Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).

The version of IBM Java installed on the remote host is prior to 6.0 < 6.0.16.41 / 6.1 < 6.1.8.41 / 7.0 < 7.0.10.1 / 7.1 < 7.1.4.1 / 8.0 < 8.0.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 17 2017 CPU advisory.

  - The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and     products, have a birthday bound of approximately four billion blocks, which makes it easier for remote     attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as     demonstrated by an HTTPS session using Triple DES in CBC mode, aka a Sweet32 attack. (CVE-2016-2183)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded:
    8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2016-5546)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2016-5547)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). (CVE-2016-5548)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). (CVE-2016-5549)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded:
    8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE     Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2016-5552)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2017-3231, CVE-2017-3261)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in     Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful     attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2017-3241)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAAS).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Difficult to exploit vulnerability allows low privileged attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE     Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2017-3252)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2017-3253)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions     that are affected are Java SE: 6u131, 7u121 and 8u112. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2017-3259)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are     affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2017-3260)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2017-3272)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).
    Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2017-3289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjre package has been released.

An update of the openjdk package has been released.

The remote host is affected by the vulnerability described in GLSA-201707-01 (IcedTea: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in IcedTea. Please review       the CVE identifiers referenced below for details.
    Note: If the web browser plug-in provided by the dev-java/icedtea-web       package was installed, the issues exposed via Java applets could have       been exploited without user interaction if a user visited a malicious       website.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, gain access to information, or cause a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for java-1_7_0-openjdk fixes the following issues :

  - Oracle Critical Patch Update of January 2017 to OpenJDK     7u131 (bsc#1020905) :

  - Security Fixes

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvments

  - S8168724, CVE-2016-5549: ECDSA signing improvments

  - S6253144: Long narrowing conversion should describe the     algorithm used and implied 'risks'

  - S6328537: Improve javadocs for Socket class by adding     references to SocketOptions

  - S6978886: javadoc shows stacktrace after print error     resulting from disk full

  - S6995421: Eliminate the static dependency to     sun.security.ec.ECKeyFactory

  - S6996372: synchronizing handshaking hash

  - S7027045: (doc) java/awt/Window.java has several typos     in javadoc

  - S7054969: Null-check-in-finally pattern in java/security     documentation

  - S7072353: JNDI libraries do not build with javac
    -Xlint:all -Werror

  - S7075563: Broken link in 'javax.swing.SwingWorker'

  - S7077672: jdk8_tl nightly fail in step-2 build on     8/10/11

  - S7088502: Security libraries don't build with javac
    -Werror

  - S7092447: Clarify the default locale used in each locale     sensitive operation

  - S7093640: Enable client-side TLS 1.2 by default

  - S7103570: AtomicIntegerFieldUpdater does not work when     SecurityManager is installed

  - S7117360: Warnings in java.util.concurrent.atomic     package

  - S7117465: Warning cleanup for IMF classes

  - S7187144: JavaDoc for ScriptEngineFactory.getProgram()     contains an error

  - S8000418: javadoc should used a standard 'generated by     javadoc' string

  - S8000666: javadoc should write directly to Writer     instead of composing strings

  - S8000673: remove dead code from HtmlWriter and subtypes

  - S8000970: break out auxiliary classes that will prevent     multi-core compilation of the JDK

  - S8001669: javadoc internal DocletAbortException should     set cause when appropriate

  - S8008949: javadoc stopped copying doc-files

  - S8011402: Move blacklisting certificate logic from hard     code to data

  - S8011547: Update XML Signature implementation to Apache     Santuario 1.5.4

  - S8012288: XML DSig API allows wrong tag names and extra     elements in SignedInfo

  - S8016217: More javadoc warnings

  - S8017325: Cleanup of the javadoc <code> tag in     java.security.cert

  - S8017326: Cleanup of the javadoc <code> tag in     java.security.spec

  - S8019772: Fix doclint issues in javax.crypto and     javax.security subpackages

  - S8020557: javadoc cleanup in javax.security

  - S8020688: Broken links in documentation at     http://docs.oracle.com/javase/6/docs/api/index.

  - S8021108: Clean up doclint warnings and errors in     java.text package

  - S8021417: Fix doclint issues in java.util.concurrent

  - S8021833: javadoc cleanup in java.net

  - S8022120: JCK test     api/javax_xml/crypto/dsig/TransformService/index_ParamMe     thods fails

  - S8022175: Fix doclint warnings in javax.print

  - S8022406: Fix doclint issues in java.beans

  - S8022746: List of spelling errors in API doc

  - S8024779: [macosx] SwingNode crashes on exit

  - S8025085: [javadoc] some errors in javax/swing

  - S8025218: [javadoc] some errors in java/awt classes

  - S8025249: [javadoc] fix some javadoc errors in     javax/swing/

  - S8025409: Fix javadoc comments errors and warning     reported by doclint report

  - S8026021: more fix of javadoc errors and warnings     reported by doclint, see the description

  - S8037099: [macosx] Remove all references to GC from     native OBJ-C code

  - S8038184: XMLSignature throws     StringIndexOutOfBoundsException if ID attribute value is     empty String

  - S8038349: Signing XML with DSA throws Exception when key     is larger than 1024 bits

  - S8049244: XML Signature performance issue caused by     unbuffered signature data

  - S8049432: New tests for TLS property     jdk.tls.client.protocols

  - S8050893: (smartcardio) Invert reset argument in tests     in sun/security/smartcardio

  - S8059212: Modify regression tests so that they do not     just fail if no cardreader found

  - S8068279: (typo in the spec)     javax.script.ScriptEngineFactory.getLanguageName

  - S8068491: Update the protocol for references of     docs.oracle.com to HTTPS.

  - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java     needs to be updated for JDK-8061210

  - S8076369: Introduce the jdk.tls.client.protocols system     property for JDK 7u

  - S8139565: Restrict certificates with DSA keys less than     1024 bits

  - S8140422: Add mechanism to allow non default root CAs to     be not subject to algorithm restrictions

  - S8140587: Atomic*FieldUpdaters should use     Class.isInstance instead of direct class check

  - S8143959: Certificates requiring blacklisting

  - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks

  - S8148516: Improve the default strength of EC in JDK

  - S8149029: Secure validation of XML based digital     signature always enabled when checking wrapping attacks

  - S8151893: Add security property to configure XML     Signature secure validation mode

  - S8155760: Implement Serialization Filtering

  - S8156802: Better constraint checking

  - S8161228: URL objects with custom protocol handlers have     port changed after deserializing

  - S8161571: Verifying ECDSA signatures permits trailing     bytes

  - S8163304: jarsigner -verbose -verify should print the     algorithms used to sign the jar

  - S8164908: ReflectionFactory support for IIOP and custom     serialization

  - S8165230: RMIConnection addNotificationListeners failing     with specific inputs

  - S8166393: disabledAlgorithms property should not be     strictly parsed

  - S8166591: [macos 10.12] Trackpad scrolling of text on OS     X 10.12 Sierra is very fast (Trackpad, Retina only)

  - S8166739: Improve extensibility of ObjectInputFilter     information passed to the filter

  - S8166875: (tz) Support tzdata2016g

  - S8166878: Connection reset during TLS handshake

  - S8167356: Follow up fix for jdk8 backport of 8164143.
    Changes for CMenuComponent.m were missed

  - S8167459: Add debug output for indicating if a chosen     ciphersuite was legacy

  - S8167472: Chrome interop regression with JDK-8148516

  - S8167591: Add MD5 to signed JAR restrictions

  - S8168861: AnchorCertificates uses hard-coded password     for cacerts keystore

  - S8168993: JDK8u121 L10n resource file update

  - S8169191: (tz) Support tzdata2016i

  - S8169688: Backout (remove) MD5 from     jdk.jar.disabledAlgorithms for January CPU

  - S8169911: Enhanced tests for jarsigner -verbose -verify     after JDK-8163304

  - S8170131: Certificates not being blocked by     jdk.tls.disabledAlgorithms property

  - S8170268: 8u121 L10n resource file update - msgdrop 20

  - S8173622: Backport of 7180907 is incomplete

  - S8173849: Fix use of java.util.Base64 in test cases

  - S8173854: [TEST] Update DHEKeySizing test case following     8076328 & 8081760

  - CVE-2017-3259 Vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE.

  - Backports

  - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef     on __APPLE__and _LLP64 systems.

  - S8000351, PR3316, RH1390708: Tenuring threshold should     be unsigned

  - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never     deleted when processing invokeMethod command

  - S8170888, PR3316, RH1390708: [linux] support for cgroup     memory limits in container (ie Docker) environments

  - Bug fixes

  - PR3318: Replace 'infinality' with 'improved font     rendering' (--enable-improved-font-rendering)

  - PR3318: Fix compatibility with vanilla Fontconfig

  - PR3318: Fix glyph y advance

  - PR3318: Always round glyph advance in 26.6 space

  - PR3318: Simplify glyph advance handling

  - PR3324: Fix NSS_LIBDIR substitution in     make_generic_profile.sh broken by PR1989

  - AArch64 port

  - S8165673, PR3320: AArch64: Fix JNI floating point     argument handling</code></code>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk fixes the following issues :

  - Oracle Critical Patch Update of January 2017 to OpenJDK     7u131 (bsc#1020905) :

  - Security Fixes

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvments

  - S8168724, CVE-2016-5549: ECDSA signing improvments

  - S6253144: Long narrowing conversion should describe the     algorithm used and implied 'risks'

  - S6328537: Improve javadocs for Socket class by adding     references to SocketOptions

  - S6978886: javadoc shows stacktrace after print error     resulting from disk full

  - S6995421: Eliminate the static dependency to     sun.security.ec.ECKeyFactory

  - S6996372: synchronizing handshaking hash

  - S7027045: (doc) java/awt/Window.java has several typos     in javadoc

  - S7054969: Null-check-in-finally pattern in java/security     documentation

  - S7072353: JNDI libraries do not build with javac
    -Xlint:all -Werror

  - S7075563: Broken link in 'javax.swing.SwingWorker'

  - S7077672: jdk8_tl nightly fail in step-2 build on     8/10/11

  - S7088502: Security libraries don't build with javac
    -Werror

  - S7092447: Clarify the default locale used in each locale     sensitive operation

  - S7093640: Enable client-side TLS 1.2 by default

  - S7103570: AtomicIntegerFieldUpdater does not work when     SecurityManager is installed

  - S7117360: Warnings in java.util.concurrent.atomic     package

  - S7117465: Warning cleanup for IMF classes

  - S7187144: JavaDoc for ScriptEngineFactory.getProgram()     contains an error

  - S8000418: javadoc should used a standard 'generated by     javadoc' string

  - S8000666: javadoc should write directly to Writer     instead of composing strings

  - S8000673: remove dead code from HtmlWriter and subtypes

  - S8000970: break out auxiliary classes that will prevent     multi-core compilation of the JDK

  - S8001669: javadoc internal DocletAbortException should     set cause when appropriate

  - S8008949: javadoc stopped copying doc-files

  - S8011402: Move blacklisting certificate logic from hard     code to data

  - S8011547: Update XML Signature implementation to Apache     Santuario 1.5.4

  - S8012288: XML DSig API allows wrong tag names and extra     elements in SignedInfo

  - S8016217: More javadoc warnings

  - S8017325: Cleanup of the javadoc <code> tag in     java.security.cert

  - S8017326: Cleanup of the javadoc <code> tag in     java.security.spec

  - S8019772: Fix doclint issues in javax.crypto and     javax.security subpackages

  - S8020557: javadoc cleanup in javax.security

  - S8020688: Broken links in documentation at     http://docs.oracle.com/javase/6/docs/api/index.

  - S8021108: Clean up doclint warnings and errors in     java.text package

  - S8021417: Fix doclint issues in java.util.concurrent

  - S8021833: javadoc cleanup in java.net

  - S8022120: JCK test     api/javax_xml/crypto/dsig/TransformService/index_ParamMe     thods fails

  - S8022175: Fix doclint warnings in javax.print

  - S8022406: Fix doclint issues in java.beans

  - S8022746: List of spelling errors in API doc

  - S8024779: [macosx] SwingNode crashes on exit

  - S8025085: [javadoc] some errors in javax/swing

  - S8025218: [javadoc] some errors in java/awt classes

  - S8025249: [javadoc] fix some javadoc errors in     javax/swing/

  - S8025409: Fix javadoc comments errors and warning     reported by doclint report

  - S8026021: more fix of javadoc errors and warnings     reported by doclint, see the description

  - S8037099: [macosx] Remove all references to GC from     native OBJ-C code

  - S8038184: XMLSignature throws     StringIndexOutOfBoundsException if ID attribute value is     empty String

  - S8038349: Signing XML with DSA throws Exception when key     is larger than 1024 bits

  - S8049244: XML Signature performance issue caused by     unbuffered signature data

  - S8049432: New tests for TLS property     jdk.tls.client.protocols

  - S8050893: (smartcardio) Invert reset argument in tests     in sun/security/smartcardio

  - S8059212: Modify regression tests so that they do not     just fail if no cardreader found

  - S8068279: (typo in the spec)     javax.script.ScriptEngineFactory.getLanguageName

  - S8068491: Update the protocol for references of     docs.oracle.com to HTTPS.

  - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java     needs to be updated for JDK-8061210

  - S8076369: Introduce the jdk.tls.client.protocols system     property for JDK 7u

  - S8139565: Restrict certificates with DSA keys less than     1024 bits

  - S8140422: Add mechanism to allow non default root CAs to     be not subject to algorithm restrictions

  - S8140587: Atomic*FieldUpdaters should use     Class.isInstance instead of direct class check

  - S8143959: Certificates requiring blacklisting

  - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks

  - S8148516: Improve the default strength of EC in JDK

  - S8149029: Secure validation of XML based digital     signature always enabled when checking wrapping attacks

  - S8151893: Add security property to configure XML     Signature secure validation mode

  - S8155760: Implement Serialization Filtering

  - S8156802: Better constraint checking

  - S8161228: URL objects with custom protocol handlers have     port changed after deserializing

  - S8161571: Verifying ECDSA signatures permits trailing     bytes

  - S8163304: jarsigner -verbose -verify should print the     algorithms used to sign the jar

  - S8164908: ReflectionFactory support for IIOP and custom     serialization

  - S8165230: RMIConnection addNotificationListeners failing     with specific inputs

  - S8166393: disabledAlgorithms property should not be     strictly parsed

  - S8166591: [macos 10.12] Trackpad scrolling of text on OS     X 10.12 Sierra is very fast (Trackpad, Retina only)

  - S8166739: Improve extensibility of ObjectInputFilter     information passed to the filter

  - S8166875: (tz) Support tzdata2016g

  - S8166878: Connection reset during TLS handshake

  - S8167356: Follow up fix for jdk8 backport of 8164143.
    Changes for CMenuComponent.m were missed

  - S8167459: Add debug output for indicating if a chosen     ciphersuite was legacy

  - S8167472: Chrome interop regression with JDK-8148516

  - S8167591: Add MD5 to signed JAR restrictions

  - S8168861: AnchorCertificates uses hardcoded password for     cacerts keystore

  - S8168993: JDK8u121 L10n resource file update

  - S8169191: (tz) Support tzdata2016i

  - S8169688: Backout (remove) MD5 from     jdk.jar.disabledAlgorithms for January CPU

  - S8169911: Enhanced tests for jarsigner -verbose -verify     after JDK-8163304

  - S8170131: Certificates not being blocked by     jdk.tls.disabledAlgorithms property

  - S8170268: 8u121 L10n resource file update - msgdrop 20

  - S8173622: Backport of 7180907 is incomplete

  - S8173849: Fix use of java.util.Base64 in test cases

  - S8173854: [TEST] Update DHEKeySizing test case following     8076328 & 8081760

  - CVE-2017-3259 Vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE.

  - Backports

  - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef     on __APPLE__and _LLP64 systems.

  - S8000351, PR3316, RH1390708: Tenuring threshold should     be unsigned

  - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never     deleted when processing invokeMethod command

  - S8170888, PR3316, RH1390708: [linux] support for cgroup     memory limits in container (ie Docker) environments

  - Bug fixes

  - PR3318: Replace 'infinality' with 'improved font     rendering' (--enable-improved-font-rendering)

  - PR3318: Fix compatibility with vanilla Fontconfig

  - PR3318: Fix glyph y advance

  - PR3318: Always round glyph advance in 26.6 space

  - PR3318: Simplify glyph advance handling

  - PR3324: Fix NSS_LIBDIR substitution in     make_generic_profile.sh broken by PR1989

  - AArch64 port

  - S8165673, PR3320: AArch64: Fix JNI floating point     argument handling

This update was imported from the SUSE:SLE-12:Update update project.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the bypass of Java sandbox restrictions, denial of service, arbitrary code execution, incorrect parsing or URLs/LDAP DNs or cryptoraphice timing side channel attacks.

For Debian 7 'Wheezy', these problems have been fixed in version 7u121-2.6.8-2~deb7u1.

We recommend that you upgrade your openjdk-7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Java SE installed on the remote host is prior to 7 Update 131, or 8 Update 121 and is affected by a flaw in the AWT subcomponent that is triggered when handling menu items.  This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code outside of intended sandbox restrictions.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the bypass of Java sandbox restrictions, denial of service, arbitrary code execution, incorrect parsing of URLs/LDAP DNs or cryptographic timing side channel attacks.

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0) :

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvements

  - S8168724, CVE-2016-5549: ECDSA signing improvements

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0) :

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvements

  - S8168724, CVE-2016-5549: ECDSA signing improvements

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-65 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in in Oracle&rsquo;s JRE and       JDK. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, gain access to information, or cause a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 121, 7 Update 131, or 6 Update 141. It is, therefore, affected by multiple vulnerabilities :

  - A vulnerability exists in the Libraries subcomponent,     known as SWEET32, in the 3DES and Blowfish algorithms     due to the use of weak 64-bit block ciphers by default.
    A man-in-the-middle attacker who has sufficient     resources can exploit this vulnerability, via a     'birthday' attack, to detect a collision that leaks the     XOR between the fixed secret and a known plaintext,     allowing the disclosure of the secret text, such as     secure HTTPS cookies, and possibly resulting in the     hijacking of an authenticated session. (CVE-2016-2183)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-5546)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2016-5547)

  - Multiple unspecified flaws exist in the Libraries     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5548, CVE-2016-5549)

  - An unspecified flaw exists in the Networking     subcomponent that allows an unauthenticated, remote     attacker to impact integrity. (CVE-2016-5552)

  - An unspecified flaw exists in the Mission Control     subcomponent that allows an unauthenticated, remote     attacker to impact integrity. (CVE-2016-8328)

  - Multiple unspecified flaws exist in the Networking     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3231, CVE-2017-3261)

  - An unspecified flaw exists in the RMI subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3241)

  - An unspecified flaw exists in the JAAS subcomponent that     allows an unauthenticated, remote attacker to impact     integrity. (CVE-2017-3252)

  - An unspecified flaw exists in the 2D subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3253)

  - An unspecified flaw exists in the Deployment     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3259)

  - An unspecified flaw exists in the AWT subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3260)

  - An unspecified flaw exists in the Java Mission Control     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3262)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3272)

  - An unspecified flaw exists in the Hotspot subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3289)

Note that CVE-2017-3241 can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.
Note that CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, and CVE-2017-3253 can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. They can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

ID	Name	Product	Family	Severity
160374	IBM Java 6.0 < 6.0.16.41 / 6.1 < 6.1.8.41 / 7.0 < 7.0.10.1 / 7.1 < 7.1.4.1 / 8.0 < 8.0.4.1 Multiple Vulnerabilities	Nessus	Misc.	critical
121694	Photon OS 1.0: Openjre PHSA-2017-0016	Nessus	PhotonOS Local Security Checks	critical
121693	Photon OS 1.0: Openjdk PHSA-2017-0016	Nessus	PhotonOS Local Security Checks	critical
101248	GLSA-201707-01 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
97296	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2017:0490-1)	Nessus	SuSE Local Security Checks	critical
97287	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-278)	Nessus	SuSE Local Security Checks	critical
97105	Debian DLA-821-1 : openjdk-7 security update	Nessus	Debian Local Security Checks	critical
9948	Oracle Java SE 7 < Update 131 / 8 < Update 121 Arbitrary Code Execution	Nessus Network Monitor	Web Clients	high
97067	Debian DSA-3782-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	critical
97002	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2017-201)	Nessus	SuSE Local Security Checks	critical
96926	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:0346-1)	Nessus	SuSE Local Security Checks	critical
96787	GLSA-201701-65 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
96629	Oracle Java SE Multiple Vulnerabilities (January 2017 CPU) (Unix) (SWEET32)	Nessus	Misc.	critical
96628	Oracle Java SE Multiple Vulnerabilities (January 2017 CPU) (SWEET32)	Nessus	Windows	critical

Detections

Analytics

CVE-2017-3260

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical