Executive Summary

Summary
Titlejava-1.5.0-ibm security update
Informations
NameRHSA-2010:0807First vendor Publication2010-10-27
VendorRedHatLast vendor Modification2010-10-27
Severity (Vendor) CriticalRevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, ppc, s390x, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux AS version 4 Extras - i386, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64

3. Description:

The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit.

This update fixes several vulnerabilities in the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. Detailed vulnerability descriptions are linked from the IBM "Security alerts" page, listed in the References section. (CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3556, CVE-2010-3559, CVE-2010-3562, CVE-2010-3565, CVE-2010-3566, CVE-2010-3568, CVE-2010-3569, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574)

The RHSA-2010:0130 update mitigated a man-in-the-middle attack in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation by disabling renegotiation. This update implements the TLS Renegotiation Indication Extension as defined in RFC 5746, allowing secure renegotiation between updated clients and servers. (CVE-2009-3555)

All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.5.0 SR12-FP2 Java release. All running instances of IBM Java must be restarted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

533125 - CVE-2009-3555 TLS: MITM attacks via session renegotiation 582466 - CVE-2010-1321 krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) 639876 - CVE-2010-3568 OpenJDK Deserialization Race condition (6559775) 639897 - CVE-2010-3562 OpenJDK IndexColorModel double-free (6925710) 639909 - CVE-2010-3548 OpenJDK DNS server IP address information leak (6957564) 639920 - CVE-2010-3565 OpenJDK JPEG writeImage remote code execution (6963023) 639922 - CVE-2010-3566 OpenJDK ICC Profile remote code execution (6963489) 639925 - CVE-2010-3569 OpenJDK Serialization inconsistencies (6966692) 642180 - CVE-2010-3549 OpenJDK HttpURLConnection request splitting (6952017) 642187 - CVE-2010-3551 OpenJDK local network address disclosure (6952603) 642202 - CVE-2010-3541 CVE-2010-3573 OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004) 642215 - CVE-2010-3574 OpenJDK HttpURLConnection incomplete TRACE permission check (6981426) 642559 - CVE-2010-3550 JDK unspecified vulnerability in Java Web Start component 642576 - CVE-2010-3556 JDK unspecified vulnerability in 2D component 642606 - CVE-2010-3559 JDK unspecified vulnerability in Sound component 642611 - CVE-2010-3572 JDK unspecified vulnerability in Sound component

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2010-0807.html

CWE : Common Weakness Enumeration

%idName
100 %CWE-310Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20492
 
Oval ID: oval:org.mitre.oval:def:20492
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3562
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12450
 
Oval ID: oval:org.mitre.oval:def:12450
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3562
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12328
 
Oval ID: oval:org.mitre.oval:def:12328
Title: DEPRECATED: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3562
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11893
 
Oval ID: oval:org.mitre.oval:def:11893
Title: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3562
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20272
 
Oval ID: oval:org.mitre.oval:def:20272
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3551
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12488
 
Oval ID: oval:org.mitre.oval:def:12488
Title: DEPRECATED: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3551
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12458
 
Oval ID: oval:org.mitre.oval:def:12458
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3551
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11330
 
Oval ID: oval:org.mitre.oval:def:11330
Title: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3551
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20205
 
Oval ID: oval:org.mitre.oval:def:20205
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3550
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12590
 
Oval ID: oval:org.mitre.oval:def:12590
Title: DEPRECATED: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 and earlier versions
Description: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3550
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12422
 
Oval ID: oval:org.mitre.oval:def:12422
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3550
Version: 13
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11619
 
Oval ID: oval:org.mitre.oval:def:11619
Title: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 and earlier versions
Description: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3550
Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20453
 
Oval ID: oval:org.mitre.oval:def:20453
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3566
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12225
 
Oval ID: oval:org.mitre.oval:def:12225
Title: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3566
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12040
 
Oval ID: oval:org.mitre.oval:def:12040
Title: DEPRECATED: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3566
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11560
 
Oval ID: oval:org.mitre.oval:def:11560
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3566
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20077
 
Oval ID: oval:org.mitre.oval:def:20077
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3565
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12571
 
Oval ID: oval:org.mitre.oval:def:12571
Title: DEPRECATED: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3565
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12294
 
Oval ID: oval:org.mitre.oval:def:12294
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3565
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12180
 
Oval ID: oval:org.mitre.oval:def:12180
Title: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3565
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21804
 
Oval ID: oval:org.mitre.oval:def:21804
Title: RHSA-2010:0786: java-1.4.2-ibm security update (Critical)
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: patch
Reference(s): RHSA-2010:0786-01
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3556
CVE-2010-3557
CVE-2010-3562
CVE-2010-3565
CVE-2010-3568
CVE-2010-3569
CVE-2010-3571
CVE-2010-3572
Version: 185
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20588
 
Oval ID: oval:org.mitre.oval:def:20588
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3572
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12544
 
Oval ID: oval:org.mitre.oval:def:12544
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3572
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12536
 
Oval ID: oval:org.mitre.oval:def:12536
Title: DEPRECATED: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3572
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12240
 
Oval ID: oval:org.mitre.oval:def:12240
Title: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3572
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23065
 
Oval ID: oval:org.mitre.oval:def:23065
Title: ELSA-2010:0786: java-1.4.2-ibm security update (Critical)
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: patch
Reference(s): ELSA-2010:0786-01
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3556
CVE-2010-3557
CVE-2010-3562
CVE-2010-3565
CVE-2010-3568
CVE-2010-3569
CVE-2010-3571
CVE-2010-3572
Version: 61
Platform(s): Oracle Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22361
 
Oval ID: oval:org.mitre.oval:def:22361
Title: RHSA-2010:0807: java-1.5.0-ibm security update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0807-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3556
CVE-2010-3559
CVE-2010-3562
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 224
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22342
 
Oval ID: oval:org.mitre.oval:def:22342
Title: RHSA-2010:0873: java-1.5.0-ibm security update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0873-02
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3556
CVE-2010-3559
CVE-2010-3562
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 211
Platform(s): Red Hat Enterprise Linux 6
Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22313
 
Oval ID: oval:org.mitre.oval:def:22313
Title: RHSA-2010:0987: java-1.6.0-ibm security and bug fix update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0987-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3553
CVE-2010-3555
CVE-2010-3556
CVE-2010-3557
CVE-2010-3558
CVE-2010-3560
CVE-2010-3562
CVE-2010-3563
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3571
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 302
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Product(s): java-1.6.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22285
 
Oval ID: oval:org.mitre.oval:def:22285
Title: RHSA-2010:0865: java-1.6.0-openjdk security and bug fix update (Important)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0865-02
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
Version: 224
Platform(s): Red Hat Enterprise Linux 6
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22284
 
Oval ID: oval:org.mitre.oval:def:22284
Title: RHSA-2010:0935: java-1.4.2-ibm security update (Moderate)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0935-01
CVE-2010-1321
CVE-2010-3574
Version: 29
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22124
 
Oval ID: oval:org.mitre.oval:def:22124
Title: RHSA-2010:0770: java-1.6.0-sun security update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0770-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3552
CVE-2010-3553
CVE-2010-3554
CVE-2010-3555
CVE-2010-3556
CVE-2010-3557
CVE-2010-3558
CVE-2010-3559
CVE-2010-3560
CVE-2010-3561
CVE-2010-3562
CVE-2010-3563
CVE-2010-3565
CVE-2010-3566
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3570
CVE-2010-3571
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 380
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.6.0-sun
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21716
 
Oval ID: oval:org.mitre.oval:def:21716
Title: RHSA-2010:0768: java-1.6.0-openjdk security and bug fix update (Important)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2010:0768-01
CESA-2010:0768
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
Version: 224
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21498
 
Oval ID: oval:org.mitre.oval:def:21498
Title: RHSA-2011:0152: java-1.4.2-ibm security update (Moderate)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): RHSA-2011:0152-01
CVE-2010-1321
CVE-2010-3574
Version: 29
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20306
 
Oval ID: oval:org.mitre.oval:def:20306
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3574
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13305
 
Oval ID: oval:org.mitre.oval:def:13305
Title: USN-1010-1 -- openjdk-6, openjdk-6b18 vulnerabilities
Description: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. USN-923-1 disabled SSL/TLS renegotiation by default; this update implements the TLS Renegotiation Indication Extension as defined in RFC 5746, and thus supports secure renegotiation between updated clients and servers. It was discovered that the HttpURLConnection class did not validate request headers set by java applets, which could allow an attacker to trigger actions otherwise not allowed to HTTP clients. It was discovered that JNDI could leak information that would allow an attacker to access information about otherwise-protected internal network names. It was discovered that HttpURLConnection improperly handled the "chunked" transfer encoding method, which could allow attackers to conduct HTTP response splitting attacks. It was discovered that the NetworkInterface class improperly checked the network "connect" permissions for local network addresses. This could allow an attacker to read local network addresses. It was discovered that UIDefault.ProxyLazyValue had unsafe reflection usage, allowing an attacker to create objects. It was discovered that multiple flaws in the CORBA reflection implementation could allow an attacker to execute arbitrary code by misusing permissions granted to certain system objects. It was discovered that unspecified flaws in the Swing library could allow untrusted applications to modify the behavior and state of certain JDK classes. It was discovered that the privileged accept method of the ServerSocket class in the CORBA implementation allowed it to receive connections from any host, instead of just the host of the current connection. An attacker could use this flaw to bypass restrictions defined by network permissions. It was discovered that there exists a double free in java�s indexColorModel that could allow an attacker to cause an applet or application to crash, or possibly execute arbitrary code with the privilege of the user running the java applet or application. It was discovered that the Kerberos implementation improperly checked AP-REQ requests, which could allow an attacker to cause a denial of service against the receiving JVM. It was discovered that improper checks of unspecified image metadata in JPEGImageWriter.writeImage of the imageio API could allow an attacker to execute arbitrary code with the privileges of the user running a java applet or application. It was discovered that an unspecified vulnerability in the ICC profile handling code could allow an attacker to execute arbitrary code with the privileges of the user running a java applet or application. It was discovered that a miscalculation in the OpenType font rendering implementation would allow out-of-bounds memory access. This could allow an attacker to execute arbitrary code with the privileges of the user running a java application. It was discovered that an unspecified race condition in the way objects were deserialized could allow an attacker to cause an applet or application to misuse the privileges of the user running the java applet or application. It was discovered that the defaultReadObject of the Serialization API could be tricked into setting a volatile field multiple times. This could allow an attacker to execute arbitrary code with the privileges of the user running a java applet or application. It was discovered that the HttpURLConnection class did not validate request headers set by java applets, which could allow an attacker to trigger actions otherwise not allowed to HTTP clients. It was discovered that the HttpURLConnection class improperly checked whether the calling code was granted the "allowHttpTrace" permission, allowing an attacker to create HTTP TRACE requests
Family: unix Class: patch
Reference(s): USN-1010-1
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3566
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.10
Ubuntu 9.10
Ubuntu 10.04
Product(s): openjdk-6
openjdk-6b18
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12462
 
Oval ID: oval:org.mitre.oval:def:12462
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3574
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12367
 
Oval ID: oval:org.mitre.oval:def:12367
Title: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3574
Version: 11
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): Java Development Kit
Java Runtime Environment
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12229
 
Oval ID: oval:org.mitre.oval:def:12229
Title: DEPRECATED: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3574
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23606
 
Oval ID: oval:org.mitre.oval:def:23606
Title: ELSA-2010:0873: java-1.5.0-ibm security update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0873-02
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3556
CVE-2010-3559
CVE-2010-3562
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 69
Platform(s): Oracle Linux 6
Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23563
 
Oval ID: oval:org.mitre.oval:def:23563
Title: ELSA-2010:0865: java-1.6.0-openjdk security and bug fix update (Important)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0865-02
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
Version: 73
Platform(s): Oracle Linux 6
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23453
 
Oval ID: oval:org.mitre.oval:def:23453
Title: ELSA-2010:0987: java-1.6.0-ibm security and bug fix update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0987-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3553
CVE-2010-3555
CVE-2010-3556
CVE-2010-3557
CVE-2010-3558
CVE-2010-3560
CVE-2010-3562
CVE-2010-3563
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3571
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 97
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): java-1.6.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23245
 
Oval ID: oval:org.mitre.oval:def:23245
Title: ELSA-2010:0935: java-1.4.2-ibm security update (Moderate)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0935-01
CVE-2010-1321
CVE-2010-3574
Version: 13
Platform(s): Oracle Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23199
 
Oval ID: oval:org.mitre.oval:def:23199
Title: DEPRECATED: ELSA-2010:0987: java-1.6.0-ibm security and bug fix update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0987-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3553
CVE-2010-3555
CVE-2010-3556
CVE-2010-3557
CVE-2010-3558
CVE-2010-3560
CVE-2010-3562
CVE-2010-3563
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3571
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 98
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): java-1.6.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22962
 
Oval ID: oval:org.mitre.oval:def:22962
Title: ELSA-2010:0768: java-1.6.0-openjdk security and bug fix update (Important)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0768-01
CVE-2009-3555
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
Version: 73
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22954
 
Oval ID: oval:org.mitre.oval:def:22954
Title: ELSA-2010:0770: java-1.6.0-sun security update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0770-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3552
CVE-2010-3553
CVE-2010-3554
CVE-2010-3555
CVE-2010-3556
CVE-2010-3557
CVE-2010-3558
CVE-2010-3559
CVE-2010-3560
CVE-2010-3561
CVE-2010-3562
CVE-2010-3563
CVE-2010-3565
CVE-2010-3566
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3570
CVE-2010-3571
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 121
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-sun
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22873
 
Oval ID: oval:org.mitre.oval:def:22873
Title: ELSA-2010:0807: java-1.5.0-ibm security update (Critical)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2010:0807-01
CVE-2009-3555
CVE-2010-1321
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3550
CVE-2010-3551
CVE-2010-3556
CVE-2010-3559
CVE-2010-3562
CVE-2010-3565
CVE-2010-3566
CVE-2010-3568
CVE-2010-3569
CVE-2010-3572
CVE-2010-3573
CVE-2010-3574
Version: 73
Platform(s): Oracle Linux 5
Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22816
 
Oval ID: oval:org.mitre.oval:def:22816
Title: ELSA-2011:0152: java-1.4.2-ibm security update (Moderate)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
Family: unix Class: patch
Reference(s): ELSA-2011:0152-01
CVE-2010-1321
CVE-2010-3574
Version: 13
Platform(s): Oracle Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19571
 
Oval ID: oval:org.mitre.oval:def:19571
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3541
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:14354
 
Oval ID: oval:org.mitre.oval:def:14354
Title: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3541
Version: 9
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): Java Runtime Environment
Java Development Kit
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12491
 
Oval ID: oval:org.mitre.oval:def:12491
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3541
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8535
 
Oval ID: oval:org.mitre.oval:def:8535
Title: HP-UX Running OpenSSL, Remote Unauthorized Data Injection, Denial of Service (DoS)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 11
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8366
 
Oval ID: oval:org.mitre.oval:def:8366
Title: HP-UX Running Apache, Remote Unauthorized Data Injection, Denial of Service (DoS)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 11
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8201
 
Oval ID: oval:org.mitre.oval:def:8201
Title: DSA-1934 apache2 -- multiple issues
Description: A design flaw has been found in the TLS and SSL protocol that allows an attacker to inject arbitrary content at the beginning of a TLS/SSL connection. The attack is related to the way how TLS and SSL handle session renegotiations. CVE-2009-3555 has been assigned to this vulnerability. As a partial mitigation against this attack, this apache2 update disables client-initiated renegotiations. This should fix the vulnerability for the majority of Apache configurations in use. NOTE: This is not a complete fix for the problem. The attack is still possible in configurations where the server initiates the renegotiation. This is the case for the following configurations (the information in the changelog of the updated packages is slightly inaccurate): As a workaround, you may rearrange your configuration in a way that SSLVerifyClient and SSLCipherSuite are only used on the server or virtual host level. A complete fix for the problem will require a protocol change. Further information will be included in a separate announcement about this issue. In addition, this update fixes the following issues in Apache's mod_proxy_ftp: Insufficient input validation in the mod_proxy_ftp module allowed remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. Insufficient input validation in the mod_proxy_ftp module allowed remote authenticated attackers to bypass intended access restrictions and send arbitrary FTP commands to an FTP server. The oldstable distribution (etch), these problems have been fixed in version 2.2.3-4+etch11.
Family: unix Class: patch
Reference(s): DSA-1934
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7973
 
Oval ID: oval:org.mitre.oval:def:7973
Title: Security Vulnerability in the Transport Layer Security (TLS) and Secure Sockets Layer 3.0 (SSLv3) Protocols Involving Handshake Renegotiation Affects Applications Utilizing Network Security Services (NSS)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 1
Platform(s): Sun Solaris 8
Sun Solaris 9
Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7478
 
Oval ID: oval:org.mitre.oval:def:7478
Title: VMware ESX, Service Console update for OpenSSL, GnuTLS, NSS and NSPR.
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7315
 
Oval ID: oval:org.mitre.oval:def:7315
Title: TLS/SSL Renegotiation Vulnerability
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: windows Class: vulnerability
Reference(s): CVE-2009-3555
Version: 23
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21877
 
Oval ID: oval:org.mitre.oval:def:21877
Title: RHSA-2010:0164: openssl097a security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0164-01
CESA-2010:0164
CVE-2009-3555
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): openssl097a
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21828
 
Oval ID: oval:org.mitre.oval:def:21828
Title: RHSA-2010:0166: gnutls security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0166-01
CESA-2010:0166
CVE-2009-2409
CVE-2009-3555
Version: 29
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21587
 
Oval ID: oval:org.mitre.oval:def:21587
Title: RHSA-2010:0165: nss security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0165-01
CESA-2010:0165
CVE-2009-3555
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): nspr
nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21255
 
Oval ID: oval:org.mitre.oval:def:21255
Title: RHSA-2010:0155: java-1.4.2-ibm security and bug fix update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0155-01
CVE-2009-3555
Version: 4
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20357
 
Oval ID: oval:org.mitre.oval:def:20357
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 4
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13623
 
Oval ID: oval:org.mitre.oval:def:13623
Title: DSA-1934-1 apache2 -- multiple issues
Description: A design flaw has been found in the TLS and SSL protocol that allows an attacker to inject arbitrary content at the beginning of a TLS/SSL connection. The attack is related to the way how TLS and SSL handle session renegotiations. CVE-2009-3555 has been assigned to this vulnerability. As a partial mitigation against this attack, this apache2 update disables client-initiated renegotiations. This should fix the vulnerability for the majority of Apache configurations in use. NOTE: This is not a complete fix for the problem. The attack is still possible in configurations where the server initiates the renegotiation. This is the case for the following configurations: - - The "SSLVerifyClient" directive is used in a Directory or Location context. - - The "SSLCipherSuite" directive is used in a Directory or Location context. As a workaround, you may rearrange your configuration in a way that SSLVerifyClient and SSLCipherSuite are only used on the server or virtual host level. A complete fix for the problem will require a protocol change. Further information will be included in a separate announcement about this issue. In addition, this update fixes the following issues in Apache's mod_proxy_ftp: CVE-2009-3094: Insufficient input validation in the mod_proxy_ftp module allowed remote FTP servers to cause a denial of service via a malformed reply to an EPSV command. CVE-2009-3095: Insufficient input validation in the mod_proxy_ftp module allowed remote authenticated attackers to bypass intended access restrictions and send arbitrary FTP commands to an FTP server. For the stable distribution, these problems have been fixed in version 2.2.9-10+lenny6. This version also includes some non-security bug fixes that were scheduled for inclusion in the next stable point release. The oldstable distribution, these problems have been fixed in version 2.2.3-4+etch11. For the testing distribution and the unstable distribution, these problems will be fixed in version 2.2.14-2. This advisory also provides updated apache2-mpm-itk packages which have been recompiled against the new apache2 packages. Updated apache2-mpm-itk packages for the armel architecture are not included yet. They will be released as soon as they become available. We recommend that you upgrade your apache2 and apache2-mpm-itk packages.
Family: unix Class: patch
Reference(s): DSA-1934-1
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13532
 
Oval ID: oval:org.mitre.oval:def:13532
Title: USN-927-6 -- nss vulnerability
Description: USN-927-1 fixed vulnerabilities in NSS on Ubuntu 9.10. This update provides the corresponding updates for Ubuntu 9.04. Original advisory details: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds support for the new new renegotiation extension and will use it when the server supports it.
Family: unix Class: patch
Reference(s): USN-927-6
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 9.04
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13529
 
Oval ID: oval:org.mitre.oval:def:13529
Title: USN-990-2 -- apache2 vulnerability
Description: USN-860-1 introduced a partial workaround to Apache that disabled client initiated TLS renegotiation in order to mitigate CVE-2009-3555. USN-990-1 introduced the new RFC5746 renegotiation extension in openssl, and completely resolves the issue. After updating openssl, an Apache server will allow both patched and unpatched web browsers to connect, but unpatched browsers will not be able to renegotiate. This update introduces the new SSLInsecureRenegotiation directive for Apache that may be used to re-enable insecure renegotiations with unpatched web browsers. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds backported support for the new RFC5746 renegotiation extension and will use it when both the client and the server support it.
Family: unix Class: patch
Reference(s): USN-990-2
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13440
 
Oval ID: oval:org.mitre.oval:def:13440
Title: USN-927-4 -- nss vulnerability
Description: USN-927-1 fixed vulnerabilities in nss in Ubuntu 9.10. This update provides the corresponding updates for Ubuntu 8.04 LTS. Original advisory details: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds support for the new new renegotiation extension and will use it when the server supports it.
Family: unix Class: patch
Reference(s): USN-927-4
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 8.04
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13424
 
Oval ID: oval:org.mitre.oval:def:13424
Title: USN-990-1 -- openssl vulnerability
Description: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds backported support for the new RFC5746 renegotiation extension and will use it when both the client and the server support it. ATTENTION: After applying this update, a patched server will allow both patched and unpatched clients to connect, but unpatched clients will not be able to renegotiate
Family: unix Class: patch
Reference(s): USN-990-1
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13085
 
Oval ID: oval:org.mitre.oval:def:13085
Title: USN-927-1 -- nss vulnerability
Description: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds support for the new new renegotiation extension and will use it when the server supports it.
Family: unix Class: patch
Reference(s): USN-927-1
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 9.10
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11617
 
Oval ID: oval:org.mitre.oval:def:11617
Title: AIX OpenSSL session renegotiation vulnerability
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 3
Platform(s): IBM AIX 5.2
IBM AIX 5.3
IBM AIX 6.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11578
 
Oval ID: oval:org.mitre.oval:def:11578
Title: Security Vulnerability in the Transport Layer Security (TLS) and Secure Sockets Layer 3.0 (SSLv3) Protocols Involving Handshake Renegotiation Affects OpenSSL
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 3
Platform(s): Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10088
 
Oval ID: oval:org.mitre.oval:def:10088
Title: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23090
 
Oval ID: oval:org.mitre.oval:def:23090
Title: ELSA-2010:0164: openssl097a security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0164-01
CVE-2009-3555
Version: 6
Platform(s): Oracle Linux 5
Product(s): openssl097a
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23000
 
Oval ID: oval:org.mitre.oval:def:23000
Title: ELSA-2010:0166: gnutls security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0166-01
CVE-2009-2409
CVE-2009-3555
Version: 13
Platform(s): Oracle Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22993
 
Oval ID: oval:org.mitre.oval:def:22993
Title: ELSA-2010:0165: nss security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0165-01
CVE-2009-3555
Version: 6
Platform(s): Oracle Linux 5
Product(s): nspr
nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22913
 
Oval ID: oval:org.mitre.oval:def:22913
Title: ELSA-2010:0155: java-1.4.2-ibm security and bug fix update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0155-01
CVE-2009-3555
Version: 6
Platform(s): Oracle Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22820
 
Oval ID: oval:org.mitre.oval:def:22820
Title: ELSA-2009:1579: httpd security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2009:1579-02
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 17
Platform(s): Oracle Linux 5
Product(s): httpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25097
 
Oval ID: oval:org.mitre.oval:def:25097
Title: Vulnerability in OpenSSL before 0.9.8i, allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: windows Class: vulnerability
Reference(s): CVE-2009-3555
Version: 4
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28269
 
Oval ID: oval:org.mitre.oval:def:28269
Title: DEPRECATED: ELSA-2010-0339 -- java-1.6.0-openjdk security update (important)
Description: [1:1.6.0.0-1.11.b16.0.1.el5] - Add oracle-enterprise.patch [1:1.6.0.0-1.11.b16.el5] - Remove javaws alternative due to conflict with java-1.6.0-sun's alternatives [1:1.6.0-1.10.b16] - Update to openjdk build b16 - Update to icedtea6-1.6 - Added tzdata-java requirement - Added autoconf and automake build requirement - Added tzdata-java requirement - Added java-1.6.0-openjdk-gcc-stack-markings.patch - Added java-1.6.0-openjdk-memory-barriers.patch - Added java-1.6.0-openjdk-jar-misc.patch - Added java-1.6.0-openjdk-linux-separate-debuginfo.patch - Added java-1.6.0-openjdk-securitypatches-20100323.patch - Added STRIP_KEEP_SYMTAB=libjvm* to install section, fix bz530402 - Resolves: rhbz#576124 [1:1.6.0-1.8.b09] - Added java-1.6.0-openjdk-debuginfo.patch - Added java-1.6.0-openjdk-elf-debuginfo.patch
Family: unix Class: patch
Reference(s): ELSA-2010-0339
CVE-2010-0082
CVE-2010-0084
CVE-2010-0085
CVE-2010-0088
CVE-2010-0091
CVE-2010-0092
CVE-2010-0093
CVE-2010-0094
CVE-2010-0095
CVE-2010-0837
CVE-2010-0838
CVE-2010-0840
CVE-2010-0845
CVE-2010-0847
CVE-2010-0848
CVE-2009-3555
Version: 4
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28188
 
Oval ID: oval:org.mitre.oval:def:28188
Title: DEPRECATED: ELSA-2010-0768 -- java-1.6.0-openjdk security and bug fix update (important)
Description: [1.6.0.0-1.16.b17.0.1.el5] - Add oracle-enterprise.patch [1.6.0.0-1.16.b17.el5] - Updated 1.7.5 tarball (contains additional security fixes) - Resolves: bz639951 [1.6.0.0-1.15.b17.el5] - Rebuild - Resolves: bz639951 [1.6.0.0-1.14.b17.el5] - Synched with el6 branch - Updated to IcedTea 1.7.5 - Resolves: bz639951 - Also resolves 619800 and 621303
Family: unix Class: patch
Reference(s): ELSA-2010-0768
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
CVE-2009-3555
Version: 4
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27881
 
Oval ID: oval:org.mitre.oval:def:27881
Title: DEPRECATED: ELSA-2010-0166 -- gnutls security update (moderate)
Description: [1.4.1-3.8] - fix safe renegotiation on SSL3 protocol [1.4.1-3.7] - implement safe renegotiation - CVE-2009-3555 (#533125) - do not allow MD2 in certificate signatures by default - CVE-2009-2409 (#510197)
Family: unix Class: patch
Reference(s): ELSA-2010-0166
CVE-2009-2409
CVE-2009-3555
Version: 4
Platform(s): Oracle Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27748
 
Oval ID: oval:org.mitre.oval:def:27748
Title: DEPRECATED: ELSA-2010-0162 -- openssl security update (important)
Description: [0.9.8e-12.6] - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924) [0.9.8e-12.5] - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which in the RHEL-5 and newer versions will crash in such case (#569774) [0.9.8e-12.4] - do not disable SSLv2 in the renegotiation patch - SSLv2 does not support renegotiation - allow unsafe renegotiation on clients with SSL_OP_LEGACY_SERVER_CONNECT [0.9.8e-12.3] - mention the RFC5746 in the CVE-2009-3555 doc [0.9.8e-12.2] - fix CVE-2009-3555 - support the safe renegotiation extension and do not allow legacy renegotiation on the server by default (#533125)
Family: unix Class: patch
Reference(s): ELSA-2010-0162
CVE-2010-0433
CVE-2009-3245
CVE-2009-3555
Version: 4
Platform(s): Oracle Linux 5
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27295
 
Oval ID: oval:org.mitre.oval:def:27295
Title: DEPRECATED: ELSA-2010-0164 -- openssl097a security update (moderate)
Description: [0.9.7a-9.2] - CVE-2009-3555 - support the secure renegotiation RFC (#533125)
Family: unix Class: patch
Reference(s): ELSA-2010-0164
CVE-2009-3555
Version: 4
Platform(s): Oracle Linux 5
Product(s): openssl097a
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:29317
 
Oval ID: oval:org.mitre.oval:def:29317
Title: RHSA-2009:1579 -- httpd security update (Moderate)
Description: Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation. A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials. This update partially mitigates this flaw for SSL sessions to HTTP servers using mod_ssl by rejecting client-requested renegotiation. (CVE-2009-3555)
Family: unix Class: patch
Reference(s): RHSA-2009:1579
CESA-2009:1579-CentOS 3
CESA-2009:1579-CentOS 5
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 3
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 3
CentOS Linux 3
CentOS Linux 5
Product(s): httpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20418
 
Oval ID: oval:org.mitre.oval:def:20418
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function, which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3559
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12556
 
Oval ID: oval:org.mitre.oval:def:12556
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function, which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3559
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11880
 
Oval ID: oval:org.mitre.oval:def:11880
Title: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function, which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3559
Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11662
 
Oval ID: oval:org.mitre.oval:def:11662
Title: DEPRECATED: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function, which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3559
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7450
 
Oval ID: oval:org.mitre.oval:def:7450
Title: HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1321
Version: 11
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7198
 
Oval ID: oval:org.mitre.oval:def:7198
Title: VMware ESX,Service Console update for krb5.
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1321
Version: 5
Platform(s): VMWare ESX Server 3.5
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21548
 
Oval ID: oval:org.mitre.oval:def:21548
Title: RHSA-2010:0423: krb5 security update (Important)
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Family: unix Class: patch
Reference(s): RHSA-2010:0423-01
CESA-2010:0423
CVE-2010-1321
Version: 4
Platform(s): Red Hat Enterprise Linux 3
Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): krb5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20380
 
Oval ID: oval:org.mitre.oval:def:20380
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1321
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13432
 
Oval ID: oval:org.mitre.oval:def:13432
Title: USN-940-1 -- krb5 vulnerabilities
Description: It was discovered that Kerberos did not correctly free memory in the GSSAPI and kdb libraries. If a remote attacker were able to manipulate an application using these libraries carefully, the service could crash, leading to a denial of service. Joel Johnson, Brian Almeida, and Shawn Emery discovered that Kerberos did not correctly verify certain packet structures. An unauthenticated remote attacker could send specially crafted traffic to cause the KDC or kadmind services to crash, leading to a denial of service
Family: unix Class: patch
Reference(s): USN-940-1
CVE-2007-5902
CVE-2007-5971
CVE-2007-5972
CVE-2010-1320
CVE-2010-1321
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
Product(s): krb5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13416
 
Oval ID: oval:org.mitre.oval:def:13416
Title: USN-940-2 -- krb5 vulnerability
Description: USN-940-1 fixed vulnerabilities in Kerberos. This update provides the corresponding updates for Ubuntu 10.04. Original advisory details: Joel Johnson, Brian Almeida, and Shawn Emery discovered that Kerberos did not correctly verify certain packet structures. An unauthenticated remote attacker could send specially crafted traffic to cause the KDC or kadmind services to crash, leading to a denial of service
Family: unix Class: patch
Reference(s): USN-940-2
CVE-2010-1320
CVE-2010-1321
Version: 5
Platform(s): Ubuntu 10.04
Product(s): krb5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13225
 
Oval ID: oval:org.mitre.oval:def:13225
Title: DSA-2052-1 krb5 -- null pointer dereference
Description: Shawn Emery discovered that in MIT Kerberos 5 , a system for authenticating users and services on a network, a null pointer dereference flaw in the Generic Security Service Application Program Interface library could allow an authenticated remote attacker to crash any server application using the GSS-API authentication mechanism, by sending a specially-crafted GSS-API token with a missing checksum field. For the stable distribution, this problem has been fixed in version 1.6.dfsg.4~beta1-5lenny4. For the testing distribution, this problem has been fixed in version 1.8.1+dfsg-3. For the testing distribution, this problem has been fixed in version 1.8.1+dfsg-3. We recommend that you upgrade your krb5 packages.
Family: unix Class: patch
Reference(s): DSA-2052-1
CVE-2010-1321
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): krb5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11908
 
Oval ID: oval:org.mitre.oval:def:11908
Title: DSA-2052 krb5 -- null pointer dereference
Description: Shawn Emery discovered that in MIT Kerberos 5 , a system for authenticating users and services on a network, a null pointer dereference flaw in the Generic Security Service Application Program Interface library could allow an authenticated remote attacker to crash any server application using the GSS-API authentication mechanism, by sending a specially-crafted GSS-API token with a missing checksum field.
Family: unix Class: patch
Reference(s): DSA-2052
CVE-2010-1321
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): krb5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11604
 
Oval ID: oval:org.mitre.oval:def:11604
Title: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1321
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23034
 
Oval ID: oval:org.mitre.oval:def:23034
Title: ELSA-2010:0423: krb5 security update (Important)
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Family: unix Class: patch
Reference(s): ELSA-2010:0423-01
CVE-2010-1321
Version: 6
Platform(s): Oracle Linux 5
Product(s): krb5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20242
 
Oval ID: oval:org.mitre.oval:def:20242
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3556
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12523
 
Oval ID: oval:org.mitre.oval:def:12523
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3556
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12496
 
Oval ID: oval:org.mitre.oval:def:12496
Title: DEPRECATED: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3556
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11815
 
Oval ID: oval:org.mitre.oval:def:11815
Title: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 and earlier versions
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3556
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20460
 
Oval ID: oval:org.mitre.oval:def:20460
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3549
Version: 4
Platform(s): VMWare ESX Server 4.0
VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:14340
 
Oval ID: oval:org.mitre.oval:def:14340
Title: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3549
Version: 9
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): Java Runtime Environment
Java Development Kit
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11559
 
Oval ID: oval:org.mitre.oval:def:11559
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3549
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20190
 
Oval ID: oval:org.mitre.oval:def:20190
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3573
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12274
 
Oval ID: oval:org.mitre.oval:def:12274
Title: DEPRECATED: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and earlier versions
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3573
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12220
 
Oval ID: oval:org.mitre.oval:def:12220
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3573
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11990
 
Oval ID: oval:org.mitre.oval:def:11990
Title: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and earlier versions
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3573
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20558
 
Oval ID: oval:org.mitre.oval:def:20558
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or "otherwise-protected internal network names."
Family: unix Class: vulnerability
Reference(s): CVE-2010-3548
Version: 4
Platform(s): VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20195
 
Oval ID: oval:org.mitre.oval:def:20195
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or "otherwise-protected internal network names."
Family: unix Class: vulnerability
Reference(s): CVE-2010-3548
Version: 4
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:14475
 
Oval ID: oval:org.mitre.oval:def:14475
Title: Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or "otherwise-protected internal network names."
Description: Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or "otherwise-protected internal network names."
Family: windows Class: vulnerability
Reference(s): CVE-2010-3548
Version: 9
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): Java Development Kit
Java Runtime Environment
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12426
 
Oval ID: oval:org.mitre.oval:def:12426
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or "otherwise-protected internal network names."
Family: unix Class: vulnerability
Reference(s): CVE-2010-3548
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20557
 
Oval ID: oval:org.mitre.oval:def:20557
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3568
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12531
 
Oval ID: oval:org.mitre.oval:def:12531
Title: DEPRECATED: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3568
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12206
 
Oval ID: oval:org.mitre.oval:def:12206
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3568
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12029
 
Oval ID: oval:org.mitre.oval:def:12029
Title: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3568
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20443
 
Oval ID: oval:org.mitre.oval:def:20443
Title: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3569
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12484
 
Oval ID: oval:org.mitre.oval:def:12484
Title: DEPRECATED: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3569
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12234
 
Oval ID: oval:org.mitre.oval:def:12234
Title: HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3569
Version: 12
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12226
 
Oval ID: oval:org.mitre.oval:def:12226
Title: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 and earlier versions
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3569
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Oracle Java SE
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application176
Application1
Application134
Application1
Application55
Application31
Application161
Application294
Application332
Application103
Os6
Os5
Os4

ExploitDB Exploits

idDescription
2009-12-21TLS Renegotiation Vulnerability PoC Exploit

OpenVAS Exploits

DateDescription
2012-08-10Name : Gentoo Security Advisory GLSA 201206-18 (GnuTLS)
File : nvt/glsa_201206_18.nasl
2012-04-30Name : Gentoo Security Advisory GLSA 201203-22 (nginx)
File : nvt/glsa_201203_22.nasl
2012-03-16Name : VMSA-2011-0003.2 Third party component updates for VMware vCenter Server, vCe...
File : nvt/gb_VMSA-2011-0003.nasl
2012-03-15Name : VMSA-2010-0016 VMware ESXi and ESX third party updates for Service Console an...
File : nvt/gb_VMSA-2010-0016.nasl
2012-03-15Name : VMSA-2011-0013.2 VMware third party component updates for VMware vCenter Serv...
File : nvt/gb_VMSA-2011-0013.nasl
2012-02-12Name : Gentoo Security Advisory GLSA 201201-13 (mit-krb5)
File : nvt/glsa_201201_13.nasl
2012-02-12Name : Gentoo Security Advisory GLSA 201110-05 (gnutls)
File : nvt/glsa_201110_05.nasl
2012-02-12Name : Gentoo Security Advisory GLSA 201111-02 (sun-jre-bin sun-jdk emul-linux-x86-j...
File : nvt/glsa_201111_02.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1579 centos3 i386
File : nvt/gb_CESA-2009_1579_httpd_centos3_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1579 centos5 i386
File : nvt/gb_CESA-2009_1579_httpd_centos5_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1580 centos4 i386
File : nvt/gb_CESA-2009_1580_httpd_centos4_i386.nasl
2011-08-09Name : CentOS Update for openssl CESA-2010:0162 centos5 i386
File : nvt/gb_CESA-2010_0162_openssl_centos5_i386.nasl
2011-08-09Name : CentOS Update for openssl097a CESA-2010:0164 centos5 i386
File : nvt/gb_CESA-2010_0164_openssl097a_centos5_i386.nasl
2011-08-09Name : CentOS Update for nspr CESA-2010:0165 centos5 i386
File : nvt/gb_CESA-2010_0165_nspr_centos5_i386.nasl
2011-08-09Name : CentOS Update for gnutls CESA-2010:0166 centos5 i386
File : nvt/gb_CESA-2010_0166_gnutls_centos5_i386.nasl
2011-08-09Name : CentOS Update for java CESA-2010:0339 centos5 i386
File : nvt/gb_CESA-2010_0339_java_centos5_i386.nasl
2011-08-09Name : CentOS Update for java CESA-2010:0768 centos5 i386
File : nvt/gb_CESA-2010_0768_java_centos5_i386.nasl
2011-05-05Name : Fedora Update for krb5 FEDORA-2011-5343
File : nvt/gb_fedora_2011_5343_krb5_fc13.nasl
2011-03-25Name : Fedora Update for krb5 FEDORA-2011-3464
File : nvt/gb_fedora_2011_3464_krb5_fc13.nasl
2011-03-09Name : Gentoo Security Advisory GLSA 201006-18 (sun-jre-bin sun-jdk emul-linux-x86-j...
File : nvt/glsa_201006_18.nasl
2011-03-07Name : Debian Security Advisory DSA 2161-2 (openjdk-6)
File : nvt/deb_2161_2.nasl
2011-02-18Name : Fedora Update for krb5 FEDORA-2011-1210
File : nvt/gb_fedora_2011_1210_krb5_fc13.nasl
2011-01-04Name : HP-UX Update for Java HPSBUX02608
File : nvt/gb_hp_ux_HPSBUX02608.nasl
2010-12-23Name : Fedora Update for krb5 FEDORA-2010-18425
File : nvt/gb_fedora_2010_18425_krb5_fc13.nasl
2010-12-02Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-16312
File : nvt/gb_fedora_2010_16312_java-1.6.0-openjdk_fc14.nasl
2010-11-23Name : Fedora Update for openssl FEDORA-2010-17826
File : nvt/gb_fedora_2010_17826_openssl_fc12.nasl
2010-11-16Name : Fedora Update for nss FEDORA-2010-15989
File : nvt/gb_fedora_2010_15989_nss_fc12.nasl
2010-11-16Name : Fedora Update for proftpd FEDORA-2010-17220
File : nvt/gb_fedora_2010_17220_proftpd_fc12.nasl
2010-11-04Name : Ubuntu Update for openjdk-6, openjdk-6b18 vulnerabilities USN-1010-1
File : nvt/gb_ubuntu_USN_1010_1.nasl
2010-10-28Name : Oracle Java SE Multiple Vulnerabilities (Windows)
File : nvt/gb_sun_java_se_mult_vuln_oct10_win.nasl
2010-10-22Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-16240
File : nvt/gb_fedora_2010_16240_java-1.6.0-openjdk_fc12.nasl
2010-10-22Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-16294
File : nvt/gb_fedora_2010_16294_java-1.6.0-openjdk_fc13.nasl
2010-10-19Name : RedHat Update for java-1.6.0-openjdk RHSA-2010:0768-01
File : nvt/gb_RHSA-2010_0768-01_java-1.6.0-openjdk.nasl
2010-09-27Name : Ubuntu Update for openssl vulnerability USN-990-1
File : nvt/gb_ubuntu_USN_990_1.nasl
2010-09-27Name : Ubuntu Update for apache2 vulnerability USN-990-2
File : nvt/gb_ubuntu_USN_990_2.nasl
2010-08-11Name : Remote Code Execution Vulnerabilities in SChannel (980436)
File : nvt/secpod_ms10-049.nasl
2010-07-26Name : Ubuntu Update for nss vulnerability USN-927-6
File : nvt/gb_ubuntu_USN_927_6.nasl
2010-07-23Name : Ubuntu Update for krb5 vulnerability USN-940-2
File : nvt/gb_ubuntu_USN_940_2.nasl
2010-07-12Name : Mandriva Update for heimdal MDVSA-2010:130 (heimdal)
File : nvt/gb_mandriva_MDVSA_2010_130.nasl
2010-07-02Name : Ubuntu Update for nss vulnerability USN-927-4
File : nvt/gb_ubuntu_USN_927_4.nasl
2010-07-02Name : Ubuntu Update for nspr update USN-927-5
File : nvt/gb_ubuntu_USN_927_5.nasl
2010-06-28Name : Fedora Update for gnutls FEDORA-2010-9487
File : nvt/gb_fedora_2010_9487_gnutls_fc12.nasl
2010-06-25Name : Fedora Update for openssl FEDORA-2010-9421
File : nvt/gb_fedora_2010_9421_openssl_fc11.nasl
2010-06-25Name : Fedora Update for gnutls FEDORA-2010-9518
File : nvt/gb_fedora_2010_9518_gnutls_fc13.nasl
2010-06-18Name : Fedora Update for openssl FEDORA-2010-9639
File : nvt/gb_fedora_2010_9639_openssl_fc12.nasl
2010-06-07Name : Fedora Update for httpd FEDORA-2010-6055
File : nvt/gb_fedora_2010_6055_httpd_fc12.nasl
2010-06-07Name : HP-UX Update for Java HPSBUX02524
File : nvt/gb_hp_ux_HPSBUX02524.nasl
2010-06-03Name : Debian Security Advisory DSA 2052-1 (krb5)
File : nvt/deb_2052_1.nasl
2010-05-28Name : Mandriva Update for krb5 MDVSA-2010:100 (krb5)
File : nvt/gb_mandriva_MDVSA_2010_100.nasl
2010-05-28Name : CentOS Update for krb5-devel CESA-2010:0423 centos3 i386
File : nvt/gb_CESA-2010_0423_krb5-devel_centos3_i386.nasl
2010-05-28Name : CentOS Update for krb5-devel CESA-2010:0423 centos4 i386
File : nvt/gb_CESA-2010_0423_krb5-devel_centos4_i386.nasl
2010-05-28Name : Java for Mac OS X 10.5 Update 7
File : nvt/macosx_java_for_10_5_upd_7.nasl
2010-05-28Name : Java for Mac OS X 10.6 Update 2
File : nvt/macosx_java_for_10_6_upd_2.nasl
2010-05-28Name : Fedora Update for openssl FEDORA-2010-8742
File : nvt/gb_fedora_2010_8742_openssl_fc12.nasl
2010-05-28Name : Fedora Update for krb5 FEDORA-2010-8796
File : nvt/gb_fedora_2010_8796_krb5_fc11.nasl
2010-05-28Name : Fedora Update for krb5 FEDORA-2010-8805
File : nvt/gb_fedora_2010_8805_krb5_fc12.nasl
2010-05-28Name : Ubuntu Update for krb5 vulnerabilities USN-940-1
File : nvt/gb_ubuntu_USN_940_1.nasl
2010-05-28Name : RedHat Update for krb5 RHSA-2010:0423-01
File : nvt/gb_RHSA-2010_0423-01_krb5.nasl
2010-05-07Name : Fedora Update for httpd FEDORA-2010-6131
File : nvt/gb_fedora_2010_6131_httpd_fc11.nasl
2010-04-30Name : HP-UX Update for OpenSSL HPSBUX02517
File : nvt/gb_hp_ux_HPSBUX02517.nasl
2010-04-30Name : Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 (java-1.6.0-openjdk)
File : nvt/gb_mandriva_MDVSA_2010_084.nasl
2010-04-30Name : Mandriva Update for netcdf MDVA-2010:129 (netcdf)
File : nvt/gb_mandriva_MDVA_2010_129.nasl
2010-04-30Name : Mandriva Update for rpm MDVA-2010:130 (rpm)
File : nvt/gb_mandriva_MDVA_2010_130.nasl
2010-04-29Name : Mandriva Update for firefox MDVSA-2010:070-1 (firefox)
File : nvt/gb_mandriva_MDVSA_2010_070_1.nasl
2010-04-29Name : Mandriva Update for openssl MDVSA-2010:076-1 (openssl)
File : nvt/gb_mandriva_MDVSA_2010_076_1.nasl
2010-04-29Name : SuSE Update for MozillaFirefox,MozillaThunderbird,seamonkey,mozilla-nss SUSE-...
File : nvt/gb_suse_2010_021.nasl
2010-04-19Name : Mandriva Update for openssl MDVSA-2010:076 (openssl)
File : nvt/gb_mandriva_MDVSA_2010_076.nasl
2010-04-19Name : Fedora Update for openssl FEDORA-2010-5357
File : nvt/gb_fedora_2010_5357_openssl_fc11.nasl
2010-04-16Name : Mandriva Update for firefox MDVSA-2010:070 (firefox)
File : nvt/gb_mandriva_MDVSA_2010_070.nasl
2010-04-16Name : Ubuntu Update for nss vulnerability USN-927-1
File : nvt/gb_ubuntu_USN_927_1.nasl
2010-04-09Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-6025
File : nvt/gb_fedora_2010_6025_java-1.6.0-openjdk_fc12.nasl
2010-04-09Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-6039
File : nvt/gb_fedora_2010_6039_java-1.6.0-openjdk_fc11.nasl
2010-04-09Name : Mandriva Update for nss MDVSA-2010:069 (nss)
File : nvt/gb_mandriva_MDVSA_2010_069.nasl
2010-04-09Name : Ubuntu Update for openjdk-6 vulnerabilities USN-923-1
File : nvt/gb_ubuntu_USN_923_1.nasl
2010-04-07Name : Oracle Java SE Multiple Vulnerabilities (Linux)
File : nvt/gb_oracle_java_se_mult_vuln_lin_apr10.nasl
2010-04-07Name : Oracle Java SE Multiple Vulnerabilities (Windows)
File : nvt/gb_oracle_java_se_mult_vuln_win_apr10.nasl
2010-04-06Name : Mac OS X Security Update 2010-001
File : nvt/macosx_secupd_2010-001.nasl
2010-04-06Name : FreeBSD Ports: seamonkey
File : nvt/freebsd_seamonkey0.nasl
2010-04-06Name : RedHat Update for java-1.6.0-openjdk RHSA-2010:0339-01
File : nvt/gb_RHSA-2010_0339-01_java-1.6.0-openjdk.nasl
2010-03-31Name : CentOS Update for openssl CESA-2010:0163 centos3 i386
File : nvt/gb_CESA-2010_0163_openssl_centos3_i386.nasl
2010-03-31Name : CentOS Update for openssl CESA-2010:0163 centos4 i386
File : nvt/gb_CESA-2010_0163_openssl_centos4_i386.nasl
2010-03-31Name : CentOS Update for nspr CESA-2010:0165 centos4 i386
File : nvt/gb_CESA-2010_0165_nspr_centos4_i386.nasl
2010-03-31Name : CentOS Update for gnutls CESA-2010:0167 centos4 i386
File : nvt/gb_CESA-2010_0167_gnutls_centos4_i386.nasl
2010-03-31Name : Fedora Update for nss FEDORA-2010-3905
File : nvt/gb_fedora_2010_3905_nss_fc11.nasl
2010-03-31Name : RedHat Update for openssl RHSA-2010:0162-01
File : nvt/gb_RHSA-2010_0162-01_openssl.nasl
2010-03-31Name : RedHat Update for openssl RHSA-2010:0163-01
File : nvt/gb_RHSA-2010_0163-01_openssl.nasl
2010-03-31Name : RedHat Update for openssl097a RHSA-2010:0164-01
File : nvt/gb_RHSA-2010_0164-01_openssl097a.nasl
2010-03-31Name : RedHat Update for nss RHSA-2010:0165-01
File : nvt/gb_RHSA-2010_0165-01_nss.nasl
2010-03-31Name : RedHat Update for gnutls RHSA-2010:0166-01
File : nvt/gb_RHSA-2010_0166-01_gnutls.nasl
2010-03-31Name : RedHat Update for gnutls RHSA-2010:0167-01
File : nvt/gb_RHSA-2010_0167-01_gnutls.nasl
2010-03-22Name : Mandriva Update for rootcerts MDVA-2010:100 (rootcerts)
File : nvt/gb_mandriva_MDVA_2010_100.nasl
2010-03-12Name : Mandriva Update for cacti MDVA-2010:089 (cacti)
File : nvt/gb_mandriva_MDVA_2010_089.nasl
2010-03-02Name : Fedora Update for nss FEDORA-2010-1127
File : nvt/gb_fedora_2010_1127_nss_fc12.nasl
2010-03-02Name : Mandriva Update for rsh MDVA-2010:076 (rsh)
File : nvt/gb_mandriva_MDVA_2010_076.nasl
2010-03-02Name : Mandriva Update for x11-driver-video-ati MDVA-2010:084 (x11-driver-video-ati)
File : nvt/gb_mandriva_MDVA_2010_084.nasl
2010-03-02Name : Fedora Update for httpd FEDORA-2009-12747
File : nvt/gb_fedora_2009_12747_httpd_fc11.nasl
2010-02-19Name : Mandriva Update for mandriva-release MDVA-2010:069 (mandriva-release)
File : nvt/gb_mandriva_MDVA_2010_069.nasl
2010-02-11Name : Microsoft Windows TLS/SSL Spoofing Vulnerability (977377)
File : nvt/gb_ms_tls_ssl_spoofing_vuln.nasl
2009-12-30Name : Fedora Core 12 FEDORA-2009-12229 (tomcat-native)
File : nvt/fcore_2009_12229.nasl
2009-12-30Name : Fedora Core 11 FEDORA-2009-12305 (tomcat-native)
File : nvt/fcore_2009_12305.nasl
2009-12-30Name : Fedora Core 12 FEDORA-2009-12606 (httpd)
File : nvt/fcore_2009_12606.nasl
2009-12-30Name : Fedora Core 11 FEDORA-2009-13236 (proftpd)
File : nvt/fcore_2009_13236.nasl
2009-12-30Name : Fedora Core 12 FEDORA-2009-13250 (proftpd)
File : nvt/fcore_2009_13250.nasl
2009-12-14Name : Fedora Core 10 FEDORA-2009-12604 (httpd)
File : nvt/fcore_2009_12604.nasl
2009-12-14Name : Gentoo Security Advisory GLSA 200912-01 (openssl)
File : nvt/glsa_200912_01.nasl
2009-12-14Name : Fedora Core 12 FEDORA-2009-12968 (nss-util)
File : nvt/fcore_2009_12968.nasl
2009-12-10Name : Mandriva Security Advisory MDVSA-2009:323 (apache)
File : nvt/mdksa_2009_323.nasl
2009-12-10Name : FreeBSD Security Advisory (FreeBSD-SA-09:15.ssl.asc)
File : nvt/freebsdsa_ssl.nasl
2009-12-10Name : Fedora Core 12 FEDORA-2009-12750 (nginx)
File : nvt/fcore_2009_12750.nasl
2009-12-10Name : Fedora Core 10 FEDORA-2009-12775 (nginx)
File : nvt/fcore_2009_12775.nasl
2009-12-10Name : Fedora Core 11 FEDORA-2009-12782 (nginx)
File : nvt/fcore_2009_12782.nasl
2009-11-23Name : SuSE Security Advisory SUSE-SA:2009:057 (openssl)
File : nvt/suse_sa_2009_057.nasl
2009-11-23Name : SLES9: Security update for OpenSSL
File : nvt/sles9p5062661.nasl
2009-11-17Name : SLES10: Security update for OpenSSL
File : nvt/sles10_compat-openssl02.nasl
2009-11-17Name : CentOS Security Advisory CESA-2009:1579 (httpd)
File : nvt/ovcesa2009_1579.nasl
2009-11-17Name : CentOS Security Advisory CESA-2009:1580 (httpd)
File : nvt/ovcesa2009_1580.nasl
2009-11-17Name : SLES11: Security update for libopenssl
File : nvt/sles11_libopenssl0_9_82.nasl
2009-11-17Name : RedHat Security Advisory RHSA-2009:1579
File : nvt/RHSA_2009_1579.nasl
2009-11-17Name : RedHat Security Advisory RHSA-2009:1580
File : nvt/RHSA_2009_1580.nasl
2009-11-17Name : SLES10: Security update for OpenSSL
File : nvt/sles10_openssl3.nasl
0000-00-00Name : Slackware Advisory SSA:2009-320-01 openssl
File : nvt/esoft_slk_ssa_2009_320_01.nasl
0000-00-00Name : Slackware Advisory SSA:2010-067-01 httpd
File : nvt/esoft_slk_ssa_2010_067_01.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
77832Parallels Plesk Panel Billing System TLS Renegotiation Handshakes MiTM Plaint...
75622Blue Coat Director TLS Renegotiation Handshakes MiTM Plaintext Data Injection
74335Hitachi Web Server TLS Renegotiation Handshakes MiTM Plaintext Data Injection
71961Oracle Fusion Middleware Oracle WebLogic Server TLS Renegotiation Handshakes ...
71951Oracle Multiple Products Oracle Security Service TLS Renegotiation Handshakes...
70620mGuard TLS Renegotiation Handshakes MiTM Plaintext Data Injection
70083Oracle Database MIT Kerberos 5 kg_accept_krb5 Remote Denial of Service
70055Oracle Supply Chain Transportation Management TLS Renegotiation Handshakes Mi...
69561IBM WebSphere MQ Internet Pass-Thru TLS Renegotiation Handshake MiTM Plaintex...
69059Oracle Java SE / Java for Business Networking Component HttpURLConnection App...
69058Oracle Java SE / Java for Business JNDI Internal Network Names Information Di...
69057Oracle Java SE / Java for Business Networking Component HttpURLConnection chu...
69056Oracle Java SE / Java for Business Web Start Component Unspecified Issue (201...
69055Oracle Java SE / Java for Business Networking Component Network Address Infor...
69050Oracle Java SE / Java for Business 2D Component Unspecified Issue (2010-3556)
69047Oracle Java SE / Java for Business HeadspaceSoundbank.nGetName BANK Record Si...
69044Oracle Java SE / Java for Business 2D Component IndexColorModel Double-free E...
69042Oracle Java SE / Java for Business JRE JPEGImageWriter.writeImage Overflow
69041Oracle Java SE / Java for Business JRE ICC Profile devs Tag Structure Overflow
69039Oracle Java SE / Java for Business JRE Component Unspecified Issue (2010-3568)
69038Oracle Java SE / Java for Business JRE Component Unspecified Issue (2010-3569)
69035Oracle Java SE / Java for Business Sound Component Unspecified Issue (2010-3...
69034Oracle Java SE / Java for Business java.net.URLConnection Same-of-origin Poli...
69033Oracle Java SE / Java for Business Networking Component HttpURLConnection all...
69032Oracle Java SE / Java for Business TLS Renegotiation Handshake MiTM Plaintext...
67029HP Threat Management Services zl Module TLS Renegotiation Handshakes MiTM Pla...
66315HP Insight Manager TLS Renegotiation Handshakes MiTM Plaintext Data Injection
65202OpenOffice.org (OOo) TLS Renegotiation Handshakes MiTM Plaintext Data Injection
64744Kerberos GSS-API AP-REQ Authenticator NULL Dereference Remote DoS
64725HP System Management Homepage (SMH) TLS Renegotiation Handshakes MiTM Plainte...
64499ArubaOS HTTPS WebUI Admin Interface TLS Renegotiation Handshakes MiTM Plainte...
64040IBM DB2 TLS Renegotiation Handshakes MiTM Plaintext Data Injection
62877SSH Tectia Audit Player TLS Renegotiation Handshakes MiTM Plaintext Data Inje...
62536Blue Coat Products TLS Renegotiation Handshakes MiTM Plaintext Data Injection
62273Opera TLS Renegotiation Handshakes MiTM Plaintext Data Injection
62210Aruba Mobility Controller TLS Renegotiation Handshakes MiTM Plaintext Data In...
62135Network Security Services (NSS) TLS Renegotiation Handshakes MiTM Plaintext D...
62064IBM Java TLS Renegotiation Handshakes MiTM Plaintext Data Injection
61929IBM WebSphere Application Server TLS Renegotiation Handshakes MiTM Plaintext ...
61785Avaya Products Multiple Product TLS Renegotiation Handshakes MiTM Plaintext D...
61784Sun Java System Multiple Product TLS Renegotiation Handshakes MiTM Plaintext ...
61718IBM WebSphere DataPower TLS Renegotiation Handshakes MiTM Plaintext Data Inje...
61234IBM SDK for Java TLS Renegotiation Handshakes MiTM Plaintext Data Injection
60521Ingate Firewall/SIParator SSL / TLS Renegotiation Handshakes MiTM Plaintext D...
60366Cisco Multiple Devices TLS Renegotiation Handshakes MiTM Plaintext Data Injec...
59974MatrixSSL TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59973Citrix Secure Gateway TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59972GnuTLS TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59971OpenSSL TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59970Mozilla Network Security Services (NSS) SSL / TLS Renegotiation Handshakes Mi...
59969Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext ...
59968Microsoft Multiple Products SSL / TLS Renegotiation Handshakes MiTM Plaintext...

Information Assurance Vulnerability Management (IAVM)

DateDescription
2012-05-03IAVM : 2012-B-0048 - Multiple Vulnerabilities in HP Systems Insight Manager
Severity : Category I - VMSKEY : V0032178
2012-04-05IAVM : 2012-B-0038 - Multiple Vulnerabilities in HP Onboard Administrator
Severity : Category I - VMSKEY : V0031972
2011-12-01IAVM : 2011-A-0160 - Multiple Vulnerabilities in VMware vCenter Server 4.0 and vCenter Update Mana...
Severity : Category I - VMSKEY : V0030769
2011-05-12IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products
Severity : Category I - VMSKEY : V0027158

Nessus® Vulnerability Scanner

DateDescription
2018-04-03Name : The remote web server may allow remote code execution.
File : iis_7_pci.nasl - Type : ACT_GATHER_INFO
2018-03-09Name : The remote web server is affected by multiple vulnerabilities.
File : nginx_0_7_64.nasl - Type : ACT_GATHER_INFO
2017-11-17Name : The remote host is affected by a MITM vulnerability.
File : fortios_FG-IR-17-137.nasl - Type : ACT_GATHER_INFO
2016-03-08Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0013_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0015_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0019_remote.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2011-0003_remote.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2011-0013_remote.nasl - Type : ACT_GATHER_INFO
2016-01-25Name : The remote Debian host is missing a security update.
File : debian_DLA-400.nasl - Type : ACT_GATHER_INFO
2015-05-11Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3253.nasl - Type : ACT_GATHER_INFO
2014-11-26Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2011-0015.nasl - Type : ACT_GATHER_INFO
2014-11-26Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0007.nasl - Type : ACT_GATHER_INFO
2014-11-26Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-10-10Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL10737.nasl - Type : ACT_GATHER_INFO
2014-06-30Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-32.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_compat-openssl097g-110721.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_gnutls-101025.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_java-1_6_0-openjdk-101103.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_4_compat-openssl097g-110721.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2014-04-16Name : The remote AIX host is running a vulnerable version of OpenSSL.
File : aix_ssl_advisory.nasl - Type : ACT_GATHER_INFO
2013-11-21Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201311-13.nasl - Type : ACT_GATHER_INFO
2013-09-25Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201309-15.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1579.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1580.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0162.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2010-0164.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0165.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0167.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0333.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0339.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0423.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0768.nasl - Type : ACT_GATHER_INFO
2013-06-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1579.nasl - Type : ACT_GATHER_INFO
2013-06-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1580.nasl - Type : ACT_GATHER_INFO
2013-02-22Name : The remote Unix host contains a runtime environment that is affected by multi...
File : oracle_java_cpu_mar_2010_unix.nasl - Type : ACT_GATHER_INFO
2013-02-22Name : The remote Unix host contains a programming platform that is affected by mult...
File : oracle_java_cpu_oct_2010_unix.nasl - Type : ACT_GATHER_INFO
2013-02-18Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2626.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0880.nasl - Type : ACT_GATHER_INFO
2013-01-08Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_gnutls_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_nss_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing a security update.
File : sl_20100325_openssl097a_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_openssl_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100331_java_1_6_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100331_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100518_krb5_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101013_java_1_6_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101014_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101110_java_1_6_0_openjdk_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20091111_httpd_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-06-25Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201206-18.nasl - Type : ACT_GATHER_INFO
2012-06-21Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201203-22.nasl - Type : ACT_GATHER_INFO
2012-06-15Name : The remote Windows host contains software that is affected by multiple vulner...
File : hp_systems_insight_manager_700_multiple_vulns.nasl - Type : ACT_GATHER_INFO
2012-05-17Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-7036.nasl - Type : ACT_GATHER_INFO
2012-01-24Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201201-13.nasl - Type : ACT_GATHER_INFO
2011-12-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-7645.nasl - Type : ACT_GATHER_INFO
2011-12-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-7440.nasl - Type : ACT_GATHER_INFO
2011-11-07Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201111-02.nasl - Type : ACT_GATHER_INFO
2011-10-28Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2011-0013.nasl - Type : ACT_GATHER_INFO
2011-10-12Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201110-05.nasl - Type : ACT_GATHER_INFO
2011-07-28Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_compat-openssl097g-110721.nasl - Type : ACT_GATHER_INFO
2011-07-28Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-7644.nasl - Type : ACT_GATHER_INFO
2011-05-13Name : The remote database server is affected by multiple vulnerabilities.
File : oracle_rdbms_cpu_apr_2011.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_gnutls-101025.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-openjdk-101103.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_1_gnutls-101025.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_1_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-openjdk-101103.nasl - Type : ACT_GATHER_INFO
2011-05-02Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12705.nasl - Type : ACT_GATHER_INFO
2011-03-17Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_mozilla-xulrunner190-100407.nasl - Type : ACT_GATHER_INFO
2011-03-17Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_MozillaFirefox-100407.nasl - Type : ACT_GATHER_INFO
2011-03-11Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_4_2-ibm-110223.nasl - Type : ACT_GATHER_INFO
2011-03-11Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12682.nasl - Type : ACT_GATHER_INFO
2011-03-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-7348.nasl - Type : ACT_GATHER_INFO
2011-02-14Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2011-0003.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_6_0-sun-7204.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gnutls-7299.nasl - Type : ACT_GATHER_INFO
2011-01-25Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-ibm-101220.nasl - Type : ACT_GATHER_INFO
2011-01-24Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12669.nasl - Type : ACT_GATHER_INFO
2011-01-21Name : The remote SuSE 11 host is missing a security update.
File : suse_11_java-1_4_2-ibm-100510.nasl - Type : ACT_GATHER_INFO
2011-01-21Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_4_2-ibm-101112.nasl - Type : ACT_GATHER_INFO
2011-01-18Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0152.nasl - Type : ACT_GATHER_INFO
2011-01-10Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2141.nasl - Type : ACT_GATHER_INFO
2010-12-17Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12658.nasl - Type : ACT_GATHER_INFO
2010-12-16Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2010-12-16Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0987.nasl - Type : ACT_GATHER_INFO
2010-12-08Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0019.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libfreebl3-100406.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libopenssl-devel-100331.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0935.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-sun-100331.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_mozilla-xulrunner190-100406.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_MozillaFirefox-100406.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_krb5-100520.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-7205.nasl - Type : ACT_GATHER_INFO
2010-12-01Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12659.nasl - Type : ACT_GATHER_INFO
2010-11-18Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0865.nasl - Type : ACT_GATHER_INFO
2010-11-18Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0873.nasl - Type : ACT_GATHER_INFO
2010-11-18Name : The remote database server is affected by multiple vulnerabilities.
File : oracle_rdbms_cpu_oct_2010.nasl - Type : ACT_GATHER_INFO
2010-11-16Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2010-0016.nasl - Type : ACT_GATHER_INFO
2010-10-29Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1010-1.nasl - Type : ACT_GATHER_INFO
2010-10-28Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0807.nasl - Type : ACT_GATHER_INFO
2010-10-22Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2010-10-22Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2010-10-22Name : The remote Fedora host is missing a security update.
File : fedora_2010-16240.nasl - Type : ACT_GATHER_INFO
2010-10-21Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0786.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote web server is affected by multiple vulnerabilities.
File : apache_2_0_64.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote web server is affected by multiple vulnerabilities
File : apache_2_2_15.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote host has a version of Java that is affected by multiple vulnerabil...
File : macosx_java_10_5_update8.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote host has a version of Java that is affected by multiple vulnerabil...
File : macosx_java_10_6_update3.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote Fedora host is missing a security update.
File : fedora_2010-16294.nasl - Type : ACT_GATHER_INFO
2010-10-18Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0768.nasl - Type : ACT_GATHER_INFO
2010-10-18Name : The remote Fedora host is missing a security update.
File : fedora_2010-16312.nasl - Type : ACT_GATHER_INFO
2010-10-15Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0770.nasl - Type : ACT_GATHER_INFO
2010-10-15Name : The remote Windows host contains a programming platform that is affected by m...
File : oracle_java_cpu_oct_2010.nasl - Type : ACT_GATHER_INFO
2010-10-14Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0768.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6655.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6944.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-6657.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_krb5-7046.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_mozilla-nss-6978.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-7077.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_mozilla-xulrunner190-6971.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-6979.nasl - Type : ACT_GATHER_INFO
2010-10-04Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0015.nasl - Type : ACT_GATHER_INFO
2010-09-22Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-990-1.nasl - Type : ACT_GATHER_INFO
2010-09-22Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-990-2.nasl - Type : ACT_GATHER_INFO
2010-09-17Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_6_2_0_12.nasl - Type : ACT_GATHER_INFO
2010-09-07Name : The remote database server is affected by multiple vulnerabilities.
File : db2_95fp6.nasl - Type : ACT_GATHER_INFO
2010-09-02Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0013.nasl - Type : ACT_GATHER_INFO
2010-08-11Name : It may be possible to execute arbitrary code on the remote Windows host using...
File : smb_nt_ms10-049.nasl - Type : ACT_GATHER_INFO
2010-07-26Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-927-6.nasl - Type : ACT_GATHER_INFO
2010-07-22Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-940-2.nasl - Type : ACT_GATHER_INFO
2010-07-07Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12623.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-5942.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6025.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6039.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6131.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6279.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2009-12747.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-8742.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-8749.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-8796.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-8805.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-9487.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-9518.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-3905.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-3929.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-3956.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-1127.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-5357.nasl - Type : ACT_GATHER_INFO
2010-06-30Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-927-4.nasl - Type : ACT_GATHER_INFO
2010-06-28Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_41166.nasl - Type : ACT_GATHER_INFO
2010-06-28Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_41167.nasl - Type : ACT_GATHER_INFO
2010-06-28Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_41168.nasl - Type : ACT_GATHER_INFO
2010-06-14Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0339.nasl - Type : ACT_GATHER_INFO
2010-06-11Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12621.nasl - Type : ACT_GATHER_INFO
2010-06-07Name : The remote Windows host has an application installed that is affected by mult...
File : openoffice_321.nasl - Type : ACT_GATHER_INFO
2010-06-04Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201006-18.nasl - Type : ACT_GATHER_INFO
2010-06-01Name : The remote database server is affected by multiple vulnerabilities.
File : db2_97fp2.nasl - Type : ACT_GATHER_INFO
2010-05-26Name : The remote openSUSE host is missing a security update.
File : suse_11_2_krb5-100521.nasl - Type : ACT_GATHER_INFO
2010-05-26Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2052.nasl - Type : ACT_GATHER_INFO
2010-05-26Name : The remote openSUSE host is missing a security update.
File : suse_11_1_krb5-100521.nasl - Type : ACT_GATHER_INFO
2010-05-26Name : The remote openSUSE host is missing a security update.
File : suse_11_0_krb5-100521.nasl - Type : ACT_GATHER_INFO
2010-05-24Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0423.nasl - Type : ACT_GATHER_INFO
2010-05-20Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-100.nasl - Type : ACT_GATHER_INFO
2010-05-20Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-940-1.nasl - Type : ACT_GATHER_INFO