The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 91, 7 Update 101, or 6 Update 115. It is, therefore, affected by security vulnerabilities in the following subcomponents :

  - 2D
  - Deployment
  - Hotspot
  - JAXP
  - JCE
  - JMX
  - Security
  - Serialization

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0677 advisory.

    Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software     Development Kit.

    This update upgrades Oracle Java SE 8 to version 8 Update 91.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java     Software Development Kit. Further information about these flaws can be found on the Oracle Java SE     Critical Patch Update Advisory page, listed in the References section. (CVE-2016-0686, CVE-2016-0687,     CVE-2016-0695, CVE-2016-3422, CVE-2016-3425, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.6.0-sun is now available for Oracle Java for Red Hat Enterprise Linux 5, Oracle Java for Red Hat Enterprise Linux 6, and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 6 to version 6 Update 115.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2016-0686, CVE-2016-0687, CVE-2016-0695, CVE-2016-3422, CVE-2016-3425, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)

This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues.

These security issues were fixed :

  - CVE-2016-0686: Ensure thread consistency (bsc#976340).

  - CVE-2016-0687: Better byte behavior (bsc#976340).

  - CVE-2016-0695: Make DSA more fair (bsc#976340).

  - CVE-2016-3425: Better buffering of XML strings     (bsc#976340).

  - CVE-2016-3427: Improve JMX connections (bsc#976340).

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2963-1 advisory.

    Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data     integrity, and availability. An attacker could exploit these to cause a denial of service, expose     sensitive data over the network, or possibly execute arbitrary code. (CVE-2016-0686, CVE-2016-0687,     CVE-2016-3427)

    Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker     could exploit this to expose sensitive data over the network. (CVE-2016-0695, CVE-2016-3426)

    A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could exploit this     to cause a denial of service. (CVE-2016-3425)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0723 advisory.

    [1:1.6.0.39-1.13.11.0]
    - Update to IcedTea 1.13.11 & OpenJDK 6 b39.
    - Resolves: rhbz#1325432

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following components :

  - 2D
  - Deployment
  - Hotspot
  - JCE
  - JMX
  - JVM
  - ORB
  - SDK
  - Serialization

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 91, 7 Update 101, or 6 Update 115. It is, therefore, affected by security vulnerabilities in the following subcomponents :

 - 2D
 - Deployment
 - Hotspot
 - JAXP
 - JCE
 - JMX
 - Security
 - Serialization

The version of Oracle Java SE installed on the remote host is prior to 6 Update 115, 7 Update 101, or 8 Update 92 and is affected by multiple vulnerabilities :

 - An unspecified flaw related to the 'Serialization' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0686)
 - An unspecified flaw related to the 'Hotspot' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0687)
 - An unspecified flaw related to the 'Security' subcomponent may allow a remote attacker to gain access to potentially sensitive information. (CVE-2016-0695)
 - An unspecified flaw related to the '2D' subcomponent may allow a context-dependent attacker to cause a denial of service. (CVE-2016-3422)
 - An unspecified flaw related to the 'JAXP' subcomponent may allow a remote attacker to cause a denial of service. (CVE-2016-3425)
 - An unspecified flaw related to the 'JCE' subcomponent may allow a context-dependent attacker to gain access to potentially sensitive information. (CVE-2016-3426)
 - A flaw related to the 'JMX' subcomponent may allow a remote attacker to execute arbitrary code through Java deserialization. (CVE-2016-3427)
 - An out-of-bounds read flaw within the '2D' subcomponent is triggered when handling specially crafted files. This may allow a context-dependent attacker gain unauthorized access to potentially sensitive information. (CVE-2016-3443)
 - An unspecified flaw related to the 'Deployment' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-3449)

ID	Name	Product	Family	Published	Updated	Severity
90626	Oracle Java SE Multiple Vulnerabilities (April 2016 CPU) (Unix)	Nessus	Misc.	4/21/2016	6/20/2024	critical
90670	RHEL 7 : java-1.8.0-oracle (RHSA-2016:0677)	Nessus	Red Hat Local Security Checks	4/22/2016	4/15/2025	critical
90672	RHEL 5 / 6 / 7 : java-1.6.0-sun (RHSA-2016:0679)	Nessus	Red Hat Local Security Checks	4/22/2016	5/14/2023	critical
90912	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-560)	Nessus	SuSE Local Security Checks	5/5/2016	5/14/2023	critical
90917	Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-2963-1)	Nessus	Ubuntu Local Security Checks	5/5/2016	8/27/2024	critical
91030	Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2016-0723)	Nessus	Oracle Linux Local Security Checks	5/11/2016	4/29/2025	critical
91103	AIX Java Advisory : java_april2016_advisory.asc (April 2016 CPU)	Nessus	AIX Local Security Checks	5/12/2016	5/14/2023	critical
700653	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 91 Multiple Vulnerabilities (April 2016 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	high
9448	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 92 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/8/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

high

critical