The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-409:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590     CVE-2015-2601     CVE-2015-2621     CVE-2015-2625     CVE-2015-2628     CVE-2015-2632     CVE-2015-2808     CVE-2015-4000     CVE-2015-4731     CVE-2015-4732     CVE-2015-4733     CVE-2015-4748     CVE-2015-4749     CVE-2015-4760

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1228 advisory.

    [1:1.8.0.51-1.b16]
    - Add md5sum for January 2015 java.security update so it gets updated this time.
    - Resolves: rhbz#1235162

    [1:1.8.0.51-0.b16]
    - July 2015 security update to u51b16.
    - Add script for generating OpenJDK tarballs from a local Mercurial tree.
    - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
    - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
    - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
    - Re-generate EC disablement patch following CPU DH changes.
    - Resolves: rhbz#1235162

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic.
(CVE-2015-4000)

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621, CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

All running instances of OpenJDK Java must be restarted for the update to take effect.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2015-4760 , CVE-2015-2628 , CVE-2015-4731 , CVE-2015-2590 , CVE-2015-4732 , CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601)

It was discovered that the GCM (Galois Counter Mode) implementation in the Security component of OpenJDK failed to properly perform a null check. This could cause the Java Virtual Machine to crash when an application performed encryption using a block cipher in the GCM mode.
(CVE-2015-2659)

A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808)

Please note that with this update, OpenJDK now disables RC4 TLS/SSL cipher suites by default to address the CVE-2015-2808 issue.

A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic.
(CVE-2015-4000)

Please note that this update forces the TLS/SSL client implementation in OpenJDK to reject DH key sizes below 768 bits, which prevents sessions to be downgraded to export-grade keys.

It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749)

Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
(CVE-2015-2621 , CVE-2015-2632)

A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address.
(CVE-2015-2625)

Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1526 advisory.

    [1:1.6.0.36-1.13.8.1]
    - Update tarball to fix TCK regression (PR2565)
    - Resolves: rhbz#1235153

    [1:1.6.0.36-1.13.8.0]
    - Update to IcedTea 1.13.8
    - Update no_pr2125.patch to work against new version.
    - Resolves: rhbz#1235153

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_6_0-ibm fixes the following issues :

  - Version update to 6.0-16.15 bsc#955131: CVE-2015-4734     CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810     CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843     CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872     CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902     CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 CVE-2015-2808     CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469     CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478     CVE-2015-0477 CVE-2015-0204

  - Add backcompat symlinks for sdkdir

  - Fix baselibs.conf policy symlinking

  - Fix bsc#941939 to provide %{name} instead of %{sdklnk}     only in _jvmprivdir

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
289535	MiracleLinux 4 : java-1.6.0-openjdk-1.6.0.36-1.13.8.1.AXS4 (AXSA:2015-409:03)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/17/2026	critical
84784	Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2015-1228)	Nessus	Oracle Linux Local Security Checks	7/16/2015	4/29/2025	critical
84791	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x i386/x86_64 (20150715) (Bar Mitzvah) (Logjam)	Nessus	Scientific Linux Local Security Checks	7/16/2015	12/5/2022	low
84931	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2015-571) (Bar Mitzvah) (Logjam)	Nessus	Amazon Linux Local Security Checks	7/23/2015	12/5/2022	medium
85137	Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2015-1526)	Nessus	Oracle Linux Local Security Checks	7/31/2015	10/22/2024	critical
119972	SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2015:2192-1) (Bar Mitzvah) (FREAK)	Nessus	SuSE Local Security Checks	1/2/2019	2/12/2025	medium

Detections

Analytics

Plugins Search

critical

critical

low

medium

critical

medium