ID de Prueba:	1.3.6.1.4.1.25623.1.0.881623
Categoría:	CentOS Local Security Checks
Título:	CentOS Update for java CESA-2013:0603 centos5
Resumen:	The remote host is missing an update for the 'java'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'java' package(s) announced via the referenced advisory. Vulnerability Insight: These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit. An integer overflow flaw was found in the way the 2D component handled certain sample model instances. A specially-crafted sample model instance could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges. (CVE-2013-0809) It was discovered that the 2D component did not properly reject certain malformed images. Specially-crafted raster parameters could cause Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with virtual machine privileges. (CVE-2013-1493) This erratum also upgrades the OpenJDK package to IcedTea7 2.3.8. Refer to the NEWS file, linked to in the References, for further information. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Affected Software/OS: java on CentOS 5 Solution: Please install the updated packages. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0809 BugTraq ID: 58296 http://www.securityfocus.com/bid/58296 Cert/CC Advisory: TA13-064A http://www.us-cert.gov/ncas/alerts/TA13-064A CERT/CC vulnerability note: VU#688246 http://www.kb.cert.org/vuls/id/688246 http://security.gentoo.org/glsa/glsa-201406-32.xml HPdes Security Advisory: HPSBUX02857 http://marc.info/?l=bugtraq&m=136439120408139&w=2 HPdes Security Advisory: HPSBUX02864 http://marc.info/?l=bugtraq&m=136570436423916&w=2 HPdes Security Advisory: SSRT101103 HPdes Security Advisory: SSRT101156 http://www.mandriva.com/security/advisories?name=MDVSA-2013:095 http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-March/022145.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19076 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19320 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19479 RedHat Security Advisories: RHSA-2013:0601 http://rhn.redhat.com/errata/RHSA-2013-0601.html RedHat Security Advisories: RHSA-2013:0603 http://rhn.redhat.com/errata/RHSA-2013-0603.html RedHat Security Advisories: RHSA-2013:0604 http://rhn.redhat.com/errata/RHSA-2013-0604.html RedHat Security Advisories: RHSA-2013:1455 http://rhn.redhat.com/errata/RHSA-2013-1455.html RedHat Security Advisories: RHSA-2013:1456 http://rhn.redhat.com/errata/RHSA-2013-1456.html SuSE Security Announcement: SUSE-SU-2013:0434 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00011.html SuSE Security Announcement: SUSE-SU-2013:0701 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html SuSE Security Announcement: openSUSE-SU-2013:0430 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00009.html SuSE Security Announcement: openSUSE-SU-2013:0438 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00012.html http://www.ubuntu.com/usn/USN-1755-2 Common Vulnerability Exposure (CVE) ID: CVE-2013-1493 BugTraq ID: 58238 http://www.securityfocus.com/bid/58238 http://www.exploit-db.com/exploits/24904 HPdes Security Advisory: HPSBMU02964 http://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04117626-1 http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html http://www.symantec.com/connect/blogs/latest-java-zero-day-shares-connections-bit9-security-incident https://krebsonsecurity.com/2013/03/new-java-0-day-attack-echoes-bit9-breach/ https://twitter.com/jduck1337/status/307629902574800897 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19246 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19477 http://www.securitytracker.com/id/1029803
Copyright	Copyright (c) 2013 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.