NASL family	Misc.
NASL id	DOMINO_9_0_1_FP1.NASL
description	According to its version, the IBM Domino (formerly IBM Lotus Domino) on the remote host is 9.x prior to 9.0.1 Fix Pack 1 (FP1). It is, therefore, affected by the following vulnerabilities : - A stack overflow issue exists due to the insecure
last seen	2020-06-01
modified	2020-06-02
plugin id	73968
published	2014-05-12
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/73968
title	IBM Domino 9.x < 9.0.1 Fix Pack 1 Multiple Vulnerabilities (uncredentialed check)

NASL family	Windows
NASL id	LOTUS_NOTES_9_0_1_FP1.NASL
description	The remote host has a version of IBM Notes (formerly Lotus Notes) 8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities mentioned in the Oracle Java Critical Patch Update advisories for October 2013 and January 2014.
last seen	2020-06-01
modified	2020-06-02
plugin id	73970
published	2014-05-12
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/73970
title	IBM Notes 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities

NASL family	Misc.
NASL id	ORACLE_JAVA_CPU_OCT_2013_UNIX.NASL
description	The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is earlier than 7 Update 45, 6 Update 65, or 5 Update 55. It is, therefore, potentially affected by security issues in the following components : - 2D - AWT - BEANS - CORBA - Deployment - JAX-WS - JAXP - JGSS - jhat - JNDI - JavaFX - Javadoc - Libraries - SCRIPTING - Security - Swing
last seen	2020-06-01
modified	2020-06-02
plugin id	70473
published	2013-10-17
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70473
title	Oracle Java SE Multiple Vulnerabilities (October 2013 CPU) (Unix)

NASL family	SuSE Local Security Checks
NASL id	SUSE_JAVA-1_6_0-IBM-8657.NASL
description	IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ Also the following bug has been fixed : - add Europe/Busingen to tzmappings. (bnc#817062) - mark files in jre/bin and bin/ as executable (bnc#823034)
last seen	2020-06-05
modified	2013-07-26
plugin id	69072
published	2013-07-26
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/69072
title	SuSE 10 Security Update : java-1_6_0-ibm (ZYPP Patch Number 8657)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_JAVA_2014-001.NASL
description	The remote Mac OS X 10.7, 10.8, 10.9, or 10.10 host has a Java runtime that is missing the Java for OS X 2014-001 update, which updates the Java version to 1.6.0_65. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the privileges of the current user outside the Java sandbox. Note that the Java for OS X 2014-001 update installs the same version of Java 6 included in Java for OS X 2013-005.
last seen	2019-10-28
modified	2014-11-06
plugin id	78891
published	2014-11-06
reporter	This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/78891
title	Mac OS X : Java for OS X 2014-001

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1060.NASL
description	Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2400, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2444, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2462, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3744) Red Hat would like to thank Tim Brown for reporting CVE-2013-1500, and US-CERT for reporting CVE-2013-1571. US-CERT acknowledges Oracle as the original reporter of CVE-2013-1571. All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR5 release. All running instances of IBM Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	68901
published	2013-07-16
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68901
title	RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:1060)

NASL family	Misc.
NASL id	JUNIPER_NSM_JSA10642.NASL
description	The remote host has one or more instances of NSM (Network and Security Manager) Server running, with version(s) prior to 2012.2R9. It is, therefore, affected by multiple vulnerabilities related to its Java and Apache installations.
last seen	2020-06-01
modified	2020-06-02
plugin id	77326
published	2014-08-22
reporter	This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/77326
title	Juniper NSM < 2012.2R9 Multiple Java and Apache Vulnerabilities (JSA10642)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20140929_XERCES_J2_ON_SL6_X.NASL
description	A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) Applications using the Xerces-J must be restarted for this update to take effect.
last seen	2020-03-18
modified	2014-09-30
plugin id	77981
published	2014-09-30
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/77981
title	Scientific Linux Security Update : xerces-j2 on SL6.x i386/x86_64 (20140929)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2013-1505.NASL
description	From Red Hat Security Advisory 2013:1505 : Updated java-1.6.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70770
published	2013-11-06
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70770
title	Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2013-1505)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2014-1319.NASL
description	Updated xerces-j2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Apache Xerces for Java (Xerces-J) is a high performance, standards compliant, validating XML parser written in Java. The xerces-j2 packages provide Xerces-J version 2. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) All xerces-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the Xerces-J must be restarted for this update to take effect.
last seen	2020-05-16
modified	2014-09-30
plugin id	77979
published	2014-09-30
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/77979
title	RHEL 6 / 7 : xerces-j2 (RHSA-2014:1319)

NASL family	Windows
NASL id	LOTUS_DOMINO_9_0_1_FP1.NASL
description	The remote host has a version of IBM Domino (formerly Lotus Domino) 8.0.x / 8.5.x / 9.0.x that is bundled with an IBM Java version prior to 1.6 SR15 FP1. It is, therefore, affected by the vulnerabilities mentioned in the Oracle Java Critical Patch Update advisories for October 2013 and January 2014.
last seen	2020-06-01
modified	2020-06-02
plugin id	73969
published	2014-05-12
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/73969
title	IBM Domino 8.0.x / 8.5.x / 9.0.x with IBM Java < 1.6 SR15 FP1 Multiple Vulnerabilities (credentialed check)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2013-1447.NASL
description	Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70536
published	2013-10-22
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70536
title	RHEL 5 : java-1.7.0-openjdk (RHSA-2013:1447)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2013-1447.NASL
description	From Red Hat Security Advisory 2013:1447 : Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit. Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	70535
published	2013-10-22
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70535
title	Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-1447)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20131022_JAVA_1_7_0_OPENJDK_ON_SL6_X.NASL
description	Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine. (CVE-2013-5782) The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2013-5830) Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838) Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions. (CVE-2013-5809) The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions. (CVE-2013-5802) Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed. (CVE-2013-5825, CVE-2013-4002, CVE-2013-5823) Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784) It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory. (CVE-2013-5778) Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks. (CVE-2013-5804, CVE-2013-5797) Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data. (CVE-2013-5780) The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross- site scripting attacks. (CVE-2013-5772) The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit. (CVE-2013-5803) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. All running instances of OpenJDK Java must be restarted for the update to take effect.
last seen	2020-03-18
modified	2013-10-24
plugin id	70576
published	2013-10-24
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/70576
title	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20131022)

Redhat

advisories

bugzilla

id	1019176
title	CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment xerces-j2 is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319001
comment xerces-j2 is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858006

AND

comment xerces-j2-javadoc-xni is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319003
comment xerces-j2-javadoc-xni is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858014

AND

comment xerces-j2-javadoc-other is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319005
comment xerces-j2-javadoc-other is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858008

AND

comment xerces-j2-javadoc-apis is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319007
comment xerces-j2-javadoc-apis is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858012

AND

comment xerces-j2-javadoc-impl is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319009
comment xerces-j2-javadoc-impl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858002

AND

comment xerces-j2-scripts is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319011
comment xerces-j2-scripts is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858004

AND

comment xerces-j2-demo is earlier than 0:2.7.1-12.7.el6_5
oval oval:com.redhat.rhsa:tst:20141319013
comment xerces-j2-demo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858010

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND
comment xerces-j2 is earlier than 0:2.11.0-17.el7_0
oval oval:com.redhat.rhsa:tst:20141319016
comment xerces-j2 is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858006

AND

comment xerces-j2-demo is earlier than 0:2.11.0-17.el7_0
oval oval:com.redhat.rhsa:tst:20141319017
comment xerces-j2-demo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110858010

AND

comment xerces-j2-javadoc is earlier than 0:2.11.0-17.el7_0
oval oval:com.redhat.rhsa:tst:20141319018
comment xerces-j2-javadoc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20141319019

rhsa

id	RHSA-2014:1319
released	2014-09-29
severity	Moderate
title	RHSA-2014:1319: xerces-j2 security update (Moderate)

rhsa
id RHSA-2013:1059
rhsa
id RHSA-2013:1060
rhsa
id RHSA-2013:1081
rhsa
id RHSA-2013:1440
rhsa
id RHSA-2013:1447
rhsa
id RHSA-2013:1451
rhsa
id RHSA-2013:1505
rhsa
id RHSA-2014:0414
rhsa
id RHSA-2014:1818
rhsa
id RHSA-2014:1821
rhsa
id RHSA-2014:1822
rhsa
id RHSA-2014:1823
rhsa
id RHSA-2015:0675
rhsa
id RHSA-2015:0720
rhsa
id RHSA-2015:0765
rhsa
id RHSA-2015:0773

rpms

java-1.6.0-ibm-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-1:1.6.0.14.0-1jpp.1.el6_4
java-1.6.0-ibm-accessibility-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-demo-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-demo-1:1.6.0.14.0-1jpp.1.el6_4
java-1.6.0-ibm-devel-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-devel-1:1.6.0.14.0-1jpp.1.el6_4
java-1.6.0-ibm-javacomm-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-javacomm-1:1.6.0.14.0-1jpp.1.el6_4
java-1.6.0-ibm-jdbc-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-jdbc-1:1.6.0.14.0-1jpp.1.el6_4
java-1.6.0-ibm-plugin-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-plugin-1:1.6.0.14.0-1jpp.1.el6_4
java-1.6.0-ibm-src-1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm-src-1:1.6.0.14.0-1jpp.1.el6_4
java-1.7.0-ibm-1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-demo-1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-demo-1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-devel-1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-devel-1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-jdbc-1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-jdbc-1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-plugin-1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-plugin-1:1.7.0.5.0-1jpp.2.el6_4
java-1.7.0-ibm-src-1:1.7.0.5.0-1jpp.2.el5_9
java-1.7.0-ibm-src-1:1.7.0.5.0-1jpp.2.el6_4
java-1.5.0-ibm-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-1:1.5.0.16.3-1jpp.1.el6_4
java-1.5.0-ibm-accessibility-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-demo-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-demo-1:1.5.0.16.3-1jpp.1.el6_4
java-1.5.0-ibm-devel-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-devel-1:1.5.0.16.3-1jpp.1.el6_4
java-1.5.0-ibm-javacomm-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-javacomm-1:1.5.0.16.3-1jpp.1.el6_4
java-1.5.0-ibm-jdbc-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-jdbc-1:1.5.0.16.3-1jpp.1.el6_4
java-1.5.0-ibm-plugin-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-plugin-1:1.5.0.16.3-1jpp.1.el6_4
java-1.5.0-ibm-src-1:1.5.0.16.3-1jpp.1.el5_9
java-1.5.0-ibm-src-1:1.5.0.16.3-1jpp.1.el6_4
java-1.7.0-oracle-1:1.7.0.45-1jpp.1.el5_10
java-1.7.0-oracle-1:1.7.0.45-1jpp.2.el6_4
java-1.7.0-oracle-devel-1:1.7.0.45-1jpp.1.el5_10
java-1.7.0-oracle-devel-1:1.7.0.45-1jpp.2.el6_4
java-1.7.0-oracle-javafx-1:1.7.0.45-1jpp.1.el5_10
java-1.7.0-oracle-javafx-1:1.7.0.45-1jpp.2.el6_4
java-1.7.0-oracle-jdbc-1:1.7.0.45-1jpp.1.el5_10
java-1.7.0-oracle-jdbc-1:1.7.0.45-1jpp.2.el6_4
java-1.7.0-oracle-plugin-1:1.7.0.45-1jpp.1.el5_10
java-1.7.0-oracle-plugin-1:1.7.0.45-1jpp.2.el6_4
java-1.7.0-oracle-src-1:1.7.0.45-1jpp.1.el5_10
java-1.7.0-oracle-src-1:1.7.0.45-1jpp.2.el6_4
java-1.7.0-openjdk-1:1.7.0.45-2.4.3.1.el5_10
java-1.7.0-openjdk-debuginfo-1:1.7.0.45-2.4.3.1.el5_10
java-1.7.0-openjdk-demo-1:1.7.0.45-2.4.3.1.el5_10
java-1.7.0-openjdk-devel-1:1.7.0.45-2.4.3.1.el5_10
java-1.7.0-openjdk-javadoc-1:1.7.0.45-2.4.3.1.el5_10
java-1.7.0-openjdk-src-1:1.7.0.45-2.4.3.1.el5_10
java-1.7.0-openjdk-1:1.7.0.45-2.4.3.2.el6_4
java-1.7.0-openjdk-debuginfo-1:1.7.0.45-2.4.3.2.el6_4
java-1.7.0-openjdk-demo-1:1.7.0.45-2.4.3.2.el6_4
java-1.7.0-openjdk-devel-1:1.7.0.45-2.4.3.2.el6_4
java-1.7.0-openjdk-javadoc-1:1.7.0.45-2.4.3.2.el6_4
java-1.7.0-openjdk-src-1:1.7.0.45-2.4.3.2.el6_4
java-1.6.0-openjdk-1:1.6.0.0-1.42.1.11.14.el5_10
java-1.6.0-openjdk-1:1.6.0.0-1.65.1.11.14.el6_4
java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.42.1.11.14.el5_10
java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.65.1.11.14.el6_4
java-1.6.0-openjdk-demo-1:1.6.0.0-1.42.1.11.14.el5_10
java-1.6.0-openjdk-demo-1:1.6.0.0-1.65.1.11.14.el6_4
java-1.6.0-openjdk-devel-1:1.6.0.0-1.42.1.11.14.el5_10
java-1.6.0-openjdk-devel-1:1.6.0.0-1.65.1.11.14.el6_4
java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.42.1.11.14.el5_10
java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.65.1.11.14.el6_4
java-1.6.0-openjdk-src-1:1.6.0.0-1.42.1.11.14.el5_10
java-1.6.0-openjdk-src-1:1.6.0.0-1.65.1.11.14.el6_4
java-1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5
java-1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10
java-1.6.0-sun-demo-1:1.6.0.75-1jpp.1.el6_5
java-1.6.0-sun-demo-1:1.6.0.75-1jpp.3.el5_10
java-1.6.0-sun-devel-1:1.6.0.75-1jpp.1.el6_5
java-1.6.0-sun-devel-1:1.6.0.75-1jpp.3.el5_10
java-1.6.0-sun-jdbc-1:1.6.0.75-1jpp.1.el6_5
java-1.6.0-sun-jdbc-1:1.6.0.75-1jpp.3.el5_10
java-1.6.0-sun-plugin-1:1.6.0.75-1jpp.1.el6_5
java-1.6.0-sun-plugin-1:1.6.0.75-1jpp.3.el5_10
java-1.6.0-sun-src-1:1.6.0.75-1jpp.1.el6_5
java-1.6.0-sun-src-1:1.6.0.75-1jpp.3.el5_10
xerces-j2-0:2.11.0-17.el7_0
xerces-j2-0:2.7.1-12.7.el6_5
xerces-j2-debuginfo-0:2.7.1-12.7.el6_5
xerces-j2-demo-0:2.11.0-17.el7_0
xerces-j2-demo-0:2.7.1-12.7.el6_5
xerces-j2-javadoc-0:2.11.0-17.el7_0
xerces-j2-javadoc-apis-0:2.7.1-12.7.el6_5
xerces-j2-javadoc-impl-0:2.7.1-12.7.el6_5
xerces-j2-javadoc-other-0:2.7.1-12.7.el6_5
xerces-j2-javadoc-xni-0:2.7.1-12.7.el6_5
xerces-j2-scripts-0:2.7.1-12.7.el6_5
apache-cxf-0:2.7.12-1.SP1_redhat_1.1.ep6.el6
apache-cxf-xjc-utils-0:2.6.2-3.redhat_1.1.ep6.el6
cxf-xjc-boolean-0:2.6.2-3.redhat_1.1.ep6.el6
cxf-xjc-dv-0:2.6.2-3.redhat_1.1.ep6.el6
cxf-xjc-ts-0:2.6.2-3.redhat_1.1.ep6.el6
hibernate4-core-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el6
hibernate4-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el6
hibernate4-entitymanager-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el6
hibernate4-envers-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el6
hibernate4-infinispan-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el6
ironjacamar-common-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-common-impl-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-common-spi-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-core-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-core-impl-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-deployers-common-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-jdbc-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-spec-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
ironjacamar-validator-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el6
javassist-eap6-0:3.18.1-5.GA_redhat_1.1.ep6.el6
jboss-as-appclient-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-cli-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-client-all-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-clustering-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-cmp-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-configadmin-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-connector-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-console-0:2.2.11-1.Final_redhat_1.1.ep6.el6
jboss-as-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-controller-client-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-core-security-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-deployment-repository-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-deployment-scanner-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-domain-http-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-domain-management-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-ee-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-ee-deployment-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-ejb3-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-embedded-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-host-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jacorb-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jaxr-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jaxrs-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jdr-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jmx-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jpa-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jsf-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-jsr77-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-logging-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-mail-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-management-client-content-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-messaging-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-modcluster-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-naming-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-network-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-osgi-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-osgi-configadmin-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-osgi-service-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-picketlink-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-platform-mbean-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-pojo-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-process-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-protocol-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-remoting-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-sar-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-security-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-server-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-system-jmx-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-threads-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-transactions-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-version-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-web-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-webservices-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-weld-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-as-xts-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jboss-hal-0:2.2.11-1.Final_redhat_1.1.ep6.el6
jboss-logmanager-0:1.5.2-2.Final_redhat_2.1.ep6.el6
jboss-metadata-0:7.1.2-1.Final_redhat_1.1.ep6.el6
jboss-metadata-appclient-0:7.1.2-1.Final_redhat_1.1.ep6.el6
jboss-metadata-common-0:7.1.2-1.Final_redhat_1.1.ep6.el6
jboss-metadata-ear-0:7.1.2-1.Final_redhat_1.1.ep6.el6
jboss-metadata-ejb-0:7.1.2-1.Final_redhat_1.1.ep6.el6
jboss-metadata-web-0:7.1.2-1.Final_redhat_1.1.ep6.el6
jboss-remoting3-jmx-0:1.1.3-1.Final_redhat_2.1.ep6.el6
jboss-xnio-base-0:3.0.11-1.GA_redhat_2.1.ep6.el6
jbossas-appclient-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossas-bundles-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossas-core-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossas-domain-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossas-javadocs-0:7.4.2-2.Final_redhat_2.1.ep6.el6
jbossas-modules-eap-0:7.4.2-2.Final_redhat_2.1.ep6.el6
jbossas-product-eap-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossas-standalone-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossas-welcome-content-eap-0:7.4.2-3.Final_redhat_2.1.ep6.el6
jbossws-common-0:2.3.1-1.Final_redhat_1.1.ep6.el6
jbossws-cxf-0:4.3.1-1.Final_redhat_1.1.ep6.el6
netty-0:3.6.10-1.Final_redhat_1.1.ep6.el6
picketlink-bindings-0:2.5.3-11.SP12_redhat_1.1.ep6.el6
picketlink-federation-0:2.5.3-12.SP12_redhat_1.1.ep6.el6
resteasy-0:2.3.8-10.SP3_redhat_2.1.ep6.el6
weld-core-0:1.1.25-1.Final_redhat_2.1.ep6.el6
wss4j-0:1.6.16-1.redhat_2.1.ep6.el6
xerces-j2-eap6-0:2.9.1-17.redhat_6.1.ep6.el6
xjc-utils-0:2.6.2-3.redhat_1.1.ep6.el6
xml-security-0:1.5.7-2.redhat_1.1.ep6.el6
apache-cxf-0:2.7.12-1.SP1_redhat_1.1.ep6.el5
apache-cxf-xjc-utils-0:2.6.2-3.redhat_1.1.ep6.el5
cxf-xjc-boolean-0:2.6.2-3.redhat_1.1.ep6.el5
cxf-xjc-dv-0:2.6.2-3.redhat_1.1.ep6.el5
cxf-xjc-ts-0:2.6.2-3.redhat_1.1.ep6.el5
hibernate4-core-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el5
hibernate4-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el5
hibernate4-entitymanager-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el5
hibernate4-envers-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el5
hibernate4-infinispan-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el5
ironjacamar-common-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-common-impl-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-common-spi-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-core-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-core-impl-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-deployers-common-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-jdbc-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-spec-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
ironjacamar-validator-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el5
javassist-eap6-0:3.18.1-5.GA_redhat_1.1.ep6.el5
jboss-as-appclient-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-cli-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-client-all-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-clustering-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-cmp-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-configadmin-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-connector-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-console-0:2.2.11-1.Final_redhat_1.1.ep6.el5
jboss-as-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-controller-client-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-core-security-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-deployment-repository-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-deployment-scanner-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-domain-http-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-domain-management-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-ee-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-ee-deployment-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-ejb3-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-embedded-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-host-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jacorb-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jaxr-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jaxrs-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jdr-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jmx-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jpa-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jsf-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-jsr77-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-logging-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-mail-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-management-client-content-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-messaging-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-modcluster-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-naming-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-network-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-osgi-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-osgi-configadmin-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-osgi-service-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-picketlink-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-platform-mbean-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-pojo-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-process-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-protocol-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-remoting-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-sar-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-security-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-server-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-system-jmx-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-threads-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-transactions-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-version-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-web-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-webservices-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-weld-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-as-xts-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jboss-hal-0:2.2.11-1.Final_redhat_1.1.ep6.el5
jboss-logmanager-0:1.5.2-2.Final_redhat_2.1.ep6.el5
jboss-metadata-0:7.1.2-1.Final_redhat_1.1.ep6.el5
jboss-metadata-appclient-0:7.1.2-1.Final_redhat_1.1.ep6.el5
jboss-metadata-common-0:7.1.2-1.Final_redhat_1.1.ep6.el5
jboss-metadata-ear-0:7.1.2-1.Final_redhat_1.1.ep6.el5
jboss-metadata-ejb-0:7.1.2-1.Final_redhat_1.1.ep6.el5
jboss-metadata-web-0:7.1.2-1.Final_redhat_1.1.ep6.el5
jboss-remoting3-jmx-0:1.1.3-1.Final_redhat_2.1.ep6.el5
jboss-xnio-base-0:3.0.11-1.GA_redhat_2.1.ep6.el5
jbossas-appclient-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossas-bundles-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossas-core-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossas-domain-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossas-javadocs-0:7.4.2-2.Final_redhat_2.1.ep6.el5
jbossas-modules-eap-0:7.4.2-2.Final_redhat_2.1.ep6.el5
jbossas-product-eap-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossas-standalone-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossas-welcome-content-eap-0:7.4.2-3.Final_redhat_2.1.ep6.el5
jbossws-common-0:2.3.1-1.Final_redhat_1.1.ep6.el5
jbossws-cxf-0:4.3.1-1.Final_redhat_1.1.ep6.el5
netty-0:3.6.10-1.Final_redhat_1.1.ep6.el5
picketlink-bindings-0:2.5.3-11.SP12_redhat_1.1.ep6.el5
picketlink-federation-0:2.5.3-12.SP12_redhat_1.1.ep6.el5
resteasy-0:2.3.8-10.SP3_redhat_2.1.ep6.el5
weld-core-0:1.1.25-1.Final_redhat_2.1.ep6.el5
wss4j-0:1.6.16-1.redhat_2.1.ep6.el5
xerces-j2-eap6-0:2.9.1-17.redhat_6.1.ep6.el5
xjc-utils-0:2.6.2-3.redhat_1.1.ep6.el5
xml-security-0:1.5.7-2.redhat_1.1.ep6.el5
apache-cxf-0:2.7.12-1.SP1_redhat_1.1.ep6.el7
apache-cxf-xjc-utils-0:2.6.2-3.redhat_1.1.ep6.el7
cxf-xjc-boolean-0:2.6.2-3.redhat_1.1.ep6.el7
cxf-xjc-dv-0:2.6.2-3.redhat_1.1.ep6.el7
cxf-xjc-ts-0:2.6.2-3.redhat_1.1.ep6.el7
hibernate4-core-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el7
hibernate4-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el7
hibernate4-entitymanager-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el7
hibernate4-envers-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el7
hibernate4-infinispan-eap6-0:4.2.14-9.SP4_redhat_1.1.ep6.el7
ironjacamar-common-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-common-impl-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-common-spi-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-core-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-core-impl-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-deployers-common-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-jdbc-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-spec-api-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
ironjacamar-validator-eap6-0:1.0.28-1.Final_redhat_1.1.ep6.el7
javassist-eap6-0:3.18.1-5.GA_redhat_1.1.ep6.el7
jboss-as-appclient-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-cli-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-client-all-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-clustering-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-cmp-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-configadmin-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-connector-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-console-0:2.2.11-1.Final_redhat_1.1.ep6.el7
jboss-as-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-controller-client-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-core-security-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-deployment-repository-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-deployment-scanner-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-domain-http-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-domain-management-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-ee-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-ee-deployment-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-ejb3-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-embedded-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-host-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jacorb-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jaxr-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jaxrs-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jdr-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jmx-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jpa-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jsf-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-jsr77-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-logging-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-mail-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-management-client-content-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-messaging-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-modcluster-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-naming-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-network-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-osgi-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-osgi-configadmin-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-osgi-service-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-picketlink-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-platform-mbean-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-pojo-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-process-controller-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-protocol-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-remoting-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-sar-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-security-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-server-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-system-jmx-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-threads-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-transactions-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-version-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-web-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-webservices-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-weld-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-as-xts-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jboss-hal-0:2.2.11-1.Final_redhat_1.1.ep6.el7
jboss-logmanager-0:1.5.2-2.Final_redhat_2.1.ep6.el7
jboss-metadata-0:7.1.2-1.Final_redhat_1.1.ep6.el7
jboss-metadata-appclient-0:7.1.2-1.Final_redhat_1.1.ep6.el7
jboss-metadata-common-0:7.1.2-1.Final_redhat_1.1.ep6.el7
jboss-metadata-ear-0:7.1.2-1.Final_redhat_1.1.ep6.el7
jboss-metadata-ejb-0:7.1.2-1.Final_redhat_1.1.ep6.el7
jboss-metadata-web-0:7.1.2-1.Final_redhat_1.1.ep6.el7
jboss-remoting3-jmx-0:1.1.3-1.Final_redhat_2.1.ep6.el7
jboss-xnio-base-0:3.0.11-1.GA_redhat_2.1.ep6.el7
jbossas-appclient-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossas-bundles-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossas-core-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossas-domain-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossas-javadocs-0:7.4.2-2.Final_redhat_2.1.ep6.el7
jbossas-modules-eap-0:7.4.2-2.Final_redhat_2.1.ep6.el7
jbossas-product-eap-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossas-standalone-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossas-welcome-content-eap-0:7.4.2-3.Final_redhat_2.1.ep6.el7
jbossws-common-0:2.3.1-1.Final_redhat_1.1.ep6.el7
jbossws-cxf-0:4.3.1-1.Final_redhat_1.1.ep6.el7
netty-0:3.6.10-1.Final_redhat_1.1.ep6.el7
picketlink-bindings-0:2.5.3-11.SP12_redhat_1.1.ep6.el7
picketlink-federation-0:2.5.3-12.SP12_redhat_1.1.ep6.el7
resteasy-0:2.3.8-10.SP3_redhat_2.1.ep6.el7
weld-core-0:1.1.25-1.Final_redhat_2.1.ep6.el7
wss4j-0:1.6.16-1.redhat_2.1.ep6.el7
xerces-j2-eap6-0:2.9.1-17.redhat_6.1.ep6.el7
xjc-utils-0:2.6.2-3.redhat_1.1.ep6.el7
xml-security-0:1.5.7-2.redhat_1.1.ep6.el7

Vulnerabilities > CVE-2013-4002 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2013-4002"}]}

Summary

Vulnerable Configurations

Nessus

Redhat

References

Vulnerabilities > CVE-2013-4002