Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Satellite 5.6 and 5.7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

Users of Red Hat Satellite 5.6 and 5.7 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR16-FP7 release.
For this update to take effect, Red Hat Satellite must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-185:04 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-186:02 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2659
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-3149
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1242 advisory.

    Oracle Java SE version 7 includes the Oracle Java Runtime Environment and     the Oracle Java Software Development Kit.

    This update fixes several vulnerabilities in the Oracle Java Runtime     Environment and the Oracle Java Software Development Kit. Further     information about these flaws can be found on the Oracle Java SE Critical     Patch Update Advisory page, listed in the References section.
    (CVE-2015-2590, CVE-2015-2596, CVE-2015-2601, CVE-2015-2613, CVE-2015-2619,     CVE-2015-2621, CVE-2015-2625, CVE-2015-2627, CVE-2015-2628, CVE-2015-2632,     CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-2808, CVE-2015-4000,     CVE-2015-4729, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736,     CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

    Note: With this update, Oracle JDK now disables RC4 TLS/SSL cipher suites     by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla     bug 1207101, linked to in the References section, for additional details     about this change.

    Note: This update forces the TLS/SSL client implementation in Oracle JDK to     reject DH key sizes below 768 bits to address the CVE-2015-4000 issue.
    Refer to Red Hat Bugzilla bug 1223211, linked to in the References section,     for additional details about this change.

    All users of java-1.7.0-oracle are advised to upgrade to these updated     packages, which provide Oracle Java 7 Update 85 and resolve these issues.
    All running instances of Oracle Java must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1485 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment     and the IBM Java Software Development Kit.

    This update fixes several vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Further information     about these flaws can be found on the IBM Java Security alerts page, listed     in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601,     CVE-2015-2613, CVE-2015-2619, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632,     CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4729,     CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736, CVE-2015-4748,     CVE-2015-4749, CVE-2015-4760)

    Note: This update forces the TLS/SSL client implementation in IBM JDK to     reject DH key sizes below 768 bits to address the CVE-2015-4000 issue.
    Refer to Red Hat Bugzilla bug 1223211, linked to in the References section,     for additional details about this change.

    All users of java-1.7.1-ibm are advised to upgrade to these updated     packages, containing the IBM Java SE 7R1 SR3-FP10 release. All running     instances of IBM Java must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2596: Difficult to exploit vulnerability in the     Hotspot component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized update, insert or delete access to some     Java accessible data.

  - CVE-2015-2597: Easily exploitable vulnerability in the     Install component requiring logon to Operating System.
    Successful attack of this vulnerability could have     resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2627: Very difficult to exploit vulnerability     in the Install component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized read access to a subset of Java     accessible data.

  - CVE-2015-2628: Easily exploitable vulnerability in the     CORBA component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data.

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4736: Difficult to exploit vulnerability in the     Deployment component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to 2D. (CVE-2015-4760)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
85373	RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:1604) (Logjam)	Nessus	Red Hat Local Security Checks	8/13/2015	4/25/2023	medium
289911	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.85-2.6.1.3.AXS4 (AXSA:2015-185:04)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/17/2026	critical
291500	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.51-0.b16.AXS4 (AXSA:2015-186:02)	Nessus	Miracle Linux Local Security Checks	1/19/2026	2/5/2026	critical
84872	RHEL 7 : java-1.7.0-oracle (RHSA-2015:1242)	Nessus	Red Hat Local Security Checks	7/20/2015	4/15/2025	critical
84955	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2015:1485)	Nessus	Red Hat Local Security Checks	7/23/2015	3/20/2025	critical
85153	SUSE SLED11 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1320-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	7/31/2015	12/5/2022	low
218970	Linux Distros Unpatched Vulnerability : CVE-2015-4760	Nessus	Misc.	3/4/2025	9/14/2025	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical

critical

low

critical