The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0807 advisory.

    [1:1.7.0.75-2.5.5.1.0.1.el5_11]
    - Add oracle-enterprise.patch
    - Fix DISTRO_NAME to 'Oracle Linux'

    [1:1.7.0.75-2.5.5.1]
    - Repacked sources
    - Resolves: rhbz#1209069

    [1:1.7.0.79-2.5.5.0]
    - Bump to 2.5.5 using OpenJDK 7u79 b14.
    - Resolves: rhbz#1209069

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0806 advisory.

    The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime     Environment and the OpenJDK 7 Java Software Development Kit.

    An off-by-one flaw, leading to a buffer overflow, was found in the font     parsing code in the 2D component in OpenJDK. A specially crafted font file     could possibly cause the Java Virtual Machine to execute arbitrary code,     allowing an untrusted Java application or applet to bypass Java sandbox     restrictions. (CVE-2015-0469)

    A flaw was found in the way the Hotspot component in OpenJDK handled     phantom references. An untrusted Java application or applet could use this     flaw to corrupt the Java Virtual Machine memory and, possibly, execute     arbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0460)

    A flaw was found in the way the JSSE component in OpenJDK parsed X.509     certificate options. A specially crafted certificate could cause JSSE to     raise an exception, possibly causing an application using JSSE to exit     unexpectedly. (CVE-2015-0488)

    A flaw was discovered in the Beans component in OpenJDK. An untrusted Java     application or applet could use this flaw to bypass certain Java sandbox     restrictions. (CVE-2015-0477)

    A directory traversal flaw was found in the way the jar tool extracted JAR     archive files. A specially crafted JAR archive could cause jar to overwrite     arbitrary files writable by the user running jar when the archive was     extracted. (CVE-2005-1080, CVE-2015-0480)

    It was found that the RSA implementation in the JCE component in OpenJDK     did not follow recommended practices for implementing RSA signatures.
    (CVE-2015-0478)

    The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat     Product Security.

    Note: If the web browser plug-in provided by the icedtea-web package was     installed, the issues exposed via Java applets could have been exploited     without user interaction if a user visited a malicious website.

    All users of java-1.7.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2005-1080, CVE-2015-0458, CVE-2015-0459, CVE-2015-0460, CVE-2015-0469, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0484, CVE-2015-0488, CVE-2015-0491, CVE-2015-0492)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 79 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2574-1 advisory.

    Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data     integrity and availability. An attacker could exploit these to cause a denial of service or expose     sensitive data over the network. (CVE-2015-0460, CVE-2015-0469)

    Alexander Cherepanov discovered that OpenJDK JRE was vulnerable to directory traversal issues with respect     to handling jar files. An attacker could use this to expose sensitive data. (CVE-2015-0480)

    Florian Weimer discovered that the RSA implementation in the JCE component in OpenJDK JRE did not follow     recommended practices for implementing RSA signatures. An attacker could use this to expose sensitive     data. (CVE-2015-0478)

    A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit     this expose sensitive data over the network. (CVE-2015-0477)

    A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could exploit these     to cause a denial of service. (CVE-2015-0488)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080 , CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

OpenJDK was updated to version 2.5.5 - OpenJDK 7u79 to fix security issues and bugs.

The following vulnerabilities have been fixed :

  - Deployment: unauthenticated remote attackers could     execute arbitrary code via multiple protocols.
    (CVE-2015-0458)

  - 2D: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0459)

  - Hotspot: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0460)

  - 2D: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0469)

  - Beans: unauthenticated remote attackers could update,     insert or delete some JAVA accessible data via multiple     protocols. (CVE-2015-0477)

  - JCE: unauthenticated remote attackers could read some     JAVA accessible data via multiple protocols.
    (CVE-2015-0478)

  - Tools: unauthenticated remote attackers could update,     insert or delete some JAVA accessible data via multiple     protocols and cause a partial denial of service (partial     DOS). (CVE-2015-0480)

  - JavaFX: unauthenticated remote attackers could read,     update, insert or delete access some Java accessible     data via multiple protocols and cause a partial denial     of service (partial DOS). (CVE-2015-0484)

  - JSSE: unauthenticated remote attackers could cause a     partial denial of service (partial DOS). (CVE-2015-0488)

  - 2D: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0491)

  - JavaFX: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0492)

The Oracle Java SE installed on the remote host is version 8 prior to Update 41; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Deployment running on client deployments of Oracle Java (CVE-2015-0458, CVE-2015-0486)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460, CVE-2015-0470)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)
 - Several undisclosed attack vectors which affect client and server deployments of Oracle Java (CVE-2015-0492, CVE-2015-0484)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 45, 7 Update 79, 6 Update 95, or 5 Update 85. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - Beans
 - Deployment
 - Hotspot
 - JavaFX
 - JCE
 - JSSE
 - Tools

The Oracle Java SE installed on the remote host is version 6 prior to Update 92; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Deployment running on client deployments of Oracle Java (CVE-2015-0458)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)

The Oracle Java SE installed on the remote host is version 7 prior to Update 77; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Deployment running on client deployments of Oracle Java (CVE-2015-0458)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)
 - Several undisclosed attack vectors which affect client and server deployments of Oracle Java (CVE-2015-0492, CVE-2015-0484)

The Oracle Java SE installed on the remote host is version 5 prior to Update 82; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)

ID	Name	Product	Family	Published	Updated	Severity
82808	Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2015-0807)	Nessus	Oracle Linux Local Security Checks	4/16/2015	10/22/2024	medium
82809	RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2015:0806)	Nessus	Red Hat Local Security Checks	4/16/2015	4/15/2025	medium
82909	RHEL 5 / 6 / 7 : java-1.7.0-oracle (RHSA-2015:0857)	Nessus	Red Hat Local Security Checks	4/21/2015	10/24/2019	critical
82992	Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-2574-1)	Nessus	Ubuntu Local Security Checks	4/22/2015	8/27/2024	medium
83059	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-516)	Nessus	Amazon Linux Local Security Checks	4/27/2015	4/18/2018	critical
83287	SuSE 11.3 Security Update : java-1_7_0-openjdk (SAT Patch Number 10621)	Nessus	SuSE Local Security Checks	5/8/2015	1/6/2021	critical
8748	Oracle Java SE 8 < Update 41 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical
700650	Oracle Java SE 5 < Update 85 / 6 < Update 95 / 7 < Update 79 / 8 < Update 45 Multiple Vulnerabilities (April 2015 CPU) (FREAK)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	critical
8750	Oracle Java SE 6 < Update 92 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical
8749	Oracle Java SE 7 < Update 77 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical
8751	Oracle Java SE 5 < Update 82 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

medium

medium

critical

medium

critical

critical

critical

critical

critical

critical

critical