The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7667-1 advisory.

    It was discovered that the 2D component of OpenJDK 8 did not properly manage memory under certain     circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. (CVE-2025-30749, CVE-2025-50106)

    Mashroor Hasan Bhuiyan discovered that the JSSE component of OpenJDK 8 did not properly manage TLS 1.3     handshakes under certain circumstances. An attacker could possibly use this issue to obtain sensitive     information. (CVE-2025-30754)

    It was discovered that the Scripting component of OpenJDK 8 did not properly manage properties under     certain circumstances. An attacker could possibly use this issue to cause a denial of service, execute     arbitrary code or bypass Java sandbox restrictions. (CVE-2025-30761)

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    https://openjdk.org/groups/vulnerability/advisories/2025-07-15

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02545-1 advisory.

    Update to OpenJDK 8u462 build 08 with OpenJ9 0.53.0 virtual machine:

    - CVE-2025-30749: several scenarios can lead to heap corruption (Oracle CPU 2025-07) (bsc#1246595)
    - CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (Oracle CPU 2025-07)     (bsc#1246598)
    - CVE-2025-30761: Improve scripting supports (Oracle CPU 2025-07) (bsc#1246580)
    - CVE-2025-50059: Improve HTTP client header handling (Oracle CPU 2025-07) (bsc#1246575)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02563-1 advisory.

    Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

    Security fixes:

    - CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
    - CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
    - CVE-2025-30761: Improve scripting supports (bsc#1246580)
    - CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
    - CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

    Changelog:

        - JDK-8026976: ECParameters, Point does not match field size
        - JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong           value
        - JDK-8231058: VerifyOops crashes with assert(_offset >= 0)           failed: offset for non comment?
        - JDK-8232625: HttpClient redirect policy should be more           conservative
        - JDK-8258483: [TESTBUG] gtest           CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is           too small
        - JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are           problematic
        - JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
        - JDK-8301753: AppendFile/WriteFile has differences between make           3.81 and 4+
        - JDK-8303770: Remove Baltimore root certificate expiring in May           2025
        - JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
        - JDK-8327476: Upgrade JLine to 3.26.1
        - JDK-8328957: Update PKCS11Test.java to not use hardcoded path
        - JDK-8331959: Update PKCS#11 Cryptographic Token Interface to           v3.1
        - JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm           gtest fails on ppc64 based platforms
        - JDK-8339728: [Accessibility,Windows,JAWS] Bug in the           getKeyChar method of the AccessBridge class
        - JDK-8345133: Test sun/security/tools/jarsigner/           /TsacertOptionTest.java failed: Warning found in stdout
        - JDK-8345625: Better HTTP connections
        - JDK-8346887: DrawFocusRect() may cause an assertion failure
        - JDK-8347629: Test FailOverDirectExecutionControlTest.java           fails with -Xcomp
        - JDK-8348110: Update LCMS to 2.17
        - JDK-8348596: Update FreeType to 2.13.3
        - JDK-8348598: Update Libpng to 1.6.47
        - JDK-8348989: Better Glyph drawing
        - JDK-8349111: Enhance Swing supports         + JDK-8349594: Enhance TLS protocol support         + JDK-8350469: [11u] Test AbsPathsInImage.java fails
          - JDK-8239429 public clone         + JDK-8350498: Remove two Camerfirma root CA certificates         + JDK-8350991: Improve HTTP client header handling         + JDK-8351099: Bump update version of OpenJDK: 11.0.28         + JDK-8351422: Improve scripting supports         + JDK-8352302: Test sun/security/tools/jarsigner/           /TimestampCheck.java is failing         + JDK-8352716: (tz) Update Timezone Data to 2025b         + JDK-8356096: ISO 4217 Amendment 179 Update         + JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS         + JDK-8359170: Add 2 TLS and 2 CS Sectigo roots         + JDK-8360147: Better Glyph drawing redux

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02666-1 advisory.

    Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

    Security fixes:

    - CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
    - CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
    - CVE-2025-30761: Improve scripting supports (bsc#1246580)
    - CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
    - CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

    Changelog:

        - JDK-8026976: ECParameters, Point does not match field size
        - JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong           value
        - JDK-8231058: VerifyOops crashes with assert(_offset >= 0)           failed: offset for non comment?
        - JDK-8232625: HttpClient redirect policy should be more           conservative
        - JDK-8258483: [TESTBUG] gtest           CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is           too small
        - JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are           problematic
        - JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
        - JDK-8301753: AppendFile/WriteFile has differences between make           3.81 and 4+
        - JDK-8303770: Remove Baltimore root certificate expiring in May           2025
        - JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
        - JDK-8327476: Upgrade JLine to 3.26.1
        - JDK-8328957: Update PKCS11Test.java to not use hardcoded path
        - JDK-8331959: Update PKCS#11 Cryptographic Token Interface to           v3.1
        - JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm           gtest fails on ppc64 based platforms
        - JDK-8339728: [Accessibility,Windows,JAWS] Bug in the           getKeyChar method of the AccessBridge class
        - JDK-8345133: Test sun/security/tools/jarsigner/           /TsacertOptionTest.java failed: Warning found in stdout
        - JDK-8345625: Better HTTP connections
        - JDK-8346887: DrawFocusRect() may cause an assertion failure
        - JDK-8347629: Test FailOverDirectExecutionControlTest.java           fails with -Xcomp
        - JDK-8348110: Update LCMS to 2.17
        - JDK-8348596: Update FreeType to 2.13.3
        - JDK-8348598: Update Libpng to 1.6.47
        - JDK-8348989: Better Glyph drawing
        - JDK-8349111: Enhance Swing supports         + JDK-8349594: Enhance TLS protocol support         + JDK-8350469: [11u] Test AbsPathsInImage.java fails
          - JDK-8239429 public clone         + JDK-8350498: Remove two Camerfirma root CA certificates         + JDK-8350991: Improve HTTP client header handling         + JDK-8351099: Bump update version of OpenJDK: 11.0.28         + JDK-8351422: Improve scripting supports         + JDK-8352302: Test sun/security/tools/jarsigner/           /TimestampCheck.java is failing         + JDK-8352716: (tz) Update Timezone Data to 2025b         + JDK-8356096: ISO 4217 Amendment 179 Update         + JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS         + JDK-8359170: Add 2 TLS and 2 CS Sectigo roots         + JDK-8360147: Better Glyph drawing redux

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0134 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-30749:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451,     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1     (Confidentiality, Integrity and Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

    CVE-2025-30754:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u451,     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert     or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. This vulnerability does not apply to Java deployments, typically in servers, that load and     run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality     and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

    CVE-2025-30761:
    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and     11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

    CVE-2025-50106:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451,     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality,     Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10861 advisory.

    [1:1.8.0.462.b08-1.0.1]
    - Update to 8u462-b08 (GA) [Orabug: 38248370]
    - Update release notes for 8u462-b08.
    - Require tzdata 2025b due to upstream inclusion of JDK-8352716
    - Add early backport of JDK-8339414
    - Sync the copy of the portable specfile with the latest update
    - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
    - Resolves: RHEL-101654
    - Resolves: RHEL-102307
    - Resolves: RHEL-102907

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13656 advisory.

    This update upgrades the IBM Semeru Runtime Certified Edition 21 runtime environment to version 21.0.8+9.

    Security Fix(es):

    * CVE-2025-30749
    * CVE-2025-30754
    * CVE-2025-50059
    * CVE-2025-50106

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4275 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4275-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     August 19, 2025                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openjdk-17     Version        : 17.0.16+8-1~deb11u1     CVE ID         : CVE-2025-30749 CVE-2025-30754 CVE-2025-50059 CVE-2025-50106

    Several vulnerabilities have been discovered in the OpenJDK Java runtime,     which may result in denial of service, information disclosure or weakened     TLS connections.

    For Debian 11 bullseye, these problems have been fixed in version     17.0.16+8-1~deb11u1.

    We recommend that you upgrade your openjdk-17 packages.

    For the detailed security status of openjdk-17 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-17

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk21 package has been released.

ID	Name	Product	Family	Published	Updated	Severity
243035	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : OpenJDK 8 vulnerabilities (USN-7667-1)	Nessus	Ubuntu Local Security Checks	7/30/2025	7/30/2025	high
243221	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-openj9 (SUSE-SU-2025:02545-1)	Nessus	SuSE Local Security Checks	7/31/2025	7/31/2025	high
243265	SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2025:02563-1)	Nessus	SuSE Local Security Checks	8/1/2025	8/1/2025	high
243518	SUSE SLES15 / openSUSE 15 Security Update : java-11-openjdk (SUSE-SU-2025:02666-1)	Nessus	SuSE Local Security Checks	8/5/2025	8/6/2025	high
243964	Alibaba Cloud Linux 3 : 0134: java-1.8.0-openjdk (ALINUX3-SA-2025:0134)	Nessus	Alibaba Cloud Linux Local Security Checks	8/6/2025	8/6/2025	high
246420	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2025-10861)	Nessus	Oracle Linux Local Security Checks	8/8/2025	9/11/2025	high
249099	RHEL 10 : java-21-ibm-semeru-certified-jdk update (Important) (RHSA-2025:13656)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	high
252282	Debian dla-4275 : openjdk-17-dbg - security update	Nessus	Debian Local Security Checks	8/19/2025	8/19/2025	high
255217	Photon OS 4.0: Openjdk21 PHSA-2025-4.0-0860	Nessus	PhotonOS Local Security Checks	8/26/2025	8/26/2025	high
255218	Photon OS 5.0: Openjdk21 PHSA-2025-5.0-0600	Nessus	PhotonOS Local Security Checks	8/26/2025	8/26/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high