The remote host is affected by the vulnerability described in GLSA-201502-12 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s Java SE       Development Kit and Runtime Environment. Please review the CVE       identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       disclose, update, insert, or delete certain data.
  Workaround :

    There is no known workaround at this time.

It was discovered that the Hotspot component in OpenJDK did not properly verify bytecode from the class files. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. (CVE-2014-4216, CVE-2014-4219)

A format string flaw was discovered in the Hotspot component event logger in OpenJDK. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine or, potentially, execute arbitrary code with the privileges of the Java Virtual Machine.
(CVE-2014-2490)

Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
(CVE-2014-4223, CVE-2014-4262, CVE-2014-2483)

Multiple flaws were discovered in the JMX, Libraries, Security, and Serviceability components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221, CVE-2014-4252, CVE-2014-4266)

It was discovered that the RSA algorithm in the Security component in OpenJDK did not sufficiently perform blinding while performing operations that were using private keys. An attacker able to measure timing differences of those operations could possibly leak information about the used keys. (CVE-2014-4244)

The Diffie-Hellman (DH) key exchange algorithm implementation in the Security component in OpenJDK failed to validate public DH parameters properly. This could cause OpenJDK to accept and use weak parameters, allowing an attacker to recover the negotiated key. (CVE-2014-4263)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-460:03 advisory.

    Description :
    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2014-2490     Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote     attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
    CVE-2014-4209     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect     confidentiality and integrity via vectors related to JMX.
    CVE-2014-4216     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to Hotspot.
    CVE-2014-4218     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect     integrity via unknown vectors related to Libraries.
    CVE-2014-4219     Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to Hotspot.
    CVE-2014-4244     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit     R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to     Security.
    CVE-2014-4252     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect     confidentiality via unknown vectors related to Security.
    CVE-2014-4262     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect     confidentiality, integrity, and availability via unknown vectors related to Libraries.
    CVE-2014-4263     Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2,     allows remote attackers to affect confidentiality and integrity via unknown vectors related to Diffie-     Hellman key agreement.
    CVE-2014-4266     Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via     unknown vectors related to Serviceability.
    fixed bugs;
    * Previosuly, an application accessing an unsynchronized HashMap     could potentially enter an infinite loop and consume an excessive amount of     CPU resources. With this update, fixed it.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0907 advisory.

    [1:1.6.0.1-6.1.13.4]
    - moved to  icedteaver 1.13.4
    - moved to openjdkver b32 and openjdkdate 15_jul_2014
    - added upstreamed patch patch9 rh1115580-unsyncHashMap.patch
    - Resolves: rhbz#1115580
    - Resolves: rhbz#1115867

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-2490, CVE-2014-4216, CVE-2014-4219, CVE-2014-4262)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to expose sensitive data over the network. (CVE-2014-4209, CVE-2014-4244, CVE-2014-4263)

Two vulnerabilities were discovered in the OpenJDK JRE related to data integrity. (CVE-2014-4218, CVE-2014-4266)

Two vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2014-4252, CVE-2014-4268).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
81370	GLSA-201502-12 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2/16/2015	1/11/2021	critical
76552	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20140716)	Nessus	Scientific Linux Local Security Checks	7/17/2014	1/14/2021	high
291514	MiracleLinux 4 : java-1.6.0-openjdk-1.6.0.0-6.1.13.4.AXS4 (AXSA:2014-460:03)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	critical
76631	Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2014-0907)	Nessus	Oracle Linux Local Security Checks	7/22/2014	10/22/2024	high
77181	Ubuntu 10.04 LTS / 12.04 LTS : openjdk-6 vulnerabilities (USN-2312-1)	Nessus	Ubuntu Local Security Checks	8/13/2014	1/19/2021	high

Detections

Analytics

Plugins Search

critical

high

critical

high

high