ID CVE-2014-0878
Summary The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.
References
Vulnerable Configurations
  • IBM Java SDK Technology Edition 6.0.0.0
    cpe:2.3:a:ibm:java_sdk:6.0.0.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.1.0 (Service Refresh 1)
    cpe:2.3:a:ibm:java_sdk:6.0.1.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0..0 (Service Refresh 2)
    cpe:2.3:a:ibm:java_sdk:6.0.2.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.3.0 (Service Refresh 3)
    cpe:2.3:a:ibm:java_sdk:6.0.3.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.4.0 (Service Refresh 4)
    cpe:2.3:a:ibm:java_sdk:6.0.4.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.5.0 (Service Refresh 5)
    cpe:2.3:a:ibm:java_sdk:6.0.5.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.6.0 (Service Refresh 6)
    cpe:2.3:a:ibm:java_sdk:6.0.6.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.7.0 (Service Refresh 7)
    cpe:2.3:a:ibm:java_sdk:6.0.7.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.8.0 (Service Refresh 8)
    cpe:2.3:a:ibm:java_sdk:6.0.8.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.8.1 (Service Refresh 8 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:6.0.8.1:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.9.0 (Service Refresh 9)
    cpe:2.3:a:ibm:java_sdk:6.0.9.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.9.1 (Service Refresh 9 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:6.0.9.1:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.9.2 (Service Refresh 9 FixPack 2)
    cpe:2.3:a:ibm:java_sdk:6.0.9.2:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.10.0 (Service Refresh 10)
    cpe:2.3:a:ibm:java_sdk:6.0.10.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.10.1 (Service Refresh 10 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:6.0.10.1:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.11.0 (Service Refresh 11)
    cpe:2.3:a:ibm:java_sdk:6.0.11.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.12.0 (Service Refresh 12)
    cpe:2.3:a:ibm:java_sdk:6.0.12.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.13.0 (Service Refresh 13)
    cpe:2.3:a:ibm:java_sdk:6.0.13.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.13.1 (Service Refresh 13 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:6.0.13.1:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.13.2 (Service Refresh 13 FixPack 2)
    cpe:2.3:a:ibm:java_sdk:6.0.13.2:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.14.0 (Service Refresh 14)
    cpe:2.3:a:ibm:java_sdk:6.0.14.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.15.0 (Service Refresh 15)
    cpe:2.3:a:ibm:java_sdk:6.0.15.0:-:-:-:technology
  • IBM Java SDK Technology Edition 6.0.15.1 (Service Refresh 15 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:6.0.15.1:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.0.0
    cpe:2.3:a:ibm:java_sdk:5.0.0.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.11.0 (5.0 Service Refresh 11)
    cpe:2.3:a:ibm:java_sdk:5.0.11.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.11.1 (5.0 Service Refresh 11 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:5.0.11.1:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.11.2 (5.0 Service Refresh 11 FixPack 2)
    cpe:2.3:a:ibm:java_sdk:5.0.11.2:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.12.0 (5.0 Service Refresh 12)
    cpe:2.3:a:ibm:java_sdk:5.0.12.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.12.1 (5.0 Service Refresh 12 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:5.0.12.1:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.12.2 (5.0 Service Refresh 12 FixPack 2)
    cpe:2.3:a:ibm:java_sdk:5.0.12.2:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.12.3 (5.0 Service Refresh 12 FixPack 3)
    cpe:2.3:a:ibm:java_sdk:5.0.12.3:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.12.4 (5.0 Service Refresh 12 FixPack 4)
    cpe:2.3:a:ibm:java_sdk:5.0.12.4:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.12.5 (5.0 Service Refresh 12 FixPack 5)
    cpe:2.3:a:ibm:java_sdk:5.0.12.5:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.13.0 (5.0 Service Refresh 13)
    cpe:2.3:a:ibm:java_sdk:5.0.13.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.14.0 (5.0 Service Refresh 14)
    cpe:2.3:a:ibm:java_sdk:5.0.14.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.15.0 (5.0 Service Refresh 15)
    cpe:2.3:a:ibm:java_sdk:5.0.15.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.16.0 (5.0 Service Refresh 16)
    cpe:2.3:a:ibm:java_sdk:5.0.16.0:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.16.1 (5.0 Service Refresh 16 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:5.0.16.1:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.16.2 (5.0 Service Refresh 16 FixPack 2)
    cpe:2.3:a:ibm:java_sdk:5.0.16.2:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.16.3 (5.0 Service Refresh 16 FixPack 3)
    cpe:2.3:a:ibm:java_sdk:5.0.16.3:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.16.4 (5.0 Service Refresh 16 FixPack 4)
    cpe:2.3:a:ibm:java_sdk:5.0.16.4:-:-:-:technology
  • IBM Java SDK Technology Edition 5.0.16.5 (5.0 Service Refresh 16 FixPack 5)
    cpe:2.3:a:ibm:java_sdk:5.0.16.5:-:-:-:technology
  • IBM Java SDK Technology Edition 7.1.0.0 (7.1 Service Refresh 1)
    cpe:2.3:a:ibm:java_sdk:7.1.0.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.0.0 (7.0)
    cpe:2.3:a:ibm:java_sdk:7.0.0.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.1.0 (7.0 Service Refresh 1)
    cpe:2.3:a:ibm:java_sdk:7.0.1.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.2.0 (7.0 Service Refresh 2)
    cpe:2.3:a:ibm:java_sdk:7.0.2.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.3.0 (7.0 Service Refresh 3)
    cpe:2.3:a:ibm:java_sdk:7.0.3.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.4.0 (7.0 Service Refresh 4)
    cpe:2.3:a:ibm:java_sdk:7.0.4.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.4.1 (7.0 Service Refresh 4 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:7.0.4.1:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.4.2 (7.0 Service Refresh 4 FixPack 2)
    cpe:2.3:a:ibm:java_sdk:7.0.4.2:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.5.0 (7.0 Service Refresh 5)
    cpe:2.3:a:ibm:java_sdk:7.0.5.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.6.0 (7.0 Service Refresh 6)
    cpe:2.3:a:ibm:java_sdk:7.0.6.0:-:-:-:technology
  • IBM Java SDK Technology Edition 7.0.6.1 (7.0 Service Refresh 6 FixPack 1)
    cpe:2.3:a:ibm:java_sdk:7.0.6.1:-:-:-:technology
CVSS
Base: 5.8 (as of 31-12-2014 - 14:47)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
nessus via4
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-0509.NASL
    description Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0446, CVE-2014-0451, CVE-2014-2427, CVE-2014-2412, CVE-2014-0460, CVE-2013-6629, CVE-2014-2401, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876) All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR16-FP6 release. All running instances of IBM Java must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 74032
    published 2014-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74032
    title RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2014:0509)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2014-0732-1.NASL
    description IBM Java 5 was updated to SR 16 FP 6 to fix several bugs and security issues. Further information is available at: https://www.ibm.com/developerworks/java/jdk/aix/j532/fixes.html#SR16FP 6 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-11-02
    plugin id 83625
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83625
    title SUSE SLES10 Security Update : IBM Java 5 (SUSE-SU-2014:0732-1)
  • NASL family Web Servers
    NASL id WEBSPHERE_8_0_0_9.NASL
    description IBM WebSphere Application Server 8.0 prior to Fix Pack 9 is running on the remote host. It is, therefore, affected by the following vulnerabilities : - A cross-site scripting flaw exists within the Administration Console, where user input is improperly validated. This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser / server trust relationship. (CVE-2013-6323, PI04777 and PI04880) - A denial of service flaw exists within the Global Security Kit when handling SSLv2 resumption during the SSL/TLS handshake. This could allow a remote attacker to crash the program. (CVE-2013-6329, PI05309) - A buffer overflow flaw exists in the HTTP server with the mod_dav module when using add-ons. This could allow a remote attacker to cause a buffer overflow and a denial of service. (CVE-2013-6438, PI09345) - A cross-site scripting flaw exists within OAuth where user input is not properly validated. This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser / server trust relationship. (CVE-2013-6738, PI05661) - A denial of service flaw exists within the Global Security Kit when handling X.509 certificate chain during the initiation of a SSL/TLS connection. A remote attacker, using a malformed certificate chain, could cause the client or server to crash by hanging the Global Security Kit. (CVE-2013-6747, PI09443) - A denial of service flaw exists within the Apache Commons FileUpload when parsing a content-type header for a multipart request. A remote attacker, using a specially crafted request, could crash the program. (CVE-2014-0050, PI12648, PI12926 and PI13162) - A flaw exists in the Elliptic Curve Digital Signature Algorithm implementation which could allow a malicious process to recover ECDSA nonces. (CVE-2014-0076, PI19700) - A denial of service flaw exists in the 'mod_log_config' when logging a cookie with an unassigned value. A remote attacker, using a specially crafted request, can cause the program to crash. (CVE-2014-0098, PI13028) - An information disclosure flaw exists in the 'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding. This many allow a remote attacker to gain timing information intended to be protected by encryption. (CVE-2014-0453) - A flaw exists with 'com.sun.jndi.dns.DnsClient' related to the randomization of query IDs. This could allow a remote attacker to conduct spoofing attacks. (CVE-2014-0460) - A flaw exists in the Full and Liberty profiles. A remote attacker, using a specially crafted request, could gain access to arbitrary files. (CVE-2014-0823, PI05324) - An information disclosure flaw exists within the Administrative Console. This could allow a network attacker, using a specially crafted request, to gain privileged access. (CVE-2014-0857, PI07808) - A denial of service flaw exists in a web server plugin on servers configured to retry failed POST request. This could allow a remote attacker to crash the application. (CVE-2014-0859, PI08892) - An information disclosure flaw exists within Proxy and ODR servers. This could allow a remote attacker, using a specially crafted request, to gain access to potentially sensitive information. (CVE-2014-0891, PI09786) - A denial of service flaw exists within the IBM Security Access Manager for Web with the Reverse Proxy component. This could allow a remote attacker, using specially crafted TLS traffic, to cause the application on the system to become unresponsive. (CVE-2014-0963, PI17025) - An information disclosure flaw exists when handling SOAP responses. This could allow a remote attacker to potentially gain access to sensitive information. (CVE-2014-0965, PI11434) - An information disclosure flaw exists. A remote attacker, using a specially crafted URL, could gain access to potentially sensitive information. (CVE-2014-3022, PI09594)
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 76995
    published 2014-08-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76995
    title IBM WebSphere Application Server 8.0 < Fix Pack 9 Multiple Vulnerabilities
  • NASL family Web Servers
    NASL id WEBSPHERE_7_0_0_33.NASL
    description IBM WebSphere Application Server 7.0 prior to Fix Pack 33 is running on the remote host. It is, therefore, affected by the following vulnerabilities : - A cross-site scripting flaw exists within the Administration Console, where user input is improperly validated. This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser / server trust relationship. (CVE-2013-6323, PI04777 and PI04880) - A denial of service flaw exists within the Global Security Kit when handling SSLv2 resumption during the SSL/TLS handshake. This could allow a remote attacker to crash the program. (CVE-2013-6329, PI05309) - A buffer overflow flaw exists in the HTTP server with the mod_dav module when using add-ons. This could allow a remote attacker to cause a buffer overflow and a denial of service. (CVE-2013-6438, PI09345) - A cross-site scripting flaw exists within OAuth where user input is not properly validated. This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser / server trust relationship. (CVE-2013-6738, PI05661) - A denial of service flaw exists within the Global Security Kit when handling X.509 certificate chain during the initiation of an SSL/TLS connection. A remote attacker, using a malformed certificate chain, could cause the client or server to crash by hanging the Global Security Kit. (CVE-2013-6747, PI09443) - A denial of service flaw exists within the Apache Commons FileUpload when parsing a content-type header for a multipart request. A remote attacker, using a specially crafted request, could crash the program. (CVE-2014-0050, PI12648, PI12926 and PI13162) - A denial of service flaw exists in the 'mod_log_config' when logging a cookie with an unassigned value. A remote attacker, using a specially crafted request, can cause the program to crash. (CVE-2014-0098, PI13028) - A remote code execution flaw exists with Apache Struts. The failure to restrict setting of Class loader attributes could allow a remote attacker to execute arbitrary script code. (CVE-2014-0114, PI17190) - An information disclosure flaw exists in the 'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding. This many allow a remote attacker to gain timing information intended to be protected by encryption. (CVE-2014-0453) - A flaw exists within 'com.sun.jndi.dns.DnsClient' related to the randomization of query IDs. This could allow a remote attacker to conduct spoofing attacks. (CVE-2014-0460) - A denial of service flaw exists in a web server plugin on servers configured to retry failed POST request. This could allow a remote attacker to crash the application. (CVE-2014-0859, PI08892) - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom' cryptographic providers by generating numbers in a predictable manner. This could allow a remote attacker to easily guess the output of the random number generator. (CVE-2014-0878) - An information disclosure flaw exists within Proxy and ODR servers. This could allow a remote attacker, using a specially crafted request, to gain access to potentially sensitive information. (CVE-2014-0891, PI09786) - A denial of service flaw exists within the IBM Security Access Manager for Web with the Reverse Proxy component. This could allow a remote attacker, using specially crafted TLS traffic, to cause the application on the system to become unresponsive. (CVE-2014-0963, PI17025) - An information disclosure flaw exists when handling SOAP responses. This could allow a remote attacker to potentially gain access to sensitive information. (CVE-2014-0965, PI11434) - An information disclosure flaw exists. A remote attacker, using a specially crafted URL, could gain access to potentially sensitive information. (CVE-2014-3022, PI09594)
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 76967
    published 2014-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76967
    title IBM WebSphere Application Server 7.0 < Fix Pack 33 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_JAVA-1_7_0-IBM-140515.NASL
    description IBM Java 7 was updated to version SR7, which received security and bug fixes. More information is available at: http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64.fixes.htm l#SR7
    last seen 2019-02-21
    modified 2015-01-28
    plugin id 74254
    published 2014-06-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74254
    title SuSE 11.3 Security Update : IBM Java 7 (SAT Patch Number 9263)
  • NASL family AIX Local Security Checks
    NASL id AIX_JAVA_APR2014_ADVISORY.NASL
    description The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities : - There is an information disclosure flaw in libjpeg and libjpeg-turbo allowing remote attackers access to uninitialized memory via crafted JPEG images. (CVE-2013-6629) - A vulnerability in libpng allows denial of service attacks via a flaw in pngtran.c pngset.c. (CVE-2013-6954) - Vulnerabilities in Oracle Java allow remote code execution via flaws in 2D image handling. (CVE-2014-0429, CVE-2014-2401, CVE-2014-2421) - A vulnerability in Oracle Java allows remote code execution via a flaw in logger handling. (CVE-2014-0446) - Vulnerabilities in Oracle Java allow remote code execution via flaws in the Deployment subcomponent. (CVE-2014-0448, CVE-2014-0449, CVE-2014-2409, CVE-2014-2420, CVE-2014-2428) - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in AWT. (CVE-2014-0451, CVE-2014-2412) - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in W3CEndpointReference.java. (CVE-2014-0452) - An information disclosure vulnerability in Oracle Java RSAPadding allows a remote attacker to view timing information protected by encryption. (CVE-2014-0452) - A vulnerability in Oracle Java allows a remote attacker to modify the SIGNATURE_PRIMITIVE_SET through flaws in SignatureAndHalshAlgorithm and AlgorithmChecker. (CVE-2014-0454) - A vulnerability in Oracle Java allows remote code execution via a flaw in MethodHandles.java. (CVE-2014-0455) - A vulnerability in Oracle Java allows remote code execution via a flaw in exception handling. (CVE-2014-0457) - Vulnerabilities in Oracle Java allow a remote attacker to bypass security features through flaws in JAX-WS. (CVE-2014-0458, CVE-2014-2423) - An unspecified vulnerability exists in Oracle Java via sandboxed applications. (CVE-2014-0459) - A vulnerability in Oracle Java allows remote attackers to conduct spoofing attacks via a flaw in the DnsClient component. (CVE-2014-0460) - A vulnerability in Oracle Java allows remote code execution via a flaw in ScriptEngineManager.java. (CVE-2014-0461) - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in the random number generation of cryptographic protection. (CVE-2014-0878) - A privilege escalation vulnerability in Oracle Java allows remote attacks to overwrite arbitrary files via a flaw in unpack200. (CVE-2014-1876) - A vulnerability in Oracle Java allows remote code execution via a flaw in Javadoc. (CVE-2014-2398) - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in asynchronous channel handling across threads. (CVE-2014-2402) - Vulnerabilities in Oracle Java allow a remote attacker to bypass security features through flaws in JAXB. (CVE-2014-2414) - A vulnerability in Oracle Java allows a remote attacker to bypass security features through flaws in Java sound libraries. (CVE-2014-2427)
    last seen 2019-02-21
    modified 2018-07-17
    plugin id 76870
    published 2014-07-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76870
    title AIX Java Advisory : java_apr2014_advisory.asc
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-0982.NASL
    description Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4, 5.5, and 5.6. The Red Hat Security Response Team has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4, 5.5, and 5.6. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. Several flaws were fixed in the IBM Java 2 Runtime Environment. (CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0457, CVE-2014-0458, CVE-2014-0460, CVE-2014-0461, CVE-2014-0878, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) Users of Red Hat Network Satellite Server 5.4, 5.5, and 5.6 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR16 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 79039
    published 2014-11-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79039
    title RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2014:0982)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-0508.NASL
    description Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0461, CVE-2014-2428, CVE-2014-0446, CVE-2014-0452, CVE-2014-0451, CVE-2014-2423, CVE-2014-2427, CVE-2014-0458, CVE-2014-2414, CVE-2014-2412, CVE-2014-2409, CVE-2014-0460, CVE-2013-6954, CVE-2013-6629, CVE-2014-2401, CVE-2014-0449, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876, CVE-2014-2420) All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 74031
    published 2014-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74031
    title RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2014:0508)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-0486.NASL
    description Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0461, CVE-2014-0455, CVE-2014-2428, CVE-2014-0448, CVE-2014-0454, CVE-2014-0446, CVE-2014-0452, CVE-2014-0451, CVE-2014-2402, CVE-2014-2423, CVE-2014-2427, CVE-2014-0458, CVE-2014-2414, CVE-2014-2412, CVE-2014-2409, CVE-2014-0460, CVE-2013-6954, CVE-2013-6629, CVE-2014-2401, CVE-2014-0449, CVE-2014-0459, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876, CVE-2014-2420) All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR7 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 74005
    published 2014-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74005
    title RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2014:0486)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_JAVA-1_6_0-IBM-140514.NASL
    description BM Java 6 was updated to version 6 SR16 to fix several security issues and various other bugs. More information can be found at: http://www.ibm.com/developerworks/java/jdk/alerts/
    last seen 2019-02-21
    modified 2015-01-28
    plugin id 74284
    published 2014-06-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74284
    title SuSE 11.3 Security Update : IBM Java 6 (SAT Patch Number 9256)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-0705.NASL
    description Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 7 Supplementary. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR1 release. All running instances of IBM Java must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 76900
    published 2014-07-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76900
    title RHEL 7 : java-1.7.1-ibm (RHSA-2014:0705)
redhat via4
rpms
  • java-1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el5_10
  • java-1.7.0-ibm-demo-1:1.7.0.7.0-1jpp.1.el5_10
  • java-1.7.0-ibm-devel-1:1.7.0.7.0-1jpp.1.el5_10
  • java-1.7.0-ibm-jdbc-1:1.7.0.7.0-1jpp.1.el5_10
  • java-1.7.0-ibm-plugin-1:1.7.0.7.0-1jpp.1.el5_10
  • java-1.7.0-ibm-src-1:1.7.0.7.0-1jpp.1.el5_10
  • java-1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el6_5
  • java-1.7.0-ibm-demo-1:1.7.0.7.0-1jpp.1.el6_5
  • java-1.7.0-ibm-devel-1:1.7.0.7.0-1jpp.1.el6_5
  • java-1.7.0-ibm-jdbc-1:1.7.0.7.0-1jpp.1.el6_5
  • java-1.7.0-ibm-plugin-1:1.7.0.7.0-1jpp.1.el6_5
  • java-1.7.0-ibm-src-1:1.7.0.7.0-1jpp.1.el6_5
  • java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-demo-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-devel-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-plugin-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-src-1:1.6.0.16.0-1jpp.1.el5_10
  • java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.6.0-ibm-demo-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.6.0-ibm-devel-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.6.0-ibm-plugin-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.6.0-ibm-src-1:1.6.0.16.0-1jpp.1.el6_5
  • java-1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-accessibility-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-demo-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-devel-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-javacomm-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-jdbc-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-plugin-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-src-1:1.5.0.16.6-1jpp.1.el5_10
  • java-1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el6_5
  • java-1.5.0-ibm-demo-1:1.5.0.16.6-1jpp.1.el6_5
  • java-1.5.0-ibm-devel-1:1.5.0.16.6-1jpp.1.el6_5
  • java-1.5.0-ibm-javacomm-1:1.5.0.16.6-1jpp.1.el6_5
  • java-1.5.0-ibm-jdbc-1:1.5.0.16.6-1jpp.1.el6_5
  • java-1.5.0-ibm-plugin-1:1.5.0.16.6-1jpp.1.el6_5
  • java-1.5.0-ibm-src-1:1.5.0.16.6-1jpp.1.el6_5
refmap via4
bid 67601
confirm
secunia
  • 59022
  • 59023
  • 59058
  • 61264
xf ibm-java-cve20140878-weak-sec(91084)
Last major update 06-01-2017 - 21:59
Published 26-05-2014 - 15:55
Last modified 28-08-2017 - 21:34
Back to Top