Oracle Java SE 7 < Update 221 / 8 < Update 211 / 11 < Update 3 / 12 < Update 1 Multiple Vulnerabilities (Apr 2019 CPU)

High Nessus Network Monitor Plugin ID 700660

Synopsis

The remote host is missing a critical Oracle Java SE patch update.

Description

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 12 Update 1, 11 Update 3, 8 Update 211, or 7 Update 221. It is, therefore, affected by multiple vulnerabilities related to the following components :

- 2D
- Libraries
- RMI
- Windows DLL

Solution

Upgrade to Oracle JDK / JRE 12 Update 1, 11 Update 3, 8 Update 211 / 7 Update 221 or later. If necessary, remove any affected versions.

See Also

http://www.nessus.org/u?9166970d

http://www.nessus.org/u?aa0c1228

Plugin Details

Severity: High

ID: 700660

Family: Web Clients

Published: 2019/05/02

Updated: 2019/05/02

Dependencies: 8892, 8895

Nessus ID: 124198

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 9

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:java_se

Patch Publication Date: 2019/04/16

Vulnerability Publication Date: 2019/04/16

Reference Information

CVE: CVE-2019-2602, CVE-2019-2684, CVE-2019-2697, CVE-2019-2698, CVE-2019-2699

BID: 107911, 107915, 107917, 107918, 107922

IAVA: 2019-A-0118