This update for java-1_7_0-ibm fixes the following issues by updating to 7.0-9.30 (bsc#963937) :

  - CVE-2015-5041: Could could have invoked non-public     interface methods under certain circumstances

  - CVE-2015-7575: The TLS protocol could allow weaker than     expected security caused by a collision attack when     using the MD5 hash function for signing a     ServerKeyExchange message during a TLS handshake. An     attacker could exploit this vulnerability using     man-in-the-middle techniques to impersonate a TLS server     and obtain credentials

  - CVE-2015-7981: libpng could allow a remote attacker to     obtain sensitive information, caused by an out-of-bounds     read in the png_convert_to_rfc1123 function. An attacker     could exploit this vulnerability to obtain sensitive     information

  - CVE-2015-8126: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8472: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8540: libpng is vulnerable to a buffer     overflow, caused by a read underflow in     png_check_keyword in pngwutil.c. By sending an overly     long argument, a remote attacker could overflow a buffer     and execute arbitrary code on the system or cause the     application to crash.

  - CVE-2016-0402: An unspecified vulnerability related to     the Networking component has no confidentiality impact,     partial integrity impact, and no availability impact

  - CVE-2016-0448: An unspecified vulnerability related to     the JMX component could allow a remote attacker to     obtain sensitive information

  - CVE-2016-0466: An unspecified vulnerability related to     the JAXP component could allow a remote attacker to     cause a denial of service

  - CVE-2016-0483: An unspecified vulnerability related to     the AWT component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

  - CVE-2016-0494: An unspecified vulnerability related to     the 2D component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

The following bugs were fixed :

  - bsc#960402: resolve package conflicts in devel package

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093186 advisory.

    Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x     before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26     allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image,     which triggers an out-of-bounds read.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the libpng PNG library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-8472     It was discovered that the original fix for     CVE-2015-8126 was incomplete and did not detect a     potential overrun by applications using png_set_PLTE     directly. A remote attacker can take advantage of this     flaw to cause a denial of service (application crash).

  - CVE-2015-8540     Xiao Qixue and Chen Yu discovered a flaw in the     png_check_keyword function. A remote attacker can     potentially take advantage of this flaw to cause a     denial of service (application crash).

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original     software developer, NLnet Labs) falls within the expected functionality and security controls of the     application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs     has no further information about the claim, and suggests that affected Red Hat customers refer to     available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was     found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption.
    This issue could allow an attacker with local access to provide specially crafted input, potentially     causing the application to crash or allowing arbitrary code execution. This could result in a denial of     service or unauthorized actions on the system.(CVE-2024-43168)

    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with     very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very     large RRsets can cause Unbound to spend a considerable time applying name compression to downstream     replies. This can lead to degraded performance and eventually denial of service in well orchestrated     attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially     crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will     try to apply name compression which was an unbounded operation that could lock the CPU until the whole     packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression     calculations it is willing to do per packet. Packets that need more compression will result in semi-     compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long.
    This change should not affect normal DNS traffic.(CVE-2024-8508)

    The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource     consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later     sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the 'DNSBomb'     issue.(CVE-2024-33655)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201611-08 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities were found in libpng. Please review the       referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could cause a Denial of Service condition or have other       unspecified impacts.
  Workaround :

    There is no known workaround at this time.

This update for java-1_6_0-ibm fixes the following issues by updating to 6.0-16.20 (bsc#963937)

  - CVE-2015-5041: Could could have invoked non-public     interface methods under certain circumstances

  - CVE-2015-7575: The TLS protocol could allow weaker than     expected security caused by a collision attack when     using the MD5 hash function for signing a     ServerKeyExchange message during a TLS handshake. An     attacker could exploit this vulnerability using     man-in-the-middle techniques to impersonate a TLS server     and obtain credentials

  - CVE-2015-7981: libpng could allow a remote attacker to     obtain sensitive information, caused by an out-of-bounds     read in the png_convert_to_rfc1123 function. An attacker     could exploit this vulnerability to obtain sensitive     information

  - CVE-2015-8126: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8472: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8540: libpng is vulnerable to a buffer     overflow, caused by a read underflow in     png_check_keyword in pngwutil.c. By sending an overly     long argument, a remote attacker could overflow a buffer     and execute arbitrary code on the system or cause the     application to crash.

  - CVE-2016-0402: An unspecified vulnerability related to     the Networking component has no confidentiality impact,     partial integrity impact, and no availability impact

  - CVE-2016-0448: An unspecified vulnerability related to     the JMX component could allow a remote attacker to     obtain sensitive information

  - CVE-2016-0466: An unspecified vulnerability related to     the JAXP component could allow a remote attacker to     cause a denial of service

  - CVE-2016-0483: An unspecified vulnerability related to     the AWT component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

  - CVE-2016-0494: An unspecified vulnerability related to     the 2D component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

The following bugs were fixed :

  - bsc#960402: resolve package conflicts in devel package

  - bsc#960286: resolve package conflicts in the fonts     subpackage

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1430 advisory.

    IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 7 to versions 7 SR9-FP40 and 7R1 SR3-FP40.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software     Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page,     listed in the References section. (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806,     CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860,     CVE-2015-4871, CVE-2015-4872, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903,     CVE-2015-5006, CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540,     CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483,     CVE-2016-0494, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443,     CVE-2016-3449)

    Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the     CVE-2015-4806 issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Latest upstream release, includes fixes for security vulnerabilities:
CVE-2015-7981, CVE-2015-8126, CVE-2015-8540

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian host is running a version of libpng prior to 1.2.44-1+squeeze6. It is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds read error exists in the     png_push_read_zTXt() function within file pngpread.c     when decompressing PNG images. An unauthenticated,     remote attacker can exploit this, via a large 'avail_in'     field to cause a denial of service condition.
    (CVE-2012-3425)

  - A buffer overflow condition exists in the png_set_PLTE()     function within file pngset.c and the png_get_PLTE()     function within file pngget.c when handling bit-depth     values less than 8. An unauthenticated, remote attacker     can exploit this, via a specially crafted IHDR chunk     in a PNG image, to cause a denial of service or have     other unspecified impact. (CVE-2015-8472)

  - An integer underflow condition exists in the     png_check_keyword() function within file pngwutil.c. An     unauthenticated, remote attacker can exploit this, via a     specially crafted PNG image using a space character as     a keyword, to cause a denial of service condition or     other unspecified impact. (CVE-2015-8540)

ID	Name	Product	Family	Published	Updated	Severity
88710	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2016:0433-1) (SLOTH)	Nessus	SuSE Local Security Checks	2/12/2016	1/19/2021	critical
340667	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093186)	Nessus	Unity Linux Local Security Checks	8/26/2026	8/28/2026	high
87899	Debian DSA-3443-1 : libpng - security update	Nessus	Debian Local Security Checks	1/14/2016	1/11/2021	high
212639	EulerOS 2.0 SP11 : unbound (EulerOS-SA-2024-2973)	Nessus	Huawei Local Security Checks	12/12/2024	12/12/2024	critical
94892	GLSA-201611-08 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	11/15/2016	1/16/2026	high
89657	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2016:0636-1) (SLOTH)	Nessus	SuSE Local Security Checks	3/4/2016	1/19/2021	critical
89961	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0770-1) (SLOTH)	Nessus	SuSE Local Security Checks	3/16/2016	1/19/2021	critical
92400	RHEL 6 : java-1.7.0-ibm and java-1.7.1-ibm (RHSA-2016:1430)	Nessus	Red Hat Local Security Checks	7/19/2016	4/15/2025	critical
89365	Fedora 22 : libpng12-1.2.56-1.fc22 (2015-ac8100927a)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
92678	Debian DLA-375-1 : libpng Security Update	Nessus	Debian Local Security Checks	8/2/2016	1/29/2026	high

Detections

Analytics

Plugins Search

critical

high

high

critical

high

critical

critical

critical

high

high