Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 45, 7 Update 79, 6 Update 95, or 5 Update 85. It is, therefore, affected by security vulnerabilities in the following components :

  - 2D
  - Beans
  - Deployment
  - Hotspot
  - JavaFX
  - JCE
  - JSSE
  - Tools

Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2005-1080, CVE-2015-0458, CVE-2015-0459, CVE-2015-0460, CVE-2015-0469, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0484, CVE-2015-0488, CVE-2015-0491, CVE-2015-0492)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 79 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2015-0460, CVE-2015-0469)

Alexander Cherepanov discovered that OpenJDK JRE was vulnerable to directory traversal issues with respect to handling jar files. An attacker could use this to expose sensitive data. (CVE-2015-0480)

Florian Weimer discovered that the RSA implementation in the JCE component in OpenJDK JRE did not follow recommended practices for implementing RSA signatures. An attacker could use this to expose sensitive data. (CVE-2015-0478)

A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit this expose sensitive data over the network. (CVE-2015-0477)

A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could exploit these to cause a denial of service. (CVE-2015-0488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.7.0 packages fix security vulnerabilities :

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions (CVE-2015-0469).

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions (CVE-2015-0460).

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly (CVE-2015-0488).

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions (CVE-2015-0477).

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted (CVE-2005-1080, CVE-2015-0480).

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures (CVE-2015-0478).

OpenJDK was updated to jdk8u45-b14 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-0458: Deployment: unauthenticated remote     attackers could execute arbitrary code via multiple     protocols.

  - CVE-2015-0459: 2D: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0460: Hotspot: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0469: 2D: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0470: Hotspot: unauthenticated remote attackers     could update, insert or delete some JAVA accessible data     via multiple protocols

  - CVE-2015-0477: Beans: unauthenticated remote attackers     could update, insert or delete some JAVA accessible data     via multiple protocols

  - CVE-2015-0478: JCE: unauthenticated remote attackers     could read some JAVA accessible data via multiple     protocols

  - CVE-2015-0480: Tools: unauthenticated remote attackers     could update, insert or delete some JAVA accessible data     via multiple protocols and cause a partial denial of     service (partial DOS)

  - CVE-2015-0484: JavaFX: unauthenticated remote attackers     could read, update, insert or delete access some Java     accessible data via multiple protocols and cause a     partial denial of service (partial DOS).

  - CVE-2015-0486: Deployment: unauthenticated remote     attackers could read some JAVA accessible data via     multiple protocols

  - CVE-2015-0488: JSSE: unauthenticated remote attackers     could cause a partial denial of service (partial DOS).

  - CVE-2015-0491: 2D: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0492: JavaFX: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

For Debian 6 'Squeeze', these problems have been fixed in version 6b35-1.13.7-1~deb6u1.

We recommend that you upgrade your openjdk-6 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - The Global Security Kit (GSKit) contains a flaw due to     improper restrictions of TLS state transitions. A     man-in-the-middle attacker can exploit this to downgrade     the security of a session to use EXPORT_RSA ciphers.
    This allows the attacker to more easily break the     encryption and monitor or tamper with the encrypted     stream. (CVE-2015-0138)

  - An unspecified flaw exists that allows an attacker to     execute code running under a security manager with     elevated privileges.(CVE-2015-0192)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-0204)

  - Multiple unspecified vulnerabilities exist in multiple     Java subcomponents including 2D, Beans, Deployment, JCE,     JSSE, and tools. (CVE-2015-0458, CVE-2015-0459,     CVE-2015-0469, CVE-2015-0477, CVE-2015-0478,     CVE-2015-0480, CVE-2015-0486, CVE-2015-0488,     CVE-2015-0491)

  - An unspecified flaw exists that allows a remote attacker     to bypass permission checks and gain access to sensitive     information. (CVE-2015-1914)

  - An unspecified flaw exists due to the Socket Extension     Provider's handling of TLS and SSL connections. A remote     attacker can exploit this to cause a denial of service.
    (CVE-2015-1916)

  - A security feature bypass vulnerability exists, known as     Bar Mitzvah, due to improper combination of state data     with key data by the RC4 cipher algorithm during the     initialization phase. A man-in-the-middle attacker can     exploit this, via a brute-force attack using LSB values,     to decrypt the traffic. (CVE-2015-2808)

IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs.

Tabulated information can be found on: <a href='http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_ Update_May_2015'>http://www.ibm.com/developerworks/java/jdk/alerts/#IB M_Security_Update_May_2015</a>

CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The java-1_7_0-ibm package was updated to version 7.0-9.20 to fix several security and non security issues :

  - bnc#955131: Version update to 7.0-9.20: CVE-2015-4734     CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810     CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843     CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872     CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902     CVE-2015-4903 CVE-2015-4911 CVE-2015-5006

  - Add backcompat symlinks for sdkdir

  - bnc#941939: Fix to provide %{name} instead of %{sdklnk}     only in _jvmprivdir

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to 2D. (CVE-2015-0469)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
82791	RHEL 5 : java-1.7.0-openjdk (RHSA-2015:0807)	Nessus	Red Hat Local Security Checks	4/15/2015	10/24/2019	critical
82803	CentOS 5 / 6 / 7 : java-1.6.0-openjdk (CESA-2015:0808)	Nessus	CentOS Local Security Checks	4/16/2015	1/4/2021	critical
82820	Oracle Java SE Multiple Vulnerabilities (April 2015 CPU) (FREAK)	Nessus	Windows	4/16/2015	12/19/2024	critical
82821	Oracle Java SE Multiple Vulnerabilities (April 2015 CPU) (Unix) (FREAK)	Nessus	Misc.	4/16/2015	4/19/2024	high
82909	RHEL 5 / 6 / 7 : java-1.7.0-oracle (RHSA-2015:0857)	Nessus	Red Hat Local Security Checks	4/21/2015	10/24/2019	critical
82991	Ubuntu 10.04 LTS / 12.04 LTS : openjdk-6 vulnerabilities (USN-2573-1)	Nessus	Ubuntu Local Security Checks	4/22/2015	1/19/2021	critical
83104	Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2015:212)	Nessus	Mandriva Local Security Checks	4/28/2015	1/14/2021	critical
83107	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2015-332)	Nessus	SuSE Local Security Checks	4/28/2015	1/19/2021	critical
83165	Debian DLA-213-1 : openjdk-6 security update	Nessus	Debian Local Security Checks	5/1/2015	1/11/2021	critical
84087	AIX Java Advisory : java_april2015_advisory.asc (Bar Mitzvah) (FREAK)	Nessus	AIX Local Security Checks	6/10/2015	4/21/2023	critical
84337	SUSE SLES11 Security Update : IBM Java (SUSE-SU-2015:1086-2) (Bar Mitzvah) (FREAK)	Nessus	SuSE Local Security Checks	6/23/2015	1/19/2021	critical
87277	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2015:2216-1) (FREAK)	Nessus	SuSE Local Security Checks	12/9/2015	6/18/2024	critical
218414	Linux Distros Unpatched Vulnerability : CVE-2015-0469	Nessus	Misc.	3/4/2025	9/1/2025	high

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

high