According to the version of the lcms2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Type_MLU_Read function in cmstypes.c in Little CMS     (aka lcms2) allows remote attackers to obtain sensitive     information or cause a denial of service via an image     with a crafted ICC profile, which triggers an     out-of-bounds heap read.(CVE-2016-10165)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain     sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers     an out-of-bounds heap read. (CVE-2016-10165)

Note that Nessus relies on the presence of the package as reported by the vendor.

An out of bounds read was found in lcms2, which can lead to heap memory leak or denial of service via a specially crafted ICC profile.

For Debian 7 'Wheezy', these problems have been fixed in version 2.2+git20110628-2.2+deb7u2.

We recommend that you upgrade your lcms2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. (CVE-2016-5582)

* It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application. (CVE-2016-5573)

* It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification.
This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2016-5542)

Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms.

* A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554)

* A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication.
(CVE-2016-5597)

Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2999 advisory.

    Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software     Development Kit.

    This update upgrades Oracle Java SE 8 to version 8 Update 151.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java     Software Development Kit. Further information about these flaws can be found on the Oracle Java SE     Critical Patch Update Advisory page listed in the References section. (CVE-2016-9840, CVE-2016-9841,     CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-10274, CVE-2017-10281, CVE-2017-10285,     CVE-2017-10293, CVE-2017-10295, CVE-2017-10309, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347,     CVE-2017-10348, CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357,     CVE-2017-10388)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk fixes the following issues:
Security issues fixed :

  - CVE-2017-10356: Fix issue inside subcomponent Security     (bsc#1064084).

  - CVE-2017-10274: Fix issue inside subcomponent Smart Card     IO (bsc#1064071).

  - CVE-2017-10281: Fix issue inside subcomponent     Serialization (bsc#1064072).

  - CVE-2017-10285: Fix issue inside subcomponent RMI     (bsc#1064073).

  - CVE-2017-10295: Fix issue inside subcomponent Networking     (bsc#1064075).

  - CVE-2017-10388: Fix issue inside subcomponent Libraries     (bsc#1064086).

  - CVE-2017-10346: Fix issue inside subcomponent Hotspot     (bsc#1064078).

  - CVE-2017-10350: Fix issue inside subcomponent JAX-WS     (bsc#1064082).

  - CVE-2017-10347: Fix issue inside subcomponent     Serialization (bsc#1064079).

  - CVE-2017-10349: Fix issue inside subcomponent JAXP     (bsc#1064081).

  - CVE-2017-10345: Fix issue inside subcomponent     Serialization (bsc#1064077).

  - CVE-2017-10348: Fix issue inside subcomponent Libraries     (bsc#1064080).

  - CVE-2017-10357: Fix issue inside subcomponent     Serialization (bsc#1064085).

  - CVE-2017-10355: Fix issue inside subcomponent Networking     (bsc#1064083).

  - CVE-2017-10102: Fix incorrect handling of references in     DGC (bsc#1049316).

  - CVE-2017-10053: Fix reading of unprocessed image data in     JPEGImageReader (bsc#1049305).

  - CVE-2017-10067: Fix JAR verifier incorrect handling of     missing digest (bsc#1049306).

  - CVE-2017-10081: Fix incorrect bracket processing in     function signature handling (bsc#1049309).

  - CVE-2017-10087: Fix insufficient access control checks     in ThreadPoolExecutor (bsc#1049311).

  - CVE-2017-10089: Fix insufficient access control checks     in ServiceRegistry (bsc#1049312).

  - CVE-2017-10090: Fix insufficient access control checks     in AsynchronousChannelGroupImpl (bsc#1049313).

  - CVE-2017-10096: Fix insufficient access control checks     in XML transformations (bsc#1049314).

  - CVE-2017-10101: Fix unrestricted access to     com.sun.org.apache.xml.internal.resolver (bsc#1049315).

  - CVE-2017-10107: Fix insufficient access control checks     in ActivationID (bsc#1049318).

  - CVE-2017-10074: Fix integer overflows in range check     loop predicates (bsc#1049307).

  - CVE-2017-10110: Fix insufficient access control checks     in ImageWatched (bsc#1049321).

  - CVE-2017-10108: Fix unbounded memory allocation in     BasicAttribute deserialization (bsc#1049319).

  - CVE-2017-10109: Fix unbounded memory allocation in     CodeSource deserialization (bsc#1049320).

  - CVE-2017-10115: Fix unspecified vulnerability in     subcomponent JCE (bsc#1049324).

  - CVE-2017-10118: Fix ECDSA implementation timing attack     (bsc#1049326).

  - CVE-2017-10116: Fix LDAPCertStore following referrals to     non-LDAP URL (bsc#1049325).

  - CVE-2017-10135: Fix PKCS#8 implementation timing attack     (bsc#1049328).

  - CVE-2017-10176: Fix incorrect handling of certain EC     points (bsc#1049329).

  - CVE-2017-10074: Fix integer overflows in range check     loop predicates (bsc#1049307).

  - CVE-2017-10074: Fix integer overflows in range check     loop predicates (bsc#1049307).

  - CVE-2017-10111: Fix checks in LambdaFormEditor     (bsc#1049322).

  - CVE-2017-10243: Fix unspecified vulnerability in     subcomponent JAX-WS (bsc#1049332).

  - CVE-2017-10125: Fix unspecified vulnerability in     subcomponent deployment (bsc#1049327).

  - CVE-2017-10114: Fix unspecified vulnerability in     subcomponent JavaFX (bsc#1049323).

  - CVE-2017-10105: Fix unspecified vulnerability in     subcomponent deployment (bsc#1049317).

  - CVE-2017-10086: Fix unspecified in subcomponent JavaFX     (bsc#1049310).

  - CVE-2017-10198: Fix incorrect enforcement of certificate     path restrictions (bsc#1049331).

  - CVE-2017-10193: Fix incorrect key size constraint check     (bsc#1049330). Bug fixes :

  - Drop Exec Shield workaround to fix crashes on recent     kernels, where Exec Shield is gone (bsc#1052318).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-ibm fixes the following issues :

  - Security update to version 7.0.10.15 (bsc#1070162) :

  - CVE-2017-10346 CVE-2017-10285 CVE-2017-10388     CVE-2017-10356 CVE-2017-10293 CVE-2016-9841     CVE-2016-10165 CVE-2017-10355 CVE-2017-10357     CVE-2017-10348 CVE-2017-10349 CVE-2017-10347     CVE-2017-10350 CVE-2017-10281 CVE-2017-10295     CVE-2017-10345

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
131893	EulerOS 2.0 SP2 : lcms2 (EulerOS-SA-2019-2401)	Nessus	Huawei Local Security Checks	12/10/2019	4/4/2024	high
219157	Linux Distros Unpatched Vulnerability : CVE-2016-10165	Nessus	Misc.	3/4/2025	8/18/2025	high
96818	Debian DLA-803-1 : lcms2 security update	Nessus	Debian Local Security Checks	1/27/2017	1/2/2026	high
94740	CentOS 5 / 6 / 7 : java-1.7.0-openjdk (CESA-2016:2658)	Nessus	CentOS Local Security Checks	11/14/2016	1/4/2021	critical
104116	RHEL 7 : java-1.8.0-oracle (RHSA-2017:2999)	Nessus	Red Hat Local Security Checks	10/24/2017	3/24/2025	critical
105538	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2018:0005-1)	Nessus	SuSE Local Security Checks	1/4/2018	11/10/2025	critical
105744	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0061-1)	Nessus	SuSE Local Security Checks	1/11/2018	11/6/2025	critical

Detections

Analytics

Plugins Search

high

high

high

critical

critical

critical

critical