The 8u431, 11.0.26, 17.0.14, 20.3.16, 21.0.5, 21.3.12, 23.0.2, and perf versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory.

  - Vulnerability in Oracle Java SE (component: Install (Sparkle)). The supported version that is affected is     Oracle Java SE: 8u431. Difficult to exploit vulnerability allows high privileged attacker with access to     the physical communication segment attached to the hardware where the Oracle Java SE executes to     compromise Oracle Java SE. Successful attacks require human interaction from a person other than the     attacker and while the vulnerability is in Oracle Java SE, attacks may significantly impact additional     products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Java     SE. Note: Only applies to the macOS autoupdater. (CVE-2025-0509)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf,     11.0.26, 17.0.14, 21.0.5, 23.0.2; Oracle GraalVM for JDK: 17.0.14, 21.0.5, 23.0.2; Oracle GraalVM     Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2025-21502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Java SE Multiple Vulnerabilities (January 2025 CPU)

medium Nessus Plugin ID 214532

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Aug 6, 2025, 11:10 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:M/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 6.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H") CVSSv2 severity (based on CVE-2025-0509, severity increased from "Medium" to "High") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Plugin Feed: 202508061110
Version 1.3 Apr 17, 2025, 10:25 AM IAVM reference Plugin Feed: 202504171025
Version 1.2 Jan 24, 2025, 1:52 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202501241352
Version 1.1 Jan 23, 2025, 5:18 PM New Plugin Feed: 202501231718