Test ID:	1.3.6.1.4.1.25623.1.0.841127
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-1505-2)
Summary:	The remote host is missing an update for the 'icedtea-web' package(s) announced via the USN-1505-2 advisory.
Description:	Summary: The remote host is missing an update for the 'icedtea-web' package(s) announced via the USN-1505-2 advisory. Vulnerability Insight: USN-1505-1 fixed vulnerabilities in OpenJDK 6. As part of the update, IcedTea-Web packages were upgraded to a new version. That upgrade introduced a regression which prevented the IcedTea-Web plugin from working with the Chromium web browser in Ubuntu 11.04 and Ubuntu 11.10. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that multiple flaws existed in the CORBA (Common Object Request Broker Architecture) implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711, CVE-2012-1719) It was discovered that multiple flaws existed in the OpenJDK font manager's layout lookup implementation. A attacker could specially craft a font file that could cause a denial of service through crashing the JVM (Java Virtual Machine) or possibly execute arbitrary code. (CVE-2012-1713) It was discovered that the SynthLookAndFeel class from Swing in OpenJDK did not properly prevent access to certain UI elements from outside the current application context. An attacker could create a Java application or applet that used this flaw to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1716) It was discovered that OpenJDK runtime library classes could create temporary files with insecure permissions. A local attacker could use this to gain access to sensitive information. (CVE-2012-1717) It was discovered that OpenJDK did not handle CRLs (Certificate Revocation Lists) properly. A remote attacker could use this to gain access to sensitive information. (CVE-2012-1718) It was discovered that the OpenJDK HotSpot Virtual Machine did not properly verify the bytecode of the class to be executed. A remote attacker could create a Java application or applet that used this to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1723, CVE-2012-1725) It was discovered that the OpenJDK XML (Extensible Markup Language) parser did not properly handle some XML documents. An attacker could create an XML document that caused a denial of service in a Java application or applet parsing the document. (CVE-2012-1724) As part of this update, the IcedTea web browser applet plugin was updated for Ubuntu 10.04 LTS, Ubuntu 11.04, and Ubuntu 11.10. Affected Software/OS: 'icedtea-web' package(s) on Ubuntu 11.04, Ubuntu 11.10. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1711 BugTraq ID: 53949 http://www.securityfocus.com/bid/53949 http://security.gentoo.org/glsa/glsa-201406-32.xml HPdes Security Advisory: HPSBUX02805 http://marc.info/?l=bugtraq&m=134496371727681&w=2 HPdes Security Advisory: SSRT100919 http://www.mandriva.com/security/advisories?name=MDVSA-2012:095 http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15996 RedHat Security Advisories: RHSA-2012:0734 http://rhn.redhat.com/errata/RHSA-2012-0734.html Common Vulnerability Exposure (CVE) ID: CVE-2012-1713 BugTraq ID: 53946 http://www.securityfocus.com/bid/53946 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16502 RedHat Security Advisories: RHSA-2012:1243 http://rhn.redhat.com/errata/RHSA-2012-1243.html RedHat Security Advisories: RHSA-2013:1455 http://rhn.redhat.com/errata/RHSA-2013-1455.html RedHat Security Advisories: RHSA-2013:1456 http://rhn.redhat.com/errata/RHSA-2013-1456.html http://secunia.com/advisories/50659 http://secunia.com/advisories/51080 SuSE Security Announcement: SUSE-SU-2012:1177 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00020.html SuSE Security Announcement: SUSE-SU-2012:1204 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00028.html SuSE Security Announcement: SUSE-SU-2012:1231 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html SuSE Security Announcement: SUSE-SU-2012:1265 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00035.html Common Vulnerability Exposure (CVE) ID: CVE-2012-1716 BugTraq ID: 53947 http://www.securityfocus.com/bid/53947 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16168 Common Vulnerability Exposure (CVE) ID: CVE-2012-1717 BugTraq ID: 53952 http://www.securityfocus.com/bid/53952 Common Vulnerability Exposure (CVE) ID: CVE-2012-1718 BugTraq ID: 53951 http://www.securityfocus.com/bid/53951 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15923 RedHat Security Advisories: RHSA-2012:1467 http://rhn.redhat.com/errata/RHSA-2012-1467.html http://secunia.com/advisories/51326 Common Vulnerability Exposure (CVE) ID: CVE-2012-1719 BugTraq ID: 53950 http://www.securityfocus.com/bid/53950 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16312 Common Vulnerability Exposure (CVE) ID: CVE-2012-1723 BugTraq ID: 53960 http://www.securityfocus.com/bid/53960 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16259 Common Vulnerability Exposure (CVE) ID: CVE-2012-1724 BugTraq ID: 53958 http://www.securityfocus.com/bid/53958 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16659 Common Vulnerability Exposure (CVE) ID: CVE-2012-1725 BugTraq ID: 53954 http://www.securityfocus.com/bid/53954 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16513
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.