In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.

The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 7239492 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:8u441,     8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM     Enterprise Edition:20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete     access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
    (CVE-2025-21587)

  - In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can     be caused by modifying a file on disk that is read when the JVM starts. (CVE-2025-4447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM MQ Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7238312 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:8u441,     8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM     Enterprise Edition:20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete     access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
    (CVE-2025-21587)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u441,     8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK: 17.0.14, 21.0.6, 24; Oracle GraalVM     Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2025-30698)

  - In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can     be caused by modifying a file on disk that is read when the JVM starts. (CVE-2025-4447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01954-1 advisory.

    - CVE-2025-4447: Fixed buffer overflow in Eclipse OpenJ9 (bsc#1243429).
    - CVE-2025-30698: Fixed 2D unauthorized data access and DoS (bsc#1241276).
    - CVE-2025-30691: Fixed Compiler Unauthorized Data Access (bsc#1241275).
    - CVE-2025-21587: Fixed unauthorized access, deletion or modification of critical data (bsc#1241274).

    Other bugfixes:

    - Fixed wrong execstack flag in libj9jit (bsc#1235844)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01788-1 advisory.

    Update to Java 8.0 Service Refresh 8 Fix Pack 45.

    Security issues fixed:

    - Oracle April 15 2025 CPU (bsc#1242208)

      * CVE-2025-21587: unauthorized access, deletion and modification of critical data via the JSSE component         (bsc#1241274).
      * CVE-2025-30691: unauthorized access to data via the Compiler component (bsc#1241275).
      * CVE-2025-30698: unauthorized access to data and ability to cause a partial DoS via the 2D component     (bsc#1241276).

    - IBM Security Update May 2025

      * CVE-2025-4447: stack based buffer overflow in Eclipse OpenJ9 through modification of file that is read     when the JVM         starts (bsc#1243429).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8431 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR8-FP40.

    Security Fix(es):

    * CVE-2025-21587
    * CVE-2025-30698
    * CVE-2025-4447

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01770-1 advisory.

    Update to Java 8.0 Service Refresh 8 Fix Pack 45.

    Security issues fixed:

    - Oracle April 15 2025 CPU (bsc#1242208)

      * CVE-2025-21587: unauthorized access, deletion and modification of critical data via the JSSE component         (bsc#1241274).
      * CVE-2025-30691: unauthorized access to data via the Compiler component (bsc#1241275).
      * CVE-2025-30698: unauthorized access to data and ability to cause a partial DoS via the 2D component     (bsc#1241276).

    - IBM Security Update May 2025

      * CVE-2025-4447: stack based buffer overflow in Eclipse OpenJ9 through modification of file that is read     when the JVM         starts (bsc#1243429).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.26 / 8.0 prior to 8.0.8.45. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update May 2025 advisory.

  - In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can     be caused by modifying a file on disk that is read when the JVM starts. (CVE-2025-4447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242053	IBM WebSphere eXtreme Scale 8.6.1 < 8.6.1.6 (7239492)	Nessus	Web Servers	high
240888	IBM MQ 9.1 < 9.1.0.29 LTS / 9.2 < 9.2.0.36 LTS / 9.3 < 9.3.0.30 LTS / 9.3 < 9.4.3 CD / 9.4 < 9.4.0.12 LTS / 9.4.3 (7238312)	Nessus	Misc.	high
240847	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-openj9 (SUSE-SU-2025:01954-1)	Nessus	SuSE Local Security Checks	high
237694	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-ibm (SUSE-SU-2025:01788-1)	Nessus	SuSE Local Security Checks	high
237692	RHEL 8 : java-1.8.0-ibm (RHSA-2025:8431)	Nessus	Red Hat Local Security Checks	high
237603	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2025:01770-1)	Nessus	SuSE Local Security Checks	high
236761	IBM Java 7.1 < 7.1.5.26 / 8.0 < 8.0.8.45	Nessus	Misc.	high

Detections

Analytics

CVE-2025-4447

high

Tenable Plugins

high

high

high

high

high

high

high