Detections
Analytics

SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2018:3868-1)

critical Nessus Plugin ID 120167

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

java-1_8_0-ibm was updated to Java 8.0 Service Refresh 5 Fix Pack 25 (bsc#1116574)

Class Libraries :

 - IJ10934 CVE-2018-13785

 - IJ10935 CVE-2018-3136

 - IJ10895 CVE-2018-3139

 - IJ10932 CVE-2018-3149

 - IJ10894 CVE-2018-3180

 - IJ10930 CVE-2018-3183

 - IJ10933 CVE-2018-3214

 - IJ09315 FLOATING POINT EXCEPTION FROM JAVA.TEXT.DECIMALFORMAT. FORMAT

 - IJ09088 INTRODUCING A NEW PROPERTY FOR TURKEY TIMEZONE FOR PRODUCTS NOT IDENTIFYING TRT

 - IJ10800 REMOVE EXPIRING ROOT CERTIFICATES IN IBM JDK’S CACERTS.

 - IJ10566 SUPPORT EBCDIC CODE PAGE IBM-274 – BELGIUM EBCDIC Java Virtual Machine

 - IJ08730 APPLICATION SIGNAL HANDLER NOT INVOKED FOR SIGABRT

 - IJ10453 ASSERTION FAILURE AT CLASSPATHITEM.CPP

 - IJ09574 CLASSLOADER DEFINED THROUGH SYSTEM PROPERTY ‘JAVA.SYSTEM.CLAS S.LOADE R’ IS NOT HONORED.

 - IJ10931 CVE-2018-3169

 - IJ10618 GPU SORT: UNSPECIFIED LAUNCH FAILURE

 - IJ10619 INCORRECT ILLEGALARGUMENTEXCEPTION BECAUSE OBJECT IS NOT AN INSTANCE OF DECLARING CLASS ON REFLECTIVE INVOCATION

 - IJ10135 JVM HUNG IN GARBAGECOLLECTORMXBEAN.G ETLASTGCINFO() API

 - IJ10680 RECURRENT ABORTED SCAVENGE ORB

 - IX90187 CLIENTREQUESTIMPL.REINVO KE FAILS WITH JAVA.LANG.INDEXOUTOFBOUN DSEXCEPTION Reliability and Serviceability

 - IJ09600 DTFJ AND JDMPVIEW FAIL TO PARSE WIDE REGISTER VALUES Security

 - IJ10492 'EC KEYSIZE z/OS Extentions

 - PH03889 ADD SUPPORT FOR TRY-WITH-RESOURCES TO COM.IBM.JZOS.ENQUEUE

 - PH03414 ROLLOVER FROM SYE TO SAE FOR ICSF REASON CODE 3059

 - PH04008 ZERTJSSE – Z SYSTEMS ENCRYPTION READINESS TOOL (ZERT) NEW SUPPORT IN THE Z/OS JAVA SDK

This includes the update to Java 8.0 Service Refresh 5 Fix Pack 22:
Java Virtual Machine

 - IJ09139 CUDA4J NOT AVAILABLE ON ALL PLATFORMS JIT Compiler

 - IJ09089 CRASH DURING COMPILATION IN USEREGISTER ON X86-32

 - IJ08655 FLOATING POINT ERROR (SIGFPE) IN ZJ9SYM1 OR ANY VM/JIT MODULE ON AN INSTRUCTION FOLLOWING A VECTOR INSTRUCTION

 - IJ08850 CRASH IN ARRAYLIST$ITR.NEXT()

 - IJ09601 JVM CRASHES ON A SIGBUS SIGNAL WHEN ACCESSING A DIRECTBYTEBUFFER z/OS Extentions

 - PH02999 JZOS data management classes accept dataset names in code pages supported by z/OS system services

 - PH01244 OUTPUT BUFFER TOO SHORT FOR GCM MODE ENCRYPTION USING IBMJCEHYBRID

Also the update to Java 8.0 Service Refresh 5 Fix Pack 21 Class Libraries

 - IJ08569 JAVA.IO.IOEXCEPTION OCCURS WHEN A FILECHANNEL IS BIGGER THAN 2GB ON AIX PLATFORM

 - IJ08570 JAVA.LANG.UNSATISFIEDLIN KERROR WITH JAVA OPTION

 -DSUN.JAVA2D.CMM=SUN.JAV A2D.CMM.KCMS.KCMSSERVICE PROVIDER ON AIX PLATFORM Java Virtual Machine

 - IJ08001 30% THROUGHPUT DROP FOR CERTAIN SYNCHRONIZATION WORKLOADS

 - IJ07997 TRACEASSERT IN GARBAGE COLLECTOR(MEMORYSUBSPACE) JIT Compiler

 - IJ08503 ASSERTION IS HIT DUE TO UNEXPECTED STACK HEIGHT IN DEBUGGING MODE

 - IJ08375 CRASH DURING HARDWARE GENERATED GUARDED STORAGE EVENT WITHIN A TRANSACTIONAL EXECUTION REGION WHEN RUNNING WITH -XGC:CONCURRENTS

 - IJ08205 CRASH WHILE COMPILING

 - IJ09575 INCORRECT RESULT WHEN USING JAVA.LANG.MATH.MIN OR MAX ON 31-BIT JVM

 - IJ07886 INCORRECT CALUCATIONS WHEN USING NUMBERFORMAT.FORMAT() AND BIGDECIMAL.{FLOAT/DOUBLE }VALUE()

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Legacy Software 15:zypper in -t patch SUSE-SLE-Module-Legacy-15-2018-2763=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1116574

https://www.suse.com/security/cve/CVE-2018-13785/

https://www.suse.com/security/cve/CVE-2018-3136/

https://www.suse.com/security/cve/CVE-2018-3139/

https://www.suse.com/security/cve/CVE-2018-3149/

https://www.suse.com/security/cve/CVE-2018-3169/

https://www.suse.com/security/cve/CVE-2018-3180/

https://www.suse.com/security/cve/CVE-2018-3183/

https://www.suse.com/security/cve/CVE-2018-3214/

http://www.nessus.org/u?b0baaa4a

Plugin Details

Severity: Critical

ID: 120167

File Name: suse_SU-2018-3868-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 1/2/2019

Updated: 3/16/2020

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 7.8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:java-1_8_0-ibm, p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa, p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel, p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/22/2018

Vulnerability Publication Date: 7/9/2018

Reference Information

CVE: CVE-2018-13785, CVE-2018-3136, CVE-2018-3139, CVE-2018-3149, CVE-2018-3169, CVE-2018-3180, CVE-2018-3183, CVE-2018-3214