Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0865
The remote host is missing updates announced in
advisory RHSA-2010:0865.

These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.

defaultReadObject of the Serialization API could be tricked into setting a
volatile field multiple times, which could allow a remote attacker to
execute arbitrary code with the privileges of the user running the applet
or application. (CVE-2010-3569)

Race condition in the way objects were deserialized could allow an
untrusted applet or application to misuse the privileges of the user
running the applet or application. (CVE-2010-3568)

Miscalculation in the OpenType font rendering implementation caused
out-of-bounds memory access, which could allow remote attackers to execute
code with the privileges of the user running the java process.

JPEGImageWriter.writeImage in the imageio API improperly checked certain
image metadata, which could allow a remote attacker to execute arbitrary
code in the context of the user running the applet or application.

Double free in IndexColorModel could cause an untrusted applet or
application to crash or, possibly, execute arbitrary code with the
privileges of the user running the applet or application. (CVE-2010-3562)

The privileged accept method of the ServerSocket class in the Common Object
Request Broker Architecture (CORBA) implementation in OpenJDK allowed it to
receive connections from any host, instead of just the host of the current
connection. An attacker could use this flaw to bypass restrictions defined
by network permissions. (CVE-2010-3561)

Flaws in the Swing library could allow an untrusted application to modify
the behavior and state of certain JDK classes. (CVE-2010-3557)

Flaws in the CORBA implementation could allow an attacker to execute
arbitrary code by misusing permissions granted to certain system objects.

UIDefault.ProxyLazyValue had unsafe reflection usage, allowing untrusted
callers to create objects via ProxyLazyValue values. (CVE-2010-3553)

HttpURLConnection improperly handled the chunked transfer encoding
method, which could allow remote attackers to conduct HTTP response
splitting attacks. (CVE-2010-3549)

HttpURLConnection improperly checked whether the calling code was granted
the allowHttpTrace permission, allowing untrusted code to create HTTP
TRACE requests. (CVE-2010-3574)

HttpURLConnection did not validate request headers set by applets, which
could allow remote attackers to trigger actions otherwise restricted to
HTTP clients. (CVE-2010-3541, CVE-2010-3573)

The Kerberos implementation improperly checked the sanity of AP-REQ
requests, which could cause a denial of service condition in the receiving
Java Virtual Machine. (CVE-2010-3564)

The java-1.6.0-openjdk packages shipped with the GA release of Red Hat
Enterprise Linux 6 mitigated a man-in-the-middle attack in the way the
TLS/SSL protocols handle session renegotiation by disabling renegotiation.
This update implements the TLS Renegotiation Indication Extension as
defined in RFC 5746, allowing secure renegotiation between updated clients
and servers. (CVE-2009-3555)

The NetworkInterface class improperly checked the network connect
permissions for local network addresses, which could allow remote attackers
to read local network addresses. (CVE-2010-3551)

Information leak flaw in the Java Naming and Directory Interface (JNDI)
could allow a remote attacker to access information about
otherwise-protected internal network names. (CVE-2010-3548)

Note: Flaws concerning applets in this advisory (CVE-2010-3568,
CVE-2010-3554, CVE-2009-3555, CVE-2010-3562, CVE-2010-3557, CVE-2010-3548,
CVE-2010-3564, CVE-2010-3565, CVE-2010-3569) can only be triggered in
OpenJDK by calling the appletviewer application.

Bug fixes:

* One defense in depth patch. (BZ#639922)

* Problems for certain SSL connections. In a reported case, this prevented
the JBoss JAAS modules from connecting over SSL to Microsoft Active
Directory servers. (BZ#642779)

Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

Risk factor : Critical

CVSS Score:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2009-3555
BugTraq ID: 36935
Bugtraq: 20091118 TLS / SSLv3 vulnerability explained (DRAFT) (Google Search)
Bugtraq: 20091124 rPSA-2009-0155-1 httpd mod_ssl (Google Search)
Bugtraq: 20091130 TLS / SSLv3 vulnerability explained (New ways to leverage the vulnerability) (Google Search)
Bugtraq: 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console (Google Search)
Bugtraq: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX (Google Search)
Bugtraq: 20131121 ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities (Google Search)
Cert/CC Advisory: TA10-222A
Cert/CC Advisory: TA10-287A
CERT/CC vulnerability note: VU#120541
Cisco Security Advisory: 20091109 Transport Layer Security Renegotiation Vulnerability
Debian Security Information: DSA-1934 (Google Search)
Debian Security Information: DSA-2141 (Google Search)
Debian Security Information: DSA-3253 (Google Search)
HPdes Security Advisory: HPSBGN02562
HPdes Security Advisory: HPSBHF02706
HPdes Security Advisory: HPSBHF03293
HPdes Security Advisory: HPSBMA02534
HPdes Security Advisory: HPSBMA02547
HPdes Security Advisory: HPSBMA02568
HPdes Security Advisory: HPSBMU02759
HPdes Security Advisory: HPSBMU02799
HPdes Security Advisory: HPSBOV02683
HPdes Security Advisory: HPSBOV02762
HPdes Security Advisory: HPSBUX02482
HPdes Security Advisory: HPSBUX02498
HPdes Security Advisory: HPSBUX02517
HPdes Security Advisory: HPSBUX02524
HPdes Security Advisory: SSRT090180
HPdes Security Advisory: SSRT090208
HPdes Security Advisory: SSRT090249
HPdes Security Advisory: SSRT090264
HPdes Security Advisory: SSRT100058
HPdes Security Advisory: SSRT100089
HPdes Security Advisory: SSRT100179
HPdes Security Advisory: SSRT100219
HPdes Security Advisory: SSRT100613
HPdes Security Advisory: SSRT100817
HPdes Security Advisory: SSRT100825
HPdes Security Advisory: SSRT101846
Microsoft Security Bulletin: MS10-049
OpenBSD Security Advisory: [4.5] 010: SECURITY FIX: November 26, 2009
OpenBSD Security Advisory: [4.6] 004: SECURITY FIX: November 26, 2009
SuSE Security Announcement: SUSE-SA:2009:057 (Google Search)
SuSE Security Announcement: SUSE-SA:2010:061 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:008 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:011 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:012 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:013 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:019 (Google Search)
SuSE Security Announcement: SUSE-SR:2010:024 (Google Search)
SuSE Security Announcement: SUSE-SU-2011:0847 (Google Search)
SuSE Security Announcement: openSUSE-SU-2011:0845 (Google Search)
XForce ISS Database: tls-renegotiation-weak-security(54158)
Common Vulnerability Exposure (CVE) ID: CVE-2010-3541
BugTraq ID: 44032
HPdes Security Advisory: HPSBUX02608
HPdes Security Advisory: SSRT100333
Common Vulnerability Exposure (CVE) ID: CVE-2010-3548
BugTraq ID: 44017
Common Vulnerability Exposure (CVE) ID: CVE-2010-3549
BugTraq ID: 44027
Common Vulnerability Exposure (CVE) ID: CVE-2010-3551
BugTraq ID: 44009
Common Vulnerability Exposure (CVE) ID: CVE-2010-3553
BugTraq ID: 44035
Common Vulnerability Exposure (CVE) ID: CVE-2010-3554
BugTraq ID: 43994
Common Vulnerability Exposure (CVE) ID: CVE-2010-3557
BugTraq ID: 44014
Common Vulnerability Exposure (CVE) ID: CVE-2010-3561
BugTraq ID: 44013
Common Vulnerability Exposure (CVE) ID: CVE-2010-3562
BugTraq ID: 43979
Common Vulnerability Exposure (CVE) ID: CVE-2010-3564
BugTraq ID: 43963
Common Vulnerability Exposure (CVE) ID: CVE-2010-3565
BugTraq ID: 43985
Common Vulnerability Exposure (CVE) ID: CVE-2010-3567
BugTraq ID: 43992
Common Vulnerability Exposure (CVE) ID: CVE-2010-3568
BugTraq ID: 44012
Common Vulnerability Exposure (CVE) ID: CVE-2010-3569
Common Vulnerability Exposure (CVE) ID: CVE-2010-3573
Common Vulnerability Exposure (CVE) ID: CVE-2010-3574
BugTraq ID: 44011
Common Vulnerability Exposure (CVE) ID: CVE-2010-3566
BugTraq ID: 43988
CopyrightCopyright (c) 2011 E-Soft Inc.

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.