The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2592 advisory.

  - OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

  - libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

  - IBM JDK: Out-of-bounds access in the String.getBytes method (CVE-2019-11772)

  - IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : java-1.8.0-ibm (RHSA-2019:2592)

critical Nessus Plugin ID 128451

Version 1.7