Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-3566, CVE-2014-6587, CVE-2014-6601, CVE-2015-0395, CVE-2015-0408, CVE-2015-0412)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2014-6585, CVE-2014-6591, CVE-2015-0400, CVE-2015-0407)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure and integrity. An attacker could exploit this to expose sensitive data over the network. (CVE-2014-6593)

A vulnerability was discovered in the OpenJDK JRE related to integrity and availability. An attacker could exploit this to cause a denial of service. (CVE-2015-0383)

A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could this exploit to cause a denial of service. (CVE-2015-0410).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OpenJDK was updated to 2.5.4 - OpenJDK 7u75 to fix security issues and bugs :

  - Security fixes

  - S8046656: Update protocol support

  - S8047125, CVE-2015-0395: (ref) More phantom object     references

  - S8047130: Fewer escapes from escape analysis

  - S8048035, CVE-2015-0400: Ensure proper proxy protocols

  - S8049253: Better GC validation

  - S8050807, CVE-2015-0383: Better performing performance     data handling

  - S8054367, CVE-2015-0412: More references for endpoints

  - S8055304, CVE-2015-0407: More boxing for     DirectoryComboBoxModel

  - S8055309, CVE-2015-0408: RMI needs better transportation     considerations

  - S8055479: TLAB stability

  - S8055489, CVE-2014-6585: Better substitution formats

  - S8056264, CVE-2014-6587: Multicast support improvements

  - S8056276, CVE-2014-6591: Fontmanager feature     improvements

  - S8057555, CVE-2014-6593: Less cryptic cipher suite     management

  - S8058982, CVE-2014-6601: Better verification of an     exceptional invokespecial

  - S8059485, CVE-2015-0410: Resolve parsing ambiguity

  - S8061210, CVE-2014-3566: Issues in TLS

java-1_7_0-openjdk was updated to fix 19 security issues.

Details are available at http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.h tml#AppendixJAVA

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of VMware vCenter Operations Manager installed on the remote Windows host has a bundled version of the Java JRE prior to version 1.7.0_76-b13 (aka 7.0.760.13). It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

VMware has released a patch that updates the JRE bundled with the appliance.

ID	Name	Product	Family	Published	Updated	Severity
81043	Ubuntu 10.04 LTS / 12.04 LTS : openjdk-6 vulnerabilities (USN-2486-1) (POODLE)	Nessus	Ubuntu Local Security Checks	1/28/2015	1/19/2021	low
81141	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2015:0190-1) (POODLE)	Nessus	SuSE Local Security Checks	2/3/2015	6/28/2023	low
81419	SuSE 11.3 Security Update : java-1_7_0-openjdk (SAT Patch Number 10286)	Nessus	SuSE Local Security Checks	2/20/2015	6/28/2023	critical
82140	Debian DLA-157-1 : openjdk-6 security update (POODLE)	Nessus	Debian Local Security Checks	3/26/2015	1/11/2021	low
82707	VMware vCenter Operations Management Windows JRE Update 1.7.0_76-b13 (VMSA-2015-0003) (POODLE)	Nessus	Misc.	4/10/2015	10/25/2021	critical

Detections

Analytics

Plugins Search

low

low

critical

low

critical