Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

The version of IBM Java installed on the remote host is prior to 7.0 < 7.0.10.40 / 7.1 < 7.1.4.40 / 8.0 < 8.0.5.30. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 15 2019 CPU advisory.

  - An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote     attackers to cause a denial of service (divide-by-zero error) via a crafted file. (CVE-2018-11212)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions     that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2019-2422)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions     that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of     Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. (CVE-2019-2426)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version     that is affected is Java SE: 8u192. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2019-2449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk11 package has been released.

This update for java-1_7_0-openjdk to version 7u231 fixes the following issues :

Security issues fixed :

CVE_2019-2426: Improve web server connections (bsc#1134297).

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2842: Extended AES support (bsc#1141786).

CVE-2019-7317: Improve PNG support (bsc#1141780).

CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE (bsc#1087082).

Certificate validation improvements

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk fixes the following issues :

Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU)

Security issues fixed :

  - CVE-2019-2602: Fixed flaw inside BigDecimal     implementation (Component: Libraries) (bsc#1132728).

  - CVE-2019-2684: Fixed flaw inside the RMI registry     implementation (bsc#1132732).

  - CVE-2019-2698: Fixed out of bounds access flaw in the 2D     component (bsc#1132729).

  - CVE-2019-2422: Fixed memory disclosure in     FileChannelImpl (bsc#1122293).

  - CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray     function in jmemmgr.c (bsc#1122299).

  - CVE-2019-2426: Improve web server connections     (bsc#1134297).

Bug fixes :

  - Please check the package Changelog for detailed     information.

This update was imported from the SUSE:SLE-12:Update update project.

This update for java-1_7_0-openjdk fixes the following issues :

Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU)

Security issues fixed :

CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component:
Libraries) (bsc#1132728).

CVE-2019-2684: Fixed flaw inside the RMI registry implementation (bsc#1132732).

CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).

CVE-2019-2422: Fixed memory disclosure in FileChannelImpl (bsc#1122293).

CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray function in jmemmgr.c (bsc#1122299).

CVE-2019-2426: Improve web server connections (bsc#1134297).

Bug fixes: Please check the package Changelog for detailed information.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues :

Security issues fixed :

  - CVE-2019-2602: Better String parsing (bsc#1132728).

  - CVE-2019-2684: More dynamic RMI interactions     (bsc#1132732).

  - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID()     (bsc#1132729).

  - CVE-2019-2422: Better FileChannel (bsc#1122293).

  - CVE-2018-11212: Improve JPEG (bsc#1122299).

Non-Security issue fixed :

  - Disable LTO (bsc#1133135).

  - Added Japanese new era name.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues :

Security issues fixed :

CVE-2019-2602: Better String parsing (bsc#1132728).

CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).

CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).

CVE-2019-2422: Better FileChannel (bsc#1122293).

CVE-2018-11212: Improve JPEG (bsc#1122299).

Non-Security issue fixed: Disable LTO (bsc#1133135).

Added Japanese new era name.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201903-14 (Oracle JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s JDK and JRE       software suites. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, gain access to information, or cause a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues :

Security issues fixed :

  - CVE-2019-2422: Better FileChannel transfer performance     (bsc#1122293)

  - CVE-2019-2426: Improve web server connections

  - CVE-2018-11212: Improve JPEG processing (bsc#1122299)

  - Better route routing

  - Better interface enumeration

  - Better interface lists

  - Improve BigDecimal support

  - Improve robot support

  - Better icon support

  - Choose printer defaults

  - Proper allocation handling

  - Initial class initialization

  - More reliable p11 transactions

  - Improve NIO stability

  - Better loading of classloader classes

  - Strengthen Windows Access Bridge Support

  - Improved data set handling

  - Improved LSA authentication

  - Libsunmscapi improved interactions

Non-security issues fix :

  - Do not resolve by default the added JavaEE modules     (bsc#1120431)

  - ~2.5% regression on compression benchmark starting with     12-b11

  - java.net.http.HttpClient hangs on 204 reply without     Content-length 0

  - Add additional TeliaSonera root certificate

  - Add more ld preloading related info to hs_error file on     Linux

  - Add test to exercise server-side client hello processing

  - AES encrypt performance regression in jdk11b11

  - AIX: ProcessBuilder: Piping between created processes     does not work.

  - AIX: Some class library files are missing the Classpath     exception

  - AppCDS crashes for some uses with JRuby

  - Automate vtable/itable stub size calculation

  - BarrierSetC1::generate_referent_check() confuses     register allocator

  - Better HTTP Redirection

  - Catastrophic size_t underflow in BitMap::*_large methods

  - Clip.isRunning() may return true after Clip.stop() was     called

  - Compiler thread creation should be bounded by available     space in memory and Code Cache

  - com.sun.net.httpserver.HttpServer returns Content-length     header for 204 response code

  - Default mask register for avx512 instructions

  - Delayed starting of debugging via jcmd

  - Disable all DES cipher suites

  - Disable anon and NULL cipher suites

  - Disable unsupported GCs for Zero

  - Epsilon alignment adjustments can overflow max TLAB size

  - Epsilon elastic TLAB sizing may cause misalignment

  - HotSpot update for vm_version.cpp to recognise updated     VS2017

  - HttpClient does not retrieve files with large sizes over     HTTP/1.1

  - IIOException 'tEXt chunk length is not proper' on     opening png file

  - Improve TLS connection stability again

  - InitialDirContext ctor sometimes throws NPE if the     server has sent a disconnection

  - Inspect stack during error reporting

  - Instead of circle rendered in appl window, but ellipse     is produced JEditor Pane

  - Introduce diagnostic flag to abort VM on failed JIT     compilation

  - Invalid assert(HeapBaseMinAddress > 0) in     ReservedHeapSpace::initialize_compressed_heap

  - jar has issues with UNC-path arguments for the jar -C     parameter [windows]

  - java.net.http HTTP client should allow specifying Origin     and Referer headers

  - java.nio.file.Files.writeString writes garbled UTF-16     instead of UTF-8

  - JDK 11.0.1 l10n resource file update

  - JDWP Transport Listener: dt_socket thread crash

  - JVMTI ResourceExhausted should not be posted in     CompilerThread

  - LDAPS communication failure with jdk 1.8.0_181

  - linux: Poor StrictMath performance due to non-optimized     compilation

  - Missing synchronization when reading counters for live     threads and peak thread count

  - NPE in SupportedGroupsExtension

  - OpenDataException thrown when constructing CompositeData     for StackTraceElement

  - Parent class loader may not have a referred     ClassLoaderData instance when obtained in     Klass::class_in_module_of_loader

  - Populate handlers while holding streamHandlerLock

  - ppc64: Enable POWER9 CPU detection

  - print_location is not reliable enough (printing register     info)

  - Reconsider default option for ClassPathURLCheck change     done in JDK-8195874

  - Register to register spill may use AVX 512 move     instruction on unsupported platform.

  - s390: Use of shift operators not covered by cpp standard

  - serviceability/sa/TestUniverse.java#id0 intermittently     fails with assert(get_instanceKlass()->is_loaded())     failed: must be at least loaded

  - SIGBUS in CodeHeapState::print_names()

  - SIGSEGV in MethodArityHistogram() with
    -XX:+CountCompiledCalls

  - Soft reference reclamation race in     com.sun.xml.internal.stream.util.ThreadLocalBufferAlloca     tor

  - Swing apps are slow if displaying from a remote source     to many local displays

  - switch jtreg to 4.2b13

  - Test library OSInfo.getSolarisVersion cannot determine     Solaris version

  - TestOptionsWithRanges.java is very slow

  - TestOptionsWithRanges.java of '-XX:TLABSize=2147483648'     fails intermittently

  - The Japanese message of FileNotFoundException garbled

  - The 'supported_groups' extension in ServerHellos

  - ThreadInfoCompositeData.toCompositeData fails to map     ThreadInfo to CompositeData

  - TimeZone.getDisplayName given Locale.US doesn't always     honor the Locale.

  - TLS 1.2 Support algorithm in SunPKCS11 provider

  - TLS 1.3 handshake server name indication is missing on a     session resume

  - TLS 1.3 server fails if ClientHello doesn't have     pre_shared_key and psk_key_exchange_modes

  - TLS 1.3 interop problems with OpenSSL 1.1.1 when used on     the client side with mutual auth

  - tz: Upgrade time-zone data to tzdata2018g

  - Undefined behaviour in ADLC

  - Update avx512 implementation

  - URLStreamHandler initialization race

  - UseCompressedOops requirement check fails fails on     32-bit system

  - windows: Update OS detection code to recognize Windows     Server 2019

  - x86: assert on unbound assembler Labels used as branch     targets

  - x86: jck tests for ldc2_w bytecode fail

  - x86: sharedRuntimeTrig/sharedRuntimeTrans compiled     without optimization

  - '-XX:OnOutOfMemoryError' uses fork instead of vfork

This update was imported from the SUSE:SLE-15:Update update project.

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues :

Security issues fixed :

CVE-2019-2422: Better FileChannel transfer performance (bsc#1122293)

CVE-2019-2426: Improve web server connections

CVE-2018-11212: Improve JPEG processing (bsc#1122299)

Better route routing

Better interface enumeration

Better interface lists

Improve BigDecimal support

Improve robot support

Better icon support

Choose printer defaults

Proper allocation handling

Initial class initialization

More reliable p11 transactions

Improve NIO stability

Better loading of classloader classes

Strengthen Windows Access Bridge Support

Improved data set handling

Improved LSA authentication

Libsunmscapi improved interactions

Non-security issues fix: Do not resolve by default the added JavaEE modules (bsc#1120431)

~2.5% regression on compression benchmark starting with 12-b11

java.net.http.HttpClient hangs on 204 reply without Content-length 0

Add additional TeliaSonera root certificate

Add more ld preloading related info to hs_error file on Linux

Add test to exercise server-side client hello processing

AES encrypt performance regression in jdk11b11

AIX: ProcessBuilder: Piping between created processes does not work.

AIX: Some class library files are missing the Classpath exception

AppCDS crashes for some uses with JRuby

Automate vtable/itable stub size calculation

BarrierSetC1::generate_referent_check() confuses register allocator

Better HTTP Redirection

Catastrophic size_t underflow in BitMap::*_large methods

Clip.isRunning() may return true after Clip.stop() was called

Compiler thread creation should be bounded by available space in memory and Code Cache

com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code

Default mask register for avx512 instructions

Delayed starting of debugging via jcmd

Disable all DES cipher suites

Disable anon and NULL cipher suites

Disable unsupported GCs for Zero

Epsilon alignment adjustments can overflow max TLAB size

Epsilon elastic TLAB sizing may cause misalignment

HotSpot update for vm_version.cpp to recognise updated VS2017

HttpClient does not retrieve files with large sizes over HTTP/1.1

IIOException 'tEXt chunk length is not proper' on opening png file

Improve TLS connection stability again

InitialDirContext ctor sometimes throws NPE if the server has sent a disconnection

Inspect stack during error reporting

Instead of circle rendered in appl window, but ellipse is produced JEditor Pane

Introduce diagnostic flag to abort VM on failed JIT compilation

Invalid assert(HeapBaseMinAddress > 0) in ReservedHeapSpace::initialize_compressed_heap

jar has issues with UNC-path arguments for the jar -C parameter [windows]

java.net.http HTTP client should allow specifying Origin and Referer headers

java.nio.file.Files.writeString writes garbled UTF-16 instead of UTF-8

JDK 11.0.1 l10n resource file update

JDWP Transport Listener: dt_socket thread crash

JVMTI ResourceExhausted should not be posted in CompilerThread

LDAPS communication failure with jdk 1.8.0_181

linux: Poor StrictMath performance due to non-optimized compilation

Missing synchronization when reading counters for live threads and peak thread count

NPE in SupportedGroupsExtension

OpenDataException thrown when constructing CompositeData for StackTraceElement

Parent class loader may not have a referred ClassLoaderData instance when obtained in Klass::class_in_module_of_loader

Populate handlers while holding streamHandlerLock

ppc64: Enable POWER9 CPU detection

print_location is not reliable enough (printing register info)

Reconsider default option for ClassPathURLCheck change done in JDK-8195874

Register to register spill may use AVX 512 move instruction on unsupported platform.

s390: Use of shift operators not covered by cpp standard

serviceability/sa/TestUniverse.java#id0 intermittently fails with assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded

SIGBUS in CodeHeapState::print_names()

SIGSEGV in MethodArityHistogram() with -XX:+CountCompiledCalls

Soft reference reclamation race in com.sun.xml.internal.stream.util.ThreadLocalBufferAllocator

Swing apps are slow if displaying from a remote source to many local displays

switch jtreg to 4.2b13

Test library OSInfo.getSolarisVersion cannot determine Solaris version

TestOptionsWithRanges.java is very slow

TestOptionsWithRanges.java of '-XX:TLABSize=2147483648' fails intermittently

The Japanese message of FileNotFoundException garbled

The 'supported_groups' extension in ServerHellos

ThreadInfoCompositeData.toCompositeData fails to map ThreadInfo to CompositeData

TimeZone.getDisplayName given Locale.US doesn't always honor the Locale.

TLS 1.2 Support algorithm in SunPKCS11 provider

TLS 1.3 handshake server name indication is missing on a session resume

TLS 1.3 server fails if ClientHello doesn't have pre_shared_key and psk_key_exchange_modes

TLS 1.3 interop problems with OpenSSL 1.1.1 when used on the client side with mutual auth

tz: Upgrade time-zone data to tzdata2018g

Undefined behaviour in ADLC

Update avx512 implementation

URLStreamHandler initialization race

UseCompressedOops requirement check fails fails on 32-bit system

windows: Update OS detection code to recognize Windows Server 2019

x86: assert on unbound assembler Labels used as branch targets

x86: jck tests for ldc2_w bytecode fail

x86: sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization

'-XX:OnOutOfMemoryError' uses fork instead of vfork

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Java SE installed on the remote host is prior to 7 Update 201, 8 Update 192, or 11.01, and is therefore affected by multiple vulnerabilities :

 - An issue exists in 'libjpeg 9a'. The 'alloc_sarray' function in 'jmemmgr.c' allows remote attackers to cause a denial of service via a crafted file. (CVE-2018-11212)
 - An issue exists that allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. (CVE-2019-2422, CVE-2019-2449)
 - An issue exists that allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. (CVE-2019-2426)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 211, 8 Update 201, 11 Update 2. It is, therefore, affected by multiple vulnerabilities related to the following components :

  - An issue in libjpeg 9a, a divide-by-zero error, could     allow remote attackers to cause a denial of service     condition via a crafted file. (CVE-2018-11212)

  - An unspecified vulnerability in Oracle Java SE in the     Networking subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE.
    (CVE-2019-2426)

  - An unspecified vulnerability in Oracle Java SE in the     Deployment subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE.
    (CVE-2019-2449)

  - An unspecified vulnerability in Oracle Java SE in the     Libraries subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE.
    (CVE-2019-2422)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
160349	IBM Java 7.0 < 7.0.10.40 / 7.1 < 7.1.4.40 / 8.0 < 8.0.5.30 Multiple Vulnerabilities	Nessus	Misc.	low
136109	Photon OS 1.0: Openjdk11 PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	critical
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	critical
127758	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:2028-1) (Spectre)	Nessus	SuSE Local Security Checks	medium
125698	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2019-1500)	Nessus	SuSE Local Security Checks	high
125676	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:1392-1)	Nessus	SuSE Local Security Checks	high
125451	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1439) (Spectre)	Nessus	SuSE Local Security Checks	high
125023	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1219-1) (Spectre)	Nessus	SuSE Local Security Checks	high
122836	GLSA-201903-14 : Oracle JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
122145	openSUSE Security Update : java-11-openjdk (openSUSE-2019-161)	Nessus	SuSE Local Security Checks	low
121568	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:0221-1)	Nessus	SuSE Local Security Checks	low
700393	Oracle Java SE 7 < Update 201 / 8 < Update 192 / 11 < 11.01 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
121231	Oracle Java SE 1.7.x < 1.7.0_211 / 1.8.x < 1.8.0_201 / 1.11.x < 1.11.0_2 Multiple Vulnerabilities (January 2019 CPU)	Nessus	Windows	low
121230	Oracle Java SE 1.7.x < 1.7.0_211 / 1.8.x < 1.8.0_201 / 1.11.x < 1.11.0_2 Multiple Vulnerabilities (January 2019 CPU) (Unix)	Nessus	Misc.	low

Detections

Analytics

CVE-2019-2426

low

Tenable Plugins

low

critical

critical

medium

high

high

high

high

high

low

low

medium

low

low