In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.

The version of IBM Java installed on the remote host is prior to 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25 / 11.0 < 11.0.10.0. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update February 2021 advisory.

  - In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow     when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
    (CVE-2020-27221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14634-1 advisory.

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base     Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2020-14803)

  - In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow     when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
    (CVE-2020-27221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0736 advisory.

  - OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

  - OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

  - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

  - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

  - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)     (CVE-2020-2773)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0717 advisory.

  - OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

  - OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

  - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

  - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

  - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)     (CVE-2020-2773)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0733 advisory.

  - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

  - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]

  - CVE-2020-27221: Potential for a stack-based buffer     overflow when the virtual machine or JNI natives are     converting from UTF-8 characters to platform encoding.

  - CVE-2020-14803: Unauthenticated attacker with network     access via multiple protocols allows to compromise Java     SE.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_1-ibm fixes the following issues :

Update to Java 7.1 Service Refresh 4 Fix Pack 80 [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]

  - CVE-2020-27221: Potential for a stack-based buffer     overflow when the virtual machine or JNI natives are     converting from UTF-8 characters to platform encoding.

  - CVE-2020-14803: Unauthenticated attacker with network     access via multiple protocols allows to compromise Java     SE.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
160354	IBM Java 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25 / 11.0 < 11.0.10.0	Nessus	Misc.	critical
150631	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2021:14634-1)	Nessus	SuSE Local Security Checks	critical
147142	RHEL 8 : java-1.8.0-ibm (RHSA-2021:0736)	Nessus	Red Hat Local Security Checks	critical
147140	RHEL 7 : java-1.8.0-ibm (RHSA-2021:0717)	Nessus	Red Hat Local Security Checks	critical
147139	RHEL 7 : java-1.7.1-ibm (RHSA-2021:0733)	Nessus	Red Hat Local Security Checks	critical
146937	SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0670-1)	Nessus	SuSE Local Security Checks	critical
146889	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0652-1)	Nessus	SuSE Local Security Checks	critical
146614	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2021:0512-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-27221

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical