IBM Java was updated to version 6.0-16.20, fixing various security issues.

More information can be found on <a href='http://www.ibm.com/developerworks/java/jdk/alerts/'>http://www.i bm.com/developerworks/java/jdk/alerts/</a>.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0050 advisory.

    [1:1.8.0.71-1.b15]
    - Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
    - Resolves: rhbz#1295751

    [1:1.8.0.71-0.b15]
    - January 2016 security update to u71b15.
    - Improve verbosity and helpfulness of tarball generation script.
    - Update patch documentation using version originally written for Fedora.
    - Drop prelink requirement as we no longer use execstack.
    - Drop ifdefbugfix patch as this is fixed upstream.
    - Provide optional boostrap build and turn it off by default.
    - Add patch for size_t formatting on s390 as size_t != intptr_t there.
    - Resolves: rhbz#1295751

    [1:1.8.0.65-4.b17]
    - Add flag logic back to spec file but disable for now.
    - Restore system-lcms.patch as used in October CPU.
    - Resolves: rhbz#1295751

    [1:1.8.0.65-3.b17]
    - moved to integration forest
    - sync with rhel7
    - Resolves: rhbz#1295751

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code.
An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483)

An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.
(CVE-2016-0466)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)

Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4871, CVE-2016-0402, CVE-2016-0448)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0067 advisory.

    [1.6.0.38-1.13.10.0.0.1]
    - Add oracle-enterprise.patch

    [1:1.6.0.38-1.13.10.0]
    - Add patch to replace -fno-strict-overflow with -fwrapv on older RHEL 5.11 GCC.
    - Resolves: rhbz#1295772

    [1:1.6.0.38-1.13.10.0]
    - Update to IcedTea 1.13.10 & OpenJDK 6 b38.
    - Resolves: rhbz#1295772

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit.

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code.
An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483)

An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.
(CVE-2016-0466)

Multiple flaws were discovered in the Networking and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-0402, CVE-2016-0448)

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

java-1_8_0-openjdk was updated to version 7u95 to fix several security issues. (bsc#962743)

The following vulnerabilities were fixed :

  - CVE-2015-7575: Further reduce use of MD5 (SLOTH)     (bsc#960996)

  - CVE-2015-8126: Vulnerability in the AWT component     related to splashscreen displays

  - CVE-2015-8472: Vulnerability in the AWT component,     addressed by same fix

  - CVE-2016-0402: Vulnerability in the Networking component     related to URL processing

  - CVE-2016-0448: Vulnerability in the JMX comonent related     to attribute processing

  - CVE-2016-0466: Vulnerability in the JAXP component,     related to limits

  - CVE-2016-0483: Vulnerability in the AWT component     related to image decoding

  - CVE-2016-0494: Vulnerability in 2D component related to     font actions

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 71, 7 Update 95, or 6 Update 111. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - AWT
 - JAXP
 - JMX
 - Libraries
 - Networking
 - Security

ID	Name	Product	Family	Published	Updated	Severity
89989	SUSE SLES10 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0776-1) (SLOTH)	Nessus	SuSE Local Security Checks	3/17/2016	1/6/2021	critical
88069	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2016-0050)	Nessus	Oracle Linux Local Security Checks	1/22/2016	2/18/2025	high
88072	RHEL 6 : java-1.7.0-openjdk (RHSA-2016:0053) (SLOTH)	Nessus	Red Hat Local Security Checks	1/22/2016	10/24/2019	medium
88403	Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2016-0067)	Nessus	Oracle Linux Local Security Checks	1/27/2016	10/22/2024	critical
88404	RHEL 5 / 6 / 7 : java-1.6.0-openjdk (RHSA-2016:0067)	Nessus	Red Hat Local Security Checks	1/27/2016	10/24/2019	critical
88453	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2016:0256-1) (SLOTH)	Nessus	SuSE Local Security Checks	1/28/2016	1/6/2021	high
88386	CentOS 5 / 6 / 7 : java-1.6.0-openjdk (CESA-2016:0067)	Nessus	CentOS Local Security Checks	1/27/2016	1/4/2021	critical
700654	Oracle Java SE 6 < Update 111 / 7 < Update 95 / 8 < Update 71 Multiple Vulnerabilities (January 2016 CPU) (SLOTH)	Nessus Network Monitor	Web Clients	5/2/2019	5/17/2019	critical

Detections

Analytics

Plugins Search

critical

high

medium

critical

critical

high

critical

critical