RHEL 5 / 6:Red Hat Satellite IBM Java Runtime (RHSA-2015:0264) (POODLE)

low Nessus 插件 ID 81505

简介

远程 Red Hat 主机缺少一个或多个安全更新。

描述

更新后的 java-1.6.0-ibm 程序包修复了多个安全问题,现在可用于 Red Hat Satellite 5.6。

Red Hat 产品安全团队将此更新评级为具有低安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数,其给出了详细的严重性等级。

此更新修正 Red Hat Satellite 5.6 附带的 IBM Java Runtime Environment 中的多个安全漏洞。在典型的操作环境中,这些问题的安全风险较低,因为不受信任的小程序上不会使用运行时。

修复了 IBM Java 2 Runtime Environment 中的多个缺陷。
(CVE-2014-3065、CVE-2014-3068、CVE-2014-3566、CVE-2014-4209、CVE-2014-4218、CVE-2014-4219、CVE-2014-4227、CVE-2014-4244、CVE-2014-4252、CVE-2014-4262、CVE-2014-4263、CVE-2014-4265、CVE-2014-4288、CVE-2014-6457、CVE-2014-6458、CVE-2014-6492、CVE-2014-6493、CVE-2014-6502、CVE-2014-6503、CVE-2014-6506、CVE-2014-6511、CVE-2014-6512、CVE-2014-6515、CVE-2014-6531、CVE-2014-6532、CVE-2014-6558、CVE-2014-6585、CVE-2014-6587、CVE-2014-6591、CVE-2014-6593、CVE-2014-8891、CVE-2014-8892、CVE-2015-0395、CVE-2015-0403、CVE-2015-0406、CVE-2015-0407、CVE-2015-0408、CVE-2015-0410、CVE-2015-0412)

CVE-2014-4262 和 CVE-2014-6512 问题由 Red Hat 产品安全团队的 Florian Weimer 发现。

建议 Red Hat Satellite 5.6 的用户升级这些更新后的程序包,其中包含 IBM Java SE 6 SR16-FP3 版本。为使此更新生效,必须重新启动 Red Hat Satellite ('/usr/sbin/rhn-satellite restart') 以及所有正在运行的 IBM Java 实例。

解决方案

更新受影响的 java-1.6.0-ibm 和/或 java-1.6.0-ibm-devel 程序包。

另见

https://access.redhat.com/security/cve/cve-2014-8891

https://developer.ibm.com/javasdk/support/security-vulnerabilities/

https://access.redhat.com/errata/RHSA-2015:0264

https://access.redhat.com/security/cve/cve-2014-4262

https://access.redhat.com/security/cve/cve-2014-4263

https://access.redhat.com/security/cve/cve-2014-4252

https://access.redhat.com/security/cve/cve-2014-4244

https://access.redhat.com/security/cve/cve-2014-4219

https://access.redhat.com/security/cve/cve-2014-4218

https://access.redhat.com/security/cve/cve-2014-4209

https://access.redhat.com/security/cve/cve-2014-4265

https://access.redhat.com/security/cve/cve-2014-4227

https://access.redhat.com/security/cve/cve-2014-6502

https://access.redhat.com/security/cve/cve-2014-6457

https://access.redhat.com/security/cve/cve-2014-6506

https://access.redhat.com/security/cve/cve-2014-6531

https://access.redhat.com/security/cve/cve-2014-6558

https://access.redhat.com/security/cve/cve-2014-6511

https://access.redhat.com/security/cve/cve-2014-6512

https://access.redhat.com/security/cve/cve-2014-6503

https://access.redhat.com/security/cve/cve-2014-6532

https://access.redhat.com/security/cve/cve-2014-4288

https://access.redhat.com/security/cve/cve-2014-6458

https://access.redhat.com/security/cve/cve-2014-6493

https://access.redhat.com/security/cve/cve-2014-6492

https://access.redhat.com/security/cve/cve-2014-6515

https://access.redhat.com/security/cve/cve-2014-3566

https://access.redhat.com/security/cve/cve-2014-3065

https://access.redhat.com/security/cve/cve-2014-3068

https://access.redhat.com/security/cve/cve-2015-0406

https://access.redhat.com/security/cve/cve-2015-0403

https://access.redhat.com/security/cve/cve-2015-0408

https://access.redhat.com/security/cve/cve-2015-0407

https://access.redhat.com/security/cve/cve-2015-0395

https://access.redhat.com/security/cve/cve-2015-0410

https://access.redhat.com/security/cve/cve-2014-6591

https://access.redhat.com/security/cve/cve-2014-6593

https://access.redhat.com/security/cve/cve-2014-6587

https://access.redhat.com/security/cve/cve-2015-0412

https://access.redhat.com/security/cve/cve-2014-6585

https://access.redhat.com/security/cve/cve-2014-8892

插件详情

严重性: Low

ID: 81505

文件名: redhat-RHSA-2015-0264.nasl

版本: 1.27

类型: local

代理: unix

发布时间: 2015/2/25

最近更新时间: 2021/2/5

支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

风险信息

VPR

风险因素: Critical

分数: 9.8

CVSS v2

风险因素: Critical

基本分数: 10

时间分数: 7.8

矢量: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

风险因素: Low

基本分数: 3.4

时间分数: 3.1

矢量: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

时间矢量: CVSS:3.0/E:P/RL:O/RC:C

漏洞信息

CPE: p-cpe:/a:redhat:enterprise_linux:java-1.6.0-ibm, p-cpe:/a:redhat:enterprise_linux:java-1.6.0-ibm-devel, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:6

必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

可利用: true

易利用性: Exploits are available

补丁发布日期: 2015/2/24

漏洞发布日期: 2014/7/17

参考资料信息

CVE: CVE-2014-3065, CVE-2014-3068, CVE-2014-3566, CVE-2014-4209, CVE-2014-4218, CVE-2014-4219, CVE-2014-4227, CVE-2014-4244, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4265, CVE-2014-4288, CVE-2014-6457, CVE-2014-6458, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412

BID: 73258, 73259

RHSA: 2015:0264