java-1_7_0-ibm was updated to fix 21 security issues.

These security issues were fixed :

  - CVE-2015-4729: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45 allowed remote attackers to affect     confidentiality and integrity via unknown vectors     related to Deployment (bsc#938895).

  - CVE-2015-4748: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and Embedded 8u33 allowed remote attackers     to affect confidentiality, integrity, and availability     via unknown vectors related to Security (bsc#938895).

  - CVE-2015-2664: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed local users to affect     confidentiality, integrity, and availability via unknown     vectors related to Deployment (bsc#938895).

  - CVE-2015-0192: Unspecified vulnerability in IBM Java 8     before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1     before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16     FP10 allowed remote attackers to gain privileges via     unknown vectors related to the Java Virtual Machine     (bsc#938895).

  - CVE-2015-2613: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33     allowed remote attackers to affect confidentiality via     vectors related to JCE (bsc#938895).

  - CVE-2015-4731: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java     SE Embedded 8u33 allowed remote attackers to affect     confidentiality, integrity, and availability via vectors     related to JMX (bsc#938895).

  - CVE-2015-2637: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-4733: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via vectors related to RMI     (bsc#938895).

  - CVE-2015-4732: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Libraries, a different vulnerability than     CVE-2015-2590 (bsc#938895).

  - CVE-2015-2621: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33, allowed remote attackers to affect confidentiality     via vectors related to JMX (bsc#938895).

  - CVE-2015-2619: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded     7u75 and 8u33 allowed remote attackers to affect     confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-2590: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Libraries, a different vulnerability than     CVE-2015-4732 (bsc#938895).

  - CVE-2015-2638: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to 2D (bsc#938895).

  - CVE-2015-2625: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via vectors related to JSSE     (bsc#938895).

  - CVE-2015-2632: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed remote attackers to     affect confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-1931: Unspecified vulnerability (bsc#938895).

  - CVE-2015-4760: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to 2D (bsc#938895).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#935540).

  - CVE-2015-2601: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via vectors related to JCE     (bsc#938895).

  - CVE-2015-2808: The RC4 algorithm, as used in the TLS     protocol and SSL protocol, did not properly combine     state data with key data during the initialization     phase, which made it easier for remote attackers to     conduct plaintext-recovery attacks against the initial     bytes of a stream by sniffing network traffic that     occasionally relies on keys affected by the Invariance     Weakness, and then using a brute-force approach     involving LSB values, aka the 'Bar Mitzvah' issue     (bsc#938895).

  - CVE-2015-4749: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect availability via vectors related to JNDI     (bsc#938895).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

For Debian 6 'Squeeze', these issues have been fixed in openjdk-6 version 6b36-1.13.8-1~deb6u1.

We recommend that you upgrade your openjdk-6 packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 51, 7 Update 85, or 6 Update 101. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - CORBA
 - Deployment
 - Hotspot
 - Install
 - JCE
 - JMX
 - JNDI
 - JSSE
 - Libraries
 - RMI
 - Security

The Oracle Java SE installed on the remote host is version 6 prior to Update 101, 7 prior to Update 85, or 8 prior to Update 51 and is affected by multiple vulnerabilities: 

 - A flaw in the 'ObjectInputStream::readSerialData()' function in 'share/classes/java/io/ObjectInputStream.java' that is triggered when handling OIS data allowing a context-dependent attacker to execute arbitrary code. (CVE-2015-2590) 
 - An unspecified flaw related to the Hotspot component may allow a context-dependent attacker to have an impact on integrity. (CVE-2015-2596) 
 - A flaw in the JCE component as various cryptographic operations use non-constant time comparisons allowing a remote attacker to conduct timing attacks in order to possibly glean sensitive information. (CVE-2015-2601)  
 - A flaw in the 'ECDH_Derive()' function in 'share/native/sun/security/ec/impl/ec.c' related to missing EC parameter validation when performing ECDH key derivation allowing a remote attacker to disclose potentially sensitive information. (CVE-2015-2613) 
 - An unspecified flaw related to the 2D component may allow a context-dependent attacker to gain access to sensitive information. (CVE-2015-2619) 
 - A flaw in the 'RMIConnectionImpl' constructor in 'share/classes/javax/management/remote/rmi/RMIConnectionImpl.java'. The issue is triggered due to improper permission checks when creating repository class loaders allowing a context-dependent attacker to bypass sandbox restrictions and disclose sensitive information.  (CVE-2015-2621) 
 - A flaw in the JSSE component that is triggered when performing X.509 certificate identity checks allowing a remote attacker to have a certificate for another domain being accepted as valid. (CVE-2015-2625) 
 - An unspecified flaw related to the Install component allowing a remote attacker to gain access to sensitive information. (CVE-2015-2627) 
 - A typecasting flaw in 'share/classes/com/sun/corba/se/impl/io/IIOPInputStream.java' that is triggered when handling IIOP operations allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-2628) 
 - International Components for Unicode for C/C++ (ICU4C) contains an integer overflow condition in the 'LETableReference::verifyLength()' function in 'layout/LETableReference.h'. With a specially crafted font, a context-dependent attacker can crash an application linked against the library or potentially disclose memory contents. (CVE-2015-2632) 
 - An unspecified flaw related to the 2D component allowing a context-dependent attacker to gain access to sensitive information. (CVE-2015-2637) 
 - An unspecified flaw related to the 2D component allowing a context-dependent attacker to execute arbitrary code. (CVE-2015-2638) 
 - A NULL pointer dereference flaw in 'share/classes/com/sun/crypto/provider/GCTR.java' related to the GCM (Galois Counter Mode) implementation. The issue is triggered when performing encryption using a block cipher in GCM mode and may allow a remote attacker to cause a crash. (CVE-2015-2659) 
 - An unspecified flaw in the Deployment component allowing a local attacker to gain elevated privileges. (CVE-2015-2664) 
 - An unspecified flaw related to the Deployment component may allow a remote attacker to have an impact on confidentiality and integrity. (CVE-2015-4729) 
 - A flaw in 'share/classes/javax/management/MBeanServerInvocationHandler.java' is triggered when handling MBean connection proxy classes allowing a context-dependent attacker to bypass sandbox restrictions and potentially execute arbitrary code. (CVE-2015-4731) 
 - A flaw in 'share/classes/java/io/ObjectInputStream.java' and 'share/classes/java/io/SerialCallbackContext.java' related to insufficient context checks allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-4732) 
 - A flaw in the 'RemoteObjectInvocationHandler::invoke()' function in 'share/classes/java/rmi/server/RemoteObjectInvocationHandler.java'. The issue is triggered as calls to the finalize() method are permitted allowing a context-dependent attacker to bypass sandbox protections and potentially execute arbitrary code. (CVE-2015-4733) 
 - An unspecified flaw related to the Deployment component may allow a context-dependent attacker to execute arbitrary code. (CVE-2015-4736) 
  -  A flaw that is triggered when handling Online Certificate Status Protocol (OCSP) responses with no 'nextUpdate' date specified allowing a remote attacker to cause an application to accept a revoked X.509 certificate. (CVE-2015-4748) 
 - A flaw in the 'DnsClient::query()' function in 'share/classes/com/sun/jndi/dns/DnsClient.java'. The issue is triggered as JNDI DnsClient's exception handling fails to release request information allowing a remote attacker to exhaust memory resources and cause a denial of service. (CVE-2015-4749) 
 -International Components for Unicode for C/C++ (ICU4C) contains overflow conditions in the layout engine. With a specially crafted font, a context-dependent attacker can cause a buffer overflow, crashing an application linked against the library or potentially allowing execution of arbitrary code. (CVE-2015-4760) 

ID	Name	Product	Family	Published	Updated	Severity
85379	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2015:1375-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	8/13/2015	12/5/2022	low
85695	Debian DLA-303-1 : openjdk-6 security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	8/31/2015	12/5/2022	low
700651	Oracle Java SE Multiple 6 < Update 101 / 7 < Update 85 / 8 < Update 51 Multiple Vulnerabilities (July 2015 CPU) (Bar Mitzvah)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	critical
8918	Oracle Java SE 6 < Update 101 / 7 < Update 85 / 8 < Update 51 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/30/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

low

low

critical

critical