Vulnerabilities > CVE-2014-6492

047910
CVSS 7.6 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
oracle
mozilla
nessus

Summary

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Vulnerable Configurations

Part Description Count
Application
Oracle
5
Application
Mozilla
1

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201502-12.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201502-12 (Oracle JRE/JDK: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Oracle’s Java SE Development Kit and Runtime Environment. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker may be able to execute arbitrary code, disclose, update, insert, or delete certain data. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id81370
    published2015-02-16
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81370
    titleGLSA-201502-12 : Oracle JRE/JDK: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201502-12.
    #
    # The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81370);
      script_version("1.4");
      script_cvs_date("Date: 2019/08/12 17:35:38");
    
      script_cve_id("CVE-2014-0429", "CVE-2014-0432", "CVE-2014-0446", "CVE-2014-0448", "CVE-2014-0449", "CVE-2014-0451", "CVE-2014-0452", "CVE-2014-0453", "CVE-2014-0454", "CVE-2014-0455", "CVE-2014-0456", "CVE-2014-0457", "CVE-2014-0458", "CVE-2014-0459", "CVE-2014-0460", "CVE-2014-0461", "CVE-2014-0463", "CVE-2014-0464", "CVE-2014-2397", "CVE-2014-2398", "CVE-2014-2401", "CVE-2014-2402", "CVE-2014-2403", "CVE-2014-2409", "CVE-2014-2410", "CVE-2014-2412", "CVE-2014-2413", "CVE-2014-2414", "CVE-2014-2420", "CVE-2014-2421", "CVE-2014-2422", "CVE-2014-2423", "CVE-2014-2427", "CVE-2014-2428", "CVE-2014-2483", "CVE-2014-2490", "CVE-2014-4208", "CVE-2014-4209", "CVE-2014-4216", "CVE-2014-4218", "CVE-2014-4219", "CVE-2014-4220", "CVE-2014-4221", "CVE-2014-4223", "CVE-2014-4227", "CVE-2014-4244", "CVE-2014-4247", "CVE-2014-4252", "CVE-2014-4262", "CVE-2014-4263", "CVE-2014-4264", "CVE-2014-4265", "CVE-2014-4266", "CVE-2014-4268", "CVE-2014-4288", "CVE-2014-6456", "CVE-2014-6457", "CVE-2014-6458", "CVE-2014-6466", "CVE-2014-6468", "CVE-2014-6476", "CVE-2014-6485", "CVE-2014-6492", "CVE-2014-6493", "CVE-2014-6502", "CVE-2014-6503", "CVE-2014-6504", "CVE-2014-6506", "CVE-2014-6511", "CVE-2014-6512", "CVE-2014-6513", "CVE-2014-6515", "CVE-2014-6517", "CVE-2014-6519", "CVE-2014-6527", "CVE-2014-6531", "CVE-2014-6532", "CVE-2014-6558", "CVE-2014-6562");
      script_bugtraq_id(66856, 66866, 66870, 66873, 66877, 66879, 66881, 66883, 66886, 66887, 66891, 66893, 66894, 66897, 66898, 66899, 66902, 66903, 66904, 66905, 66907, 66908, 66909, 66910, 66911, 66912, 66913, 66914, 66915, 66916, 66917, 66918, 66919, 66920, 68562, 68571, 68576, 68580, 68583, 68590, 68596, 68599, 68603, 68608, 68612, 68615, 68620, 68624, 68626, 68632, 68636, 68639, 68642, 68645, 70456, 70460, 70468, 70470, 70484, 70488, 70507, 70518, 70519, 70522, 70523, 70531, 70533, 70538, 70544, 70548, 70552, 70556, 70560, 70564, 70565, 70567, 70569, 70570, 70572);
      script_xref(name:"GLSA", value:"201502-12");
    
      script_name(english:"GLSA-201502-12 : Oracle JRE/JDK: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201502-12
    (Oracle JRE/JDK: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Oracle’s Java SE
          Development Kit and Runtime Environment. Please review the CVE
          identifiers referenced below for details.
      
    Impact :
    
        A context-dependent attacker may be able to execute arbitrary code,
          disclose, update, insert, or delete certain data.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201502-12"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Oracle JRE 1.7 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-java/oracle-jre-bin-1.7.0.71'
        All Oracle JDK 1.7 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-java/oracle-jdk-bin-1.7.0.71'
        All users of the precompiled 32-bit Oracle JRE should upgrade to the
          latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=app-emulation/emul-linux-x86-java-1.7.0.71'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:emul-linux-x86-java");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:oracle-jdk-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:oracle-jre-bin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/04/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/02/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-java/oracle-jre-bin", unaffected:make_list("ge 1.7.0.71"), vulnerable:make_list("lt 1.7.0.71"))) flag++;
    if (qpkg_check(package:"dev-java/oracle-jdk-bin", unaffected:make_list("ge 1.7.0.71"), vulnerable:make_list("lt 1.7.0.71"))) flag++;
    if (qpkg_check(package:"app-emulation/emul-linux-x86-java", unaffected:make_list("ge 1.7.0.71"), vulnerable:make_list("lt 1.7.0.71"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Oracle JRE/JDK");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1880.NASL
    descriptionUpdated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 and 7 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-3065, CVE-2014-3566, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. Note: With this update, the IBM SDK now disables the SSL 3.0 protocol to address the CVE-2014-3566 issue (also known as POODLE). Refer to the IBM article linked to in the References section for additional details about this change and instructions on how to re-enable SSL 3.0 support if needed. All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR2 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id79377
    published2014-11-21
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79377
    titleRHEL 6 / 7 : java-1.7.1-ibm (RHSA-2014:1880) (POODLE)
  • NASL familyWindows
    NASL idORACLE_JAVA_CPU_OCT_2014.NASL
    descriptionThe version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 25, 7 Update 71, 6 Update 85, or 5 Update 75. It is, therefore, affected by security issues in the following components : - 2D - AWT - Deployment - Hotspot - JAXP - JSSE - JavaFX - Libraries - Security
    last seen2020-06-01
    modified2020-06-02
    plugin id78481
    published2014-10-15
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/78481
    titleOracle Java SE Multiple Vulnerabilities (October 2014 CPU)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-0264.NASL
    descriptionUpdated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Satellite 5.6. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Satellite 5.6. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. Several flaws were fixed in the IBM Java 2 Runtime Environment. (CVE-2014-3065, CVE-2014-3068, CVE-2014-3566, CVE-2014-4209, CVE-2014-4218, CVE-2014-4219, CVE-2014-4227, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4265, CVE-2014-4288, CVE-2014-6457, CVE-2014-6458, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412) The CVE-2014-4262 and CVE-2014-6512 issues were discovered by Florian Weimer of Red Hat Product Security. Users of Red Hat Satellite 5.6 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR16-FP3 release. For this update to take effect, Red Hat Satellite must be restarted (
    last seen2020-06-01
    modified2020-06-02
    plugin id81505
    published2015-02-25
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81505
    titleRHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:0264) (POODLE)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_JAVA-1_6_0-IBM-141119.NASL
    descriptionjava-1_6_0-ibm has been updated to version 1.6.0_sr16.2 to fix 18 security issues. These security issues has been fixed : - Unspecified vulnerability in Oracle Java SE 6u81. (CVE-2014-3065) - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the
    last seen2020-06-05
    modified2014-12-01
    plugin id79634
    published2014-12-01
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/79634
    titleSuSE 11.3 Security Update : IBM Java (SAT Patch Number 9992)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_JAVA-1_7_0-IBM-141121.NASL
    descriptionjava-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues. These security issues have been fixed : - Unspecified vulnerability. (CVE-2014-3065) - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the
    last seen2020-06-05
    modified2014-12-01
    plugin id79635
    published2014-12-01
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/79635
    titleSuSE 11.3 Security Update : IBM Java (SAT Patch Number 9999)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2014-1541-1.NASL
    descriptionjava-1_6_0-ibm was updated to version 1.6.0_sr16.2 to fix 18 security issues. These security issues were fixed : - Unspecified vulnerability in Oracle Java SE 6u81 (CVE-2014-3065). - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the
    last seen2020-06-05
    modified2019-01-02
    plugin id119959
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119959
    titleSUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2014:1541-1) (POODLE)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1877.NASL
    descriptionUpdated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-3065, CVE-2014-3566, CVE-2014-4288, CVE-2014-6457, CVE-2014-6458, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. Note: With this update, the IBM SDK now disables the SSL 3.0 protocol to address the CVE-2014-3566 issue (also known as POODLE). Refer to the IBM article linked to in the References section for additional details about this change and instructions on how to re-enable SSL 3.0 support if needed. All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16-FP2 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id79352
    published2014-11-20
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79352
    titleRHEL 5 / 6 : java-1.6.0-ibm (RHSA-2014:1877) (POODLE)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1876.NASL
    descriptionUpdated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-3065, CVE-2014-3566, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. Note: With this update, the IBM SDK now disables the SSL 3.0 protocol to address the CVE-2014-3566 issue (also known as POODLE). Refer to the IBM article linked to in the References section for additional details about this change and instructions on how to re-enable SSL 3.0 support if needed. All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR8 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id79351
    published2014-11-20
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79351
    titleRHEL 5 : java-1.7.0-ibm (RHSA-2014:1876) (POODLE)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1658.NASL
    descriptionUpdated java-1.6.0-sun packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2014-4288, CVE-2014-6457, CVE-2014-6458, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6504, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6517, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 85 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id79057
    published2014-11-08
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79057
    titleRHEL 5 / 6 / 7 : java-1.6.0-sun (RHSA-2014:1658)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_JAVA-1_7_0-OPENJDK-141024.NASL
    descriptionOracle Critical Patch Update Advisory - October 2014 Description : A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Find more information here: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.h tml
    last seen2020-06-05
    modified2014-11-12
    plugin id79208
    published2014-11-12
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/79208
    titleSuSE 11.3 Security Update : Java OpenJDK (SAT Patch Number 9906)
  • NASL familyAIX Local Security Checks
    NASL idAIX_JAVA_OCT2014_ADVISORY.NASL
    descriptionThe version of Java SDK installed on the remote host is affected by the following vulnerabilities : - A privilege escalation vulnerability in the IBM Java SDK allows a local attacker to inject arbitrary code into the shared classes cache due to a flaw in the default configuration for the shared classes feature. Other users are able to execute the injected code, which can allow the attacker to gain elevated privileges. (CVE-2014-3065) - Oracle Java contains the flaw related to SSLv3 CBC-mode ciphers known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A man-in-the-middle attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566) - Vulnerabilities in Oracle Java allow remote code execution via flaws in the Deployment subcomponent. (CVE-2014-4288, CVE-2014-6492, CVE-2014-6493, CVE-2014-6503, CVE-2014-6532) - A session hijacking vulnerability exists in Oracle Java due to a flaw related to handling of server certificate changes during SSL/TLS renegotiation. This allows an attacker to intercept communication between a client and server to hijack a mutually authenticated session. (CVE-2014-6457) - Privilege escalation vulnerabilities exist in Oracle Java within the the Deployment subcomponent. (CVE-2014-6458, CVE-2014-6466) - Data integrity vulnerabilities exist in Oracle Java within the the Deployment subcomponent. (CVE-2014-6476, CVE-2014-6515, CVE-2014-6527) - A privilege escalation vulnerability exists in Oracle Java in the resource bundle handling code of the
    last seen2020-06-01
    modified2020-06-02
    plugin id79626
    published2014-11-28
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/79626
    titleAIX Java Advisory : java_oct2014_advisory.asc (POODLE)
  • NASL familyMisc.
    NASL idORACLE_JAVA_CPU_OCT_2014_UNIX.NASL
    descriptionThe version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 25, 7 Update 71, 6 Update 85, or 5 Update 75. It is, therefore, affected by security issues in the following components : - 2D - AWT - Deployment - Hotspot - JAXP - JSSE - JavaFX - Libraries - Security
    last seen2020-06-01
    modified2020-06-02
    plugin id78482
    published2014-10-15
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/78482
    titleOracle Java SE Multiple Vulnerabilities (October 2014 CPU) (Unix)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1657.NASL
    descriptionUpdated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6504, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6517, CVE-2014-6519, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 72 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id79056
    published2014-11-08
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79056
    titleRHEL 5 / 6 / 7 : java-1.7.0-oracle (RHSA-2014:1657)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1882.NASL
    descriptionUpdated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. [Updated 2 December 2014] This advisory has been updated to include updated java-1.7.0-ibm-jdbc and java-1.7.0-ibm-plugin packages, which were previously missing from this erratum. No changes were made to the other packages in this erratum. IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-3065, CVE-2014-3566, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. Note: With this update, the IBM SDK now disables the SSL 3.0 protocol to address the CVE-2014-3566 issue (also known as POODLE). Refer to the IBM article linked to in the References section for additional details about this change and instructions on how to re-enable SSL 3.0 support if needed. Note: This is the last update for the java-1.7.0-ibm packages distributed via the Red Hat Enterprise Linux 6 Supplementary channels. The RHEA-2014:1619 advisory, released as a part of Red Hat Enterprise Linux 6.6, introduced the new java-1.7.1-ibm packages. These packages contain IBM Java SE version 7 Release 1, which adds multiple enhancements over the IBM Java SE version 7 in the java-1.7.0-ibm packages. All java-1.7.0-ibm users must migrate to java-1.7.1-ibm packages to continue receiving updates for the IBM Java SE version 7 via the Red Hat Enterprise Linux 6 Supplementary channel. All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR8 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id79379
    published2014-11-21
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79379
    titleRHEL 6 : java-1.7.0-ibm (RHSA-2014:1882) (POODLE)

Redhat

advisories
  • rhsa
    idRHSA-2014:1657
  • rhsa
    idRHSA-2014:1658
  • rhsa
    idRHSA-2014:1876
  • rhsa
    idRHSA-2014:1877
  • rhsa
    idRHSA-2014:1880
  • rhsa
    idRHSA-2014:1882
  • rhsa
    idRHSA-2015:0264
rpms
  • java-1.7.0-oracle-1:1.7.0.72-1jpp.2.el6
  • java-1.7.0-oracle-1:1.7.0.72-1jpp.2.el7
  • java-1.7.0-oracle-1:1.7.0.72-1jpp.4.el5_11
  • java-1.7.0-oracle-devel-1:1.7.0.72-1jpp.2.el6
  • java-1.7.0-oracle-devel-1:1.7.0.72-1jpp.2.el7
  • java-1.7.0-oracle-devel-1:1.7.0.72-1jpp.4.el5_11
  • java-1.7.0-oracle-javafx-1:1.7.0.72-1jpp.2.el6
  • java-1.7.0-oracle-javafx-1:1.7.0.72-1jpp.2.el7
  • java-1.7.0-oracle-javafx-1:1.7.0.72-1jpp.4.el5_11
  • java-1.7.0-oracle-jdbc-1:1.7.0.72-1jpp.2.el6
  • java-1.7.0-oracle-jdbc-1:1.7.0.72-1jpp.2.el7
  • java-1.7.0-oracle-jdbc-1:1.7.0.72-1jpp.4.el5_11
  • java-1.7.0-oracle-plugin-1:1.7.0.72-1jpp.2.el6
  • java-1.7.0-oracle-plugin-1:1.7.0.72-1jpp.2.el7
  • java-1.7.0-oracle-plugin-1:1.7.0.72-1jpp.4.el5_11
  • java-1.7.0-oracle-src-1:1.7.0.72-1jpp.2.el6
  • java-1.7.0-oracle-src-1:1.7.0.72-1jpp.2.el7
  • java-1.7.0-oracle-src-1:1.7.0.72-1jpp.4.el5_11
  • java-1.6.0-sun-1:1.6.0.85-1jpp.2.el6
  • java-1.6.0-sun-1:1.6.0.85-1jpp.2.el7
  • java-1.6.0-sun-1:1.6.0.85-1jpp.3.el5_11
  • java-1.6.0-sun-demo-1:1.6.0.85-1jpp.2.el6
  • java-1.6.0-sun-demo-1:1.6.0.85-1jpp.2.el7
  • java-1.6.0-sun-demo-1:1.6.0.85-1jpp.3.el5_11
  • java-1.6.0-sun-devel-1:1.6.0.85-1jpp.2.el6
  • java-1.6.0-sun-devel-1:1.6.0.85-1jpp.2.el7
  • java-1.6.0-sun-devel-1:1.6.0.85-1jpp.3.el5_11
  • java-1.6.0-sun-jdbc-1:1.6.0.85-1jpp.2.el6
  • java-1.6.0-sun-jdbc-1:1.6.0.85-1jpp.2.el7
  • java-1.6.0-sun-jdbc-1:1.6.0.85-1jpp.3.el5_11
  • java-1.6.0-sun-plugin-1:1.6.0.85-1jpp.2.el6
  • java-1.6.0-sun-plugin-1:1.6.0.85-1jpp.2.el7
  • java-1.6.0-sun-plugin-1:1.6.0.85-1jpp.3.el5_11
  • java-1.6.0-sun-src-1:1.6.0.85-1jpp.2.el6
  • java-1.6.0-sun-src-1:1.6.0.85-1jpp.2.el7
  • java-1.6.0-sun-src-1:1.6.0.85-1jpp.3.el5_11
  • java-1.7.0-ibm-1:1.7.0.8.0-1jpp.1.el5
  • java-1.7.0-ibm-demo-1:1.7.0.8.0-1jpp.1.el5
  • java-1.7.0-ibm-devel-1:1.7.0.8.0-1jpp.1.el5
  • java-1.7.0-ibm-jdbc-1:1.7.0.8.0-1jpp.1.el5
  • java-1.7.0-ibm-plugin-1:1.7.0.8.0-1jpp.1.el5
  • java-1.7.0-ibm-src-1:1.7.0.8.0-1jpp.1.el5
  • java-1.6.0-ibm-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-demo-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-demo-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.6.0-ibm-devel-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-devel-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.6.0-ibm-plugin-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-plugin-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.6.0-ibm-src-1:1.6.0.16.2-1jpp.1.el5
  • java-1.6.0-ibm-src-1:1.6.0.16.2-1jpp.1.el6_6
  • java-1.7.1-ibm-1:1.7.1.2.0-1jpp.3.el6_6
  • java-1.7.1-ibm-1:1.7.1.2.0-1jpp.3.el7_0
  • java-1.7.1-ibm-demo-1:1.7.1.2.0-1jpp.3.el6_6
  • java-1.7.1-ibm-demo-1:1.7.1.2.0-1jpp.3.el7_0
  • java-1.7.1-ibm-devel-1:1.7.1.2.0-1jpp.3.el6_6
  • java-1.7.1-ibm-devel-1:1.7.1.2.0-1jpp.3.el7_0
  • java-1.7.1-ibm-jdbc-1:1.7.1.2.0-1jpp.3.el6_6
  • java-1.7.1-ibm-jdbc-1:1.7.1.2.0-1jpp.3.el7_0
  • java-1.7.1-ibm-plugin-1:1.7.1.2.0-1jpp.3.el6_6
  • java-1.7.1-ibm-plugin-1:1.7.1.2.0-1jpp.3.el7_0
  • java-1.7.1-ibm-src-1:1.7.1.2.0-1jpp.3.el6_6
  • java-1.7.1-ibm-src-1:1.7.1.2.0-1jpp.3.el7_0
  • java-1.7.0-ibm-1:1.7.0.8.0-1jpp.1.el6_6
  • java-1.7.0-ibm-demo-1:1.7.0.8.0-1jpp.1.el6_6
  • java-1.7.0-ibm-devel-1:1.7.0.8.0-1jpp.1.el6_6
  • java-1.7.0-ibm-jdbc-1:1.7.0.8.0-1jpp.1.el6_6
  • java-1.7.0-ibm-plugin-1:1.7.0.8.0-1jpp.1.el6_6
  • java-1.7.0-ibm-src-1:1.7.0.8.0-1jpp.1.el6_6
  • java-1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el5
  • java-1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el6
  • java-1.6.0-ibm-devel-1:1.6.0.16.3-1jpp.1.el5
  • java-1.6.0-ibm-devel-1:1.6.0.16.3-1jpp.1.el6