Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-409:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590     CVE-2015-2601     CVE-2015-2621     CVE-2015-2625     CVE-2015-2628     CVE-2015-2632     CVE-2015-2808     CVE-2015-4000     CVE-2015-4731     CVE-2015-4732     CVE-2015-4733     CVE-2015-4748     CVE-2015-4749     CVE-2015-4760

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1228 advisory.

    [1:1.8.0.51-1.b16]
    - Add md5sum for January 2015 java.security update so it gets updated this time.
    - Resolves: rhbz#1235162

    [1:1.8.0.51-0.b16]
    - July 2015 security update to u51b16.
    - Add script for generating OpenJDK tarballs from a local Mercurial tree.
    - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
    - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
    - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
    - Re-generate EC disablement patch following CPU DH changes.
    - Resolves: rhbz#1235162

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic.
(CVE-2015-4000)

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621, CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

All running instances of OpenJDK Java must be restarted for the update to take effect.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2015-4760 , CVE-2015-2628 , CVE-2015-4731 , CVE-2015-2590 , CVE-2015-4732 , CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

It was discovered that the GCM (Galois Counter Mode) implementation in the Security component of OpenJDK failed to properly perform a null check. This could cause the Java Virtual Machine to crash when an application performed encryption using a block cipher in the GCM mode.
(CVE-2015-2659)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

Please note that with this update, OpenJDK now disables RC4 TLS/SSL cipher suites by default to address the CVE-2015-2808 issue.

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic.
(CVE-2015-4000)

Please note that this update forces the TLS/SSL client implementation in OpenJDK to reject DH key sizes below 768 bits, which prevents sessions to be downgraded to export-grade keys.

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621 , CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1526 advisory.

    [1:1.6.0.36-1.13.8.1]
    - Update tarball to fix TCK regression (PR2565)
    - Resolves: rhbz#1235153

    [1:1.6.0.36-1.13.8.0]
    - Update to IcedTea 1.13.8
    - Update no_pr2125.patch to work against new version.
    - Resolves: rhbz#1235153

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
91328	F5 Networks BIG-IP : Java SE vulnerabilities (SOL17079)	Nessus	F5 Networks Local Security Checks	5/26/2016	3/8/2022	critical
289535	MiracleLinux 4 : java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4 (AXSA:2015-409:03)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/17/2026	critical
84784	Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2015-1228)	Nessus	Oracle Linux Local Security Checks	7/16/2015	4/29/2025	critical
84791	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x i386/x86_64 (20150715) (Bar Mitzvah) (Logjam)	Nessus	Scientific Linux Local Security Checks	7/16/2015	12/5/2022	low
84931	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2015-571) (Bar Mitzvah) (Logjam)	Nessus	Amazon Linux Local Security Checks	7/23/2015	12/5/2022	medium
85137	Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2015-1526)	Nessus	Oracle Linux Local Security Checks	7/31/2015	10/22/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

low

medium

critical