The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0086 advisory.

  - SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack (CVE-2014-3566)

  - ICU: font parsing OOB read (OpenJDK 2D, 8055489) (CVE-2014-6585)

  - OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264) (CVE-2014-6587)

  - ICU: font parsing OOB read (OpenJDK 2D, 8056276) (CVE-2014-6591)

  - OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) (CVE-2014-6593)

  - OpenJDK: class verifier insufficient invokespecial calls verification (Hotspot, 8058982) (CVE-2014-6601)

  - OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807) (CVE-2015-0383)

  - OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) (CVE-2015-0395)

  - Oracle JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment) (CVE-2015-0403,     CVE-2015-0406)

  - OpenJDK: directory information leak via file chooser (Swing, 8055304) (CVE-2015-0407)

  - OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) (CVE-2015-0408)

  - OpenJDK: DER decoder infinite loop  (Security, 8059485) (CVE-2015-0410)

  - OpenJDK: insufficient code privileges checks (JAX-WS, 8054367) (CVE-2015-0412)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : java-1.6.0-sun (RHSA-2015:0086)

low Nessus Plugin ID 81014

Version 1.16