Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.8.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

Multiple flaws were discovered in the Beans and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-0477, CVE-2015-0470)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.8.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0807 advisory.

    [1:1.7.0.75-2.5.5.1.0.1.el5_11]
    - Add oracle-enterprise.patch
    - Fix DISTRO_NAME to 'Oracle Linux'

    [1:1.7.0.75-2.5.5.1]
    - Repacked sources
    - Resolves: rhbz#1209069

    [1:1.7.0.79-2.5.5.0]
    - Bump to 2.5.5 using OpenJDK 7u79 b14.
    - Resolves: rhbz#1209069

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0808 advisory.

  - jar: directory traversal vulnerability (CVE-2005-1080)

  - OpenJDK: incorrect handling of phantom references (Hotspot, 8071931) (CVE-2015-0460)

  - ICU: layout engine glyphStorage off-by-one (OpenJDK 2D, 8067699) (CVE-2015-0469)

  - OpenJDK: incorrect permissions check in resource loading (Beans, 8068320) (CVE-2015-0477)

  - OpenJDK: insufficient hardening of RSA-CRT implementation (JCE, 8071726) (CVE-2015-0478)

  - OpenJDK: jar directory traversal issues (Tools, 8064601) (CVE-2015-0480)

  - OpenJDK: certificate options parsing uncaught exception (JSSE, 8068720) (CVE-2015-0488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

All running instances of OpenJDK Java must be restarted for the update to take effect.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.8.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2005-1080, CVE-2015-0458, CVE-2015-0459, CVE-2015-0460, CVE-2015-0469, CVE-2015-0470, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0484, CVE-2015-0486, CVE-2015-0488, CVE-2015-0491, CVE-2015-0492)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.8.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 8 Update 45 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0477)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080 , CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

OpenJDK was updated to version 2.5.5 - OpenJDK 7u79 to fix security issues and bugs.

The following vulnerabilities have been fixed :

  - Deployment: unauthenticated remote attackers could     execute arbitrary code via multiple protocols.
    (CVE-2015-0458)

  - 2D: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0459)

  - Hotspot: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0460)

  - 2D: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0469)

  - Beans: unauthenticated remote attackers could update,     insert or delete some JAVA accessible data via multiple     protocols. (CVE-2015-0477)

  - JCE: unauthenticated remote attackers could read some     JAVA accessible data via multiple protocols.
    (CVE-2015-0478)

  - Tools: unauthenticated remote attackers could update,     insert or delete some JAVA accessible data via multiple     protocols and cause a partial denial of service (partial     DOS). (CVE-2015-0480)

  - JavaFX: unauthenticated remote attackers could read,     update, insert or delete access some Java accessible     data via multiple protocols and cause a partial denial     of service (partial DOS). (CVE-2015-0484)

  - JSSE: unauthenticated remote attackers could cause a     partial denial of service (partial DOS). (CVE-2015-0488)

  - 2D: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0491)

  - JavaFX: unauthenticated remote attackers could execute     arbitrary code via multiple protocols. (CVE-2015-0492)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1006 advisory.

    IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Further information     about these flaws can be found on the IBM Java Security alerts page, listed     in the References section. (CVE-2005-1080, CVE-2015-0138, CVE-2015-0192,     CVE-2015-0458, CVE-2015-0459, CVE-2015-0469, CVE-2015-0477, CVE-2015-0478,     CVE-2015-0480, CVE-2015-0488, CVE-2015-0491, CVE-2015-1914, CVE-2015-2808)

    The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat     Product Security.

    Note: With this update, the IBM JDK now disables RC4 SSL/TLS cipher suites     by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla     bug 1207101, linked to from the References section, for additional details     about this change.

    All users of java-1.6.0-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 6 SR16-FP4 release. All running     instances of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 and 7 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2005-1080, CVE-2015-0138, CVE-2015-0192, CVE-2015-0458, CVE-2015-0459, CVE-2015-0469, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0488, CVE-2015-0491, CVE-2015-1914, CVE-2015-2808)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

Note: With this update, the IBM JDK now disables RC4 SSL/TLS cipher suites by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug 1207101, linked to in the References section, for additional details about this change.

All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR3 release. All running instances of IBM Java must be restarted for the update to take effect.

The java-1_7_1-ibm package was updated to versioin 7.1-3.20 to fix several security and non security issues :

  - bnc#955131: Version update to 7.1-3.20: CVE-2015-4734     CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810     CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843     CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872     CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902     CVE-2015-4903 CVE-2015-4911 CVE-2015-5006

  - Add backcompat symlinks for sdkdir

  - bnc#941939: Fix to provide %{name} instead of %{sdklnk}     only in _jvmprivdir

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
82802	CentOS 5 : java-1.7.0-openjdk (CESA-2015:0807)	Nessus	CentOS Local Security Checks	4/16/2015	1/4/2021	critical
82804	CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2015:0809)	Nessus	CentOS Local Security Checks	4/16/2015	1/4/2021	critical
82808	Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2015-0807)	Nessus	Oracle Linux Local Security Checks	4/16/2015	10/22/2024	medium
82810	RHEL 5 / 6 / 7 : java-1.6.0-openjdk (RHSA-2015:0808)	Nessus	Red Hat Local Security Checks	4/16/2015	4/27/2024	medium
82813	Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x, SL7.x i386/srpm/x86_64 (20150415)	Nessus	Scientific Linux Local Security Checks	4/16/2015	1/14/2021	critical
82815	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/srpm/x86_64 (20150415)	Nessus	Scientific Linux Local Security Checks	4/16/2015	1/14/2021	critical
82897	RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2015:0854)	Nessus	Red Hat Local Security Checks	4/20/2015	10/24/2019	critical
83059	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-516)	Nessus	Amazon Linux Local Security Checks	4/27/2015	4/18/2018	critical
83287	SuSE 11.3 Security Update : java-1_7_0-openjdk (SAT Patch Number 10621)	Nessus	SuSE Local Security Checks	5/8/2015	1/6/2021	critical
83432	RHEL 6 : java-1.6.0-ibm (RHSA-2015:1006)	Nessus	Red Hat Local Security Checks	5/13/2015	4/15/2025	critical
83753	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2015:1020) (Bar Mitzvah)	Nessus	Red Hat Local Security Checks	5/21/2015	2/5/2021	critical
87404	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2015:2168-2) (FREAK)	Nessus	SuSE Local Security Checks	12/16/2015	6/18/2024	critical

Detections

Analytics

Plugins Search

critical

critical

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical