java-1_7_0-ibm was updated to fix 21 security issues.

These security issues were fixed :

  - CVE-2015-4729: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45 allowed remote attackers to affect     confidentiality and integrity via unknown vectors     related to Deployment (bsc#938895).

  - CVE-2015-4748: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and Embedded 8u33 allowed remote attackers     to affect confidentiality, integrity, and availability     via unknown vectors related to Security (bsc#938895).

  - CVE-2015-2664: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed local users to affect     confidentiality, integrity, and availability via unknown     vectors related to Deployment (bsc#938895).

  - CVE-2015-0192: Unspecified vulnerability in IBM Java 8     before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1     before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16     FP10 allowed remote attackers to gain privileges via     unknown vectors related to the Java Virtual Machine     (bsc#938895).

  - CVE-2015-2613: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33     allowed remote attackers to affect confidentiality via     vectors related to JCE (bsc#938895).

  - CVE-2015-4731: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java     SE Embedded 8u33 allowed remote attackers to affect     confidentiality, integrity, and availability via vectors     related to JMX (bsc#938895).

  - CVE-2015-2637: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-4733: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via vectors related to RMI     (bsc#938895).

  - CVE-2015-4732: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Libraries, a different vulnerability than     CVE-2015-2590 (bsc#938895).

  - CVE-2015-2621: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33, allowed remote attackers to affect confidentiality     via vectors related to JMX (bsc#938895).

  - CVE-2015-2619: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded     7u75 and 8u33 allowed remote attackers to affect     confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-2590: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Libraries, a different vulnerability than     CVE-2015-4732 (bsc#938895).

  - CVE-2015-2638: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to 2D (bsc#938895).

  - CVE-2015-2625: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via vectors related to JSSE     (bsc#938895).

  - CVE-2015-2632: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed remote attackers to     affect confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-1931: Unspecified vulnerability (bsc#938895).

  - CVE-2015-4760: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to 2D (bsc#938895).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#935540).

  - CVE-2015-2601: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via vectors related to JCE     (bsc#938895).

  - CVE-2015-2808: The RC4 algorithm, as used in the TLS     protocol and SSL protocol, did not properly combine     state data with key data during the initialization     phase, which made it easier for remote attackers to     conduct plaintext-recovery attacks against the initial     bytes of a stream by sniffing network traffic that     occasionally relies on keys affected by the Invariance     Weakness, and then using a brute-force approach     involving LSB values, aka the 'Bar Mitzvah' issue     (bsc#938895).

  - CVE-2015-4749: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect availability via vectors related to JNDI     (bsc#938895).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

For Debian 6 'Squeeze', these issues have been fixed in openjdk-6 version 6b36-1.13.8-1~deb6u1.

We recommend that you upgrade your openjdk-6 packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IBM Java was updated to version 6 SR16 FP7 (6.0-16.7) to fix several security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-1931: IBM Java Security Components store plain     text data in memory dumps, which could allow a local     attacker to obtain information to aid in further attacks     against the system.

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data. (bnc#935540)

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
85379	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2015:1375-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	8/13/2015	12/5/2022	low
85695	Debian DLA-303-1 : openjdk-6 security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	8/31/2015	12/5/2022	low
85869	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2015:1509-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	9/9/2015	12/5/2022	low

Detections

Analytics

Plugins Search

low

low

low