An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3779 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP35.

    Security Fix(es):

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

    * OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)     (CVE-2018-3136)

    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)

    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

    * libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for     denial of service (CVE-2018-13785)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: Sound).
    Supported versions that are affected are Java SE: 6u201,     7u191 and 8u182; Java SE Embedded: 8u181; JRockit:
    R28.3.19. Easily exploitable vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded, JRockit. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g. through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 5.3     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2018-3214)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Networking). Supported     versions that are affected are Java SE: 6u201, 7u191,     8u182 and 11; Java SE Embedded: 8u181. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java SE     Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g. code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g. code installed by an administrator). CVSS 3.0     Base Score 3.1 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
    (CVE-2018-3139)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JSSE).
    Supported versions that are affected are Java SE: 6u201,     7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit:
    R28.3.19. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via SSL/TLS     to compromise Java SE, Java SE Embedded, JRockit.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded, JRockit accessible data as     well as unauthorized read access to a subset of Java SE,     Java SE Embedded, JRockit accessible data and     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in     Java SE 8), that load and run untrusted code (e.g. code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g.
    through a web service which supplies data to the APIs.
    CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
    (CVE-2018-3180)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Security). Supported     versions that are affected are Java SE: 6u201, 7u191,     8u182 and 11; Java SE Embedded: 8u181. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g. code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run     only trusted code (e.g. code installed by an     administrator). CVSS 3.0 Base Score 3.4 (Integrity     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N).
    (CVE-2018-3136)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u201,     7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit:
    R28.3.19. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker and     while the vulnerability is in Java SE, Java SE Embedded,     JRockit, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in     Java SE 8), that load and run untrusted code (e.g. code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g.
    through a web service which supplies data to the APIs.
    CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
    (CVE-2018-3149)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Hotspot). Supported     versions that are affected are Java SE: 7u191, 8u182 and     11; Java SE Embedded: 8u181. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks require human     interaction from a person other than the attacker and     while the vulnerability is in Java SE, Java SE Embedded,     attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g. code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g. code installed by an administrator). CVSS 3.0     Base Score 8.3 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
    (CVE-2018-3169)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: Scripting).
    Supported versions that are affected are Java SE: 8u182     and 11; Java SE Embedded: 8u181; JRockit: R28.3.19.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. While the vulnerability is in Java     SE, Java SE Embedded, JRockit, attacks may significantly     impact additional products. Successful attacks of this     vulnerability can result in takeover of Java SE, Java SE     Embedded, JRockit. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.
    code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g.
    through a web service which supplies data to the APIs.
    CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
    (CVE-2018-3183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has java-1.7.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: Sound).
    Supported versions that are affected are Java SE: 6u201,     7u191 and 8u182; Java SE Embedded: 8u181; JRockit:
    R28.3.19. Easily exploitable vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded, JRockit. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g. through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 5.3     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2018-3214)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Networking). Supported     versions that are affected are Java SE: 6u201, 7u191,     8u182 and 11; Java SE Embedded: 8u181. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java SE     Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g. code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g. code installed by an administrator). CVSS 3.0     Base Score 3.1 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
    (CVE-2018-3139)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JSSE).
    Supported versions that are affected are Java SE: 6u201,     7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit:
    R28.3.19. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via SSL/TLS     to compromise Java SE, Java SE Embedded, JRockit.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded, JRockit accessible data as     well as unauthorized read access to a subset of Java SE,     Java SE Embedded, JRockit accessible data and     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in     Java SE 8), that load and run untrusted code (e.g. code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g.
    through a web service which supplies data to the APIs.
    CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
    (CVE-2018-3180)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Security). Supported     versions that are affected are Java SE: 6u201, 7u191,     8u182 and 11; Java SE Embedded: 8u181. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g. code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run     only trusted code (e.g. code installed by an     administrator). CVSS 3.0 Base Score 3.4 (Integrity     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N).
    (CVE-2018-3136)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u201,     7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit:
    R28.3.19. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker and     while the vulnerability is in Java SE, Java SE Embedded,     JRockit, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in takeover of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in     Java SE 8), that load and run untrusted code (e.g. code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g.
    through a web service which supplies data to the APIs.
    CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
    (CVE-2018-3149)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Hotspot). Supported     versions that are affected are Java SE: 7u191, 8u182 and     11; Java SE Embedded: 8u181. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks require human     interaction from a person other than the attacker and     while the vulnerability is in Java SE, Java SE Embedded,     attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g. code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g. code installed by an administrator). CVSS 3.0     Base Score 8.3 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
    (CVE-2018-3169)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

CVE-2018-2938: Support Derby connections (bsc#1101644)

CVE-2018-2940: Better stack walking (bsc#1101645)

CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

CVE-2018-2973: Improve LDAP support (bsc#1101656)

CVE-2018-3639 cpu speculative store bypass mitigation

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u191 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-3183: Improve script engine support (bsc#1112148)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181;
    JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE     Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g. through a web service which supplies data to the APIs.
    (CVE-2018-3149)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3360:04 advisory.

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)
    * OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)
    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)
    * OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534)     (CVE-2018-3136)
    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)
    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)
    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3372:06 advisory.

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)
    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)
    * OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)     (CVE-2018-3136)
    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)
    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)
    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
119047	CentOS 6 : java-1.7.0-openjdk (CESA-2018:3409)	Nessus	CentOS Local Security Checks	11/21/2018	5/26/2022	high
119443	RHEL 6 : java-1.7.1-ibm (RHSA-2018:3779)	Nessus	Red Hat Local Security Checks	12/6/2018	6/3/2024	high
127205	NewStart CGSL CORE 5.04 / MAIN 5.04 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0035)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	critical
127215	NewStart CGSL CORE 5.04 / MAIN 5.04 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0040)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/19/2022	high
121059	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)	Nessus	SuSE Local Security Checks	1/10/2019	1/9/2026	critical
121091	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:0057-1)	Nessus	SuSE Local Security Checks	1/11/2019	6/27/2024	critical
221905	Linux Distros Unpatched Vulnerability : CVE-2018-3149	Nessus	Misc.	3/4/2025	7/16/2026	high
289916	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.191.b12-0.AXS4 (AXSA:2018-3360:04)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
289976	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.201-2.6.16.0.AXS4 (AXSA:2018-3372:06)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high

Detections

Analytics

Plugins Search

high

high

critical

high

critical

critical

high

critical

high