Oracle Java SE Multiple Vulnerabilities (January 2016 CPU) (SLOTH)
critical Nessus Plugin ID 88045
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Windows host contains a programming platform that is affected by multiple vulnerabilities.Description
The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 71, 7 Update 95, or 6 Update 111. It is, therefore, affected by security vulnerabilities in the following components :- 2D
- AWT
- JAXP
- JMX
- Libraries
- Networking
- Security
Solution
Upgrade to Oracle JDK / JRE 8 Update 71, 7 Update 95, 6 Update 111, or later. If necessary, remove any affected versions.Note that an Extended Support contract with Oracle is needed to obtain JDK / JRE 6 Update 111 or later.
See Also
http://www.nessus.org/u?376edd90
http://www.nessus.org/u?f7b6203b
http://www.nessus.org/u?796894ea
http://www.nessus.org/u?b809e094
Plugin Details
Severity: Critical
ID: 88045
File Name: oracle_java_cpu_jan_2016.nasl
Version: 1.13
Type: local
Agent: windows
Family: Windows
Published: 1/21/2016
Updated: 11/15/2018
Dependencies: sun_java_jre_installed.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 6
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:jre, cpe:/a:oracle:jdk
Required KB Items: SMB/Java/JRE/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 1/19/2016
Vulnerability Publication Date: 8/14/2015
Reference Information
CVE: CVE-2015-7575, CVE-2015-8126, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0475, CVE-2016-0483, CVE-2016-0494