Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.870642
Category:Red Hat Local Security Checks
Title:RedHat Update for eclipse RHSA-2011:0568-01
Summary:The remote host is missing an update for the 'eclipse'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'eclipse'
package(s) announced via the referenced advisory.

Vulnerability Insight:
The Eclipse software development environment provides a set of tools for
C/C++ and Java development.

A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents
web application. An attacker could use this flaw to perform a cross-site
scripting attack against victims by tricking them into visiting a
specially-crafted Eclipse Help URL. (CVE-2010-4647)

The following Eclipse packages have been upgraded to the versions found in
the official upstream Eclipse Helios SR1 release, providing a number of
bug fixes and enhancements over the previous versions:

* eclipse to 3.6.1. (BZ#656329)

* eclipse-cdt to 7.0.1. (BZ#656333)

* eclipse-birt to 2.6.0. (BZ#656391)

* eclipse-emf to 2.6.0. (BZ#656344)

* eclipse-gef to 3.6.1. (BZ#656347)

* eclipse-mylyn to 3.4.2. (BZ#656337)

* eclipse-rse to 3.2. (BZ#656338)

* eclipse-dtp to 1.8.1. (BZ#656397)

* eclipse-changelog to 2.7.0. (BZ#669499)

* eclipse-valgrind to 0.6.1. (BZ#669460)

* eclipse-callgraph to 0.6.1. (BZ#669462)

* eclipse-oprofile to 0.6.1. (BZ#670228)

* eclipse-linuxprofilingframework to 0.6.1. (BZ#669461)

In addition, the following updates were made to the dependencies of the
Eclipse packages above:

* icu4j to 4.2.1. (BZ#656342)

* sat4j to 2.2.0. (BZ#661842)

* objectweb-asm to 3.2. (BZ#664019)

* jetty-eclipse to 6.1.24. (BZ#661845)

This update includes numerous upstream bug fixes and enhancements, such as:

* The Eclipse IDE and Java Development Tools (JDT):

- - projects and folders can filter out resources in the workspace.

- - new virtual folder and linked files support.

- - the full set of UNIX file permissions is now supported.

- - addition of the stop button to cancel long-running wizard tasks.

- - Java editor now shows multiple quick-fixes via problem hover.

- - new support for running JUnit version 4 tests.

- - over 200 upstream bug fixes.

* The Eclipse C/C++ Development Tooling (CDT):

- - new Codan framework has been added for static code analysis.

- - refactoring improvements such as stored refactoring history.

- - compile and build errors now highlighted in the build console.

- - switch to the new DSF debugger framework.

- - new template view support.

- - over 600 upstream bug fixes.

This update also fixes the following bugs:

* Incorrect URIs for GNU Tools in the 'Help Contents' window have been
fixed. (BZ#622713)

* The profiling of binaries did not work if an Eclipse project was not in
an Eclipse workspace. This up ...

Description truncated, please see the referenced URL(s) for more information.

Affected Software/OS:
eclipse on Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Workstation (v. 6)

Solution:
Please Install the Updated Packages.

CVSS Score:
4.3

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-4647
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052532.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052554.html
http://www.mandriva.com/security/advisories?name=MDVSA-2011:032
http://yehg.net/lab/pr0js/advisories/eclipse/[eclipse_help_server]_cross_site_scripting
https://bugs.eclipse.org/bugs/show_bug.cgi?id=329582
http://openwall.com/lists/oss-security/2011/01/06/7
http://openwall.com/lists/oss-security/2011/01/06/16
http://www.redhat.com/support/errata/RHSA-2011-0568.html
XForce ISS Database: eclipseide-querystring-xss(64833)
https://exchange.xforce.ibmcloud.com/vulnerabilities/64833
CopyrightCopyright (c) 2012 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.