The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3046 advisory.

    Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software     Development Kit.

    This update upgrades Oracle Java SE 7 to version 7 Update 161.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java     Software Development Kit. Further information about these flaws can be found on the Oracle Java SE     Critical Patch Update Advisory page listed in the References section. (CVE-2016-9840, CVE-2016-9841,     CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-10274, CVE-2017-10281, CVE-2017-10285,     CVE-2017-10293, CVE-2017-10295, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348,     CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357, CVE-2017-10388)

    Note: Starting with this update, Java web browser plugin and Java Web Start application are no longer     included with Oracle Java SE 7. Refer to the Releases Notes and the Oracle Java SE Support Roadmap pages     linked to in the References section for further information about this change.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-openjdk fixes the following issues :

  - Update to version jdk8u151 (icedtea 3.6.0) Security     issues fixed :

  - CVE-2017-10274: Handle smartcard clean up better     (bsc#1064071)

  - CVE-2017-10281: Better queuing priorities (bsc#1064072)

  - CVE-2017-10285: Unreferenced references (bsc#1064073)

  - CVE-2017-10295: Better URL connections (bsc#1064075)

  - CVE-2017-10388: Correct Kerberos ticket grants     (bsc#1064086)

  - CVE-2017-10346: Better invokespecial checks     (bsc#1064078)

  - CVE-2017-10350: Better Base Exceptions (bsc#1064082)

  - CVE-2017-10347: Better timezone processing (bsc#1064079)

  - CVE-2017-10349: Better X processing (bsc#1064081)

  - CVE-2017-10345: Better keystore handling (bsc#1064077)

  - CVE-2017-10348: Better processing of unresolved     permissions (bsc#1064080)

  - CVE-2017-10357: Process Proxy presentation (bsc#1064085)

  - CVE-2017-10355: More stable connection processing     (bsc#1064083)

  - CVE-2017-10356: Update storage implementations     (bsc#1064084)

  - CVE-2016-10165: Improve CMS header processing     (bsc#1064069)

  - CVE-2016-9840, CVE-2016-9841, CVE-2016-9842,     CVE-2016-9843: Upgrade compression library (bsc#1064070)     Bug fixes :

  - Fix bsc#1032647, bsc#1052009 with btrfs subvolumes and     overlayfs

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_1-ibm fixes the following issues :

  - Security update to version 7.1.4.15 [bsc#1070162]

  - CVE-2017-10349: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10348: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10388: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2016-9841: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10293: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10345: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10350: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10356: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10357: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10347: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10355: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10285: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10281: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10295: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10346: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2016-10165: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
104139	RHEL 7 : java-1.7.0-oracle (RHSA-2017:3046)	Nessus	Red Hat Local Security Checks	10/25/2017	3/20/2025	critical
104531	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2989-1)	Nessus	SuSE Local Security Checks	11/13/2017	11/14/2025	critical
105506	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2017:3455-1)	Nessus	SuSE Local Security Checks	1/2/2018	11/10/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical