The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1430 advisory.

  - OpenJDK: kerberos realm name leak (JGSS, 8048030) (CVE-2015-4734)

  - OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842) (CVE-2015-4803)

  - OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671)     (CVE-2015-4805)

  - OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193) (CVE-2015-4806)

  - Oracle JDK: unspecified vulnerability fixed in 7u91 and 8u65 (Deployment) (CVE-2015-4810)

  - OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383) (CVE-2015-4835)

  - OpenJDK: OOB access in CMS code (2D, 8086092) (CVE-2015-4840)

  - OpenJDK: leak of user.dir location (JAXP, 8078427) (CVE-2015-4842)

  - OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891) (CVE-2015-4843)

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042) (CVE-2015-4844)

  - OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688) (CVE-2015-4860)

  - OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries)     (CVE-2015-4871)

  - OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291) (CVE-2015-4872)

  - OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387) (CVE-2015-4882)

  - OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413) (CVE-2015-4883)

  - OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733) (CVE-2015-4893)

  - Oracle JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment) (CVE-2015-4902)

  - OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339) (CVE-2015-4903)

  - IBM JDK: local disclosure of kerberos credentials cache (CVE-2015-5006)

  - IBM JDK: J9 JVM allows code to invoke non-public interface methods (CVE-2015-5041)

  - TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) (CVE-2015-7575)

  - libpng: Out-of-bounds read in png_convert_to_rfc1123 (CVE-2015-7981)

  - libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (CVE-2015-8126,     CVE-2015-8472)

  - libpng: underflow read in png_check_keyword() (CVE-2015-8540)

  - IBM JDK: buffer overflow vulnerability in the IBM JVM (CVE-2016-0264)

  - IBM JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (CVE-2016-0363)

  - IBM JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (CVE-2016-0376)

  - OpenJDK: URL deserialization inconsistencies (Networking, 8059054) (CVE-2016-0402)

  - OpenJDK: logging of RMI connection secrets (JMX, 8130710) (CVE-2016-0448)

  - OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) (CVE-2016-0466)

  - OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) (CVE-2016-0483)

  - ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) (CVE-2016-0494)

  - OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)     (CVE-2016-0686)

  - OpenJDK: insufficient byte type checks (Hotspot, 8132051) (CVE-2016-0687)

  - Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D) (CVE-2016-3422, CVE-2016-3443)

  - OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945) (CVE-2016-3426)

  - OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430) (CVE-2016-3427)

  - Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (Deployment) (CVE-2016-3449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 / 6 : java-1.7.0-ibm and java-1.7.1-ibm (RHSA-2016:1430)

critical Nessus Plugin ID 92400

Version 2.18

Version 2.17

Version 2.16

Version 2.18 Apr 21, 2024, 12:31 PM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404211231
Version 2.17 May 14, 2023, 12:09 PM CISA reference Plugin Feed: 202305141209
Version 2.16 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311