An update of the openjdk8 package has been released.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2737 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP40.

    Security Fix(es):

    * IBM JDK: Out-of-bounds access in the String.getBytes method (CVE-2019-11772)

    * IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)

    * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

    * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

    * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

    * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

    * libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The java-1.7.0-openjdk packages provide the OpenJDK 7     Java Runtime Environment and the OpenJDK 7 Java     Software Development Kit.Security Fix(es):Vulnerability     in the Java SE, Java SE Embedded, JRockit component of     Oracle Java SE (subcomponent: JSSE). Supported versions     that are affected are Java SE: 6u201, 7u191, 8u182 and     11 Java SE Embedded: 8u181 JRockit: R28.3.19. Difficult     to exploit vulnerability allows unauthenticated     attacker with network access via SSL/TLS to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE,     Java SE Embedded, JRockit accessible data as well as     unauthorized read access to a subset of Java SE, Java     SE Embedded, JRockit accessible data and unauthorized     ability to cause a partial denial of service (partial     DOS) of Java SE, Java SE Embedded, JRockit. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g. code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g. through a web service     which supplies data to the     APIs.(CVE-2018-3180)Vulnerability in the Java SE, Java     SE Embedded, JRockit component of Oracle Java SE     (subcomponent: Sound). Supported versions that are     affected are Java SE: 6u201, 7u191 and 8u182 Java SE     Embedded: 8u181 JRockit: R28.3.19. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial     DOS) of Java SE, Java SE Embedded, JRockit. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g. through a web service     which supplies data to the     APIs.(CVE-2018-3214)Vulnerability in the Java SE, Java     SE Embedded component of Oracle Java SE (subcomponent:
    Networking). Supported versions that are affected are     Java SE: 7u221, 8u212, 11.0.3 and 12.0.1 Java SE     Embedded: 8u211. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE, Java SE Embedded accessible data as     well as unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs.(CVE-2019-2816)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The java-1.7.0-openjdk packages provide the OpenJDK 7     Java Runtime Environment and the OpenJDK 7 Java     Software Development Kit.Security Fix(es):Vulnerability     in the Java SE product of Oracle Java SE (component:
    Javadoc). Supported versions that are affected are Java     SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks require human interaction     from a person other than the attacker and while the     vulnerability is in Java SE, attacks may significantly     impact additional products. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE accessible data as     well as unauthorized read access to a subset of Java SE     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted     code (e.g., code that comes from the internet) and rely     on the Java sandbox for security. This vulnerability     does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g.,     code installed by an     administrator).(CVE-2019-2999)Vulnerability in the Java     SE, Java SE Embedded component of Oracle Java SE     (subcomponent: Networking). Supported versions that are     affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1     Java SE Embedded: 8u211. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the     APIs.(CVE-2019-2816)Vulnerability in the Java SE, Java     SE Embedded component of Oracle Java SE (subcomponent:
    Security). Supported versions that are affected are     Java SE: 8u212, 11.0.3 and 12.0.1 Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks require human interaction     from a person other than the attacker and while the     vulnerability is in Java SE, Java SE Embedded, attacks     may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java     SE Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the     APIs.(CVE-2019-2786)Vulnerability in the Java SE, Java     SE Embedded component of Oracle Java SE (subcomponent:
    Utilities). Supported versions that are affected are     Java SE: 7u221, 8u212, 11.0.3 and 12.0.1 Java SE     Embedded: 8u211. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2762)Vulnerability in the Java SE, Java     SE Embedded component of Oracle Java SE (subcomponent:
    Utilities). Supported versions that are affected are     Java SE: 7u221, 8u212, 11.0.3 and 12.0.1 Java SE     Embedded: 8u211. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2769)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component: 2D).
    Supported versions that are affected are Java SE:
    7u231, 8u221, 11.0.4 and 13 Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2962)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component: 2D).
    Supported versions that are affected are Java SE:
    7u231, 8u221, 11.0.4 and 13 Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply     to Java deployments, typically in servers, that load     and run only trusted code (e.g., code installed by an     administrator).(CVE-2019-2988)Vulnerability in the Java     SE, Java SE Embedded product of Oracle Java SE     (component: 2D). Supported versions that are affected     are Java SE: 7u231, 8u221, 11.0.4 and 13 Java SE     Embedded: 8u221. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply     to Java deployments, typically in servers, that load     and run only trusted code (e.g., code installed by an     administrator).(CVE-2019-2992)Vulnerability in the Java     SE, Java SE Embedded product of Oracle Java SE     (component: Concurrency). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13 Java     SE Embedded: 8u221. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability can only be     exploited by supplying data to APIs in the specified     Component without using Untrusted Java Web Start     applications or Untrusted Java applets, such as through     a web service.(CVE-2019-2964)Vulnerability in the Java     SE, Java SE Embedded product of Oracle Java SE     (component: JAXP). Supported versions that are affected     are Java SE: 7u231, 8u221, 11.0.4 and 13 Java SE     Embedded: 8u221. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2973)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component:
    JAXP). Supported versions that are affected are Java     SE: 7u231, 8u221, 11.0.4 and 13 Java SE Embedded:
    8u221. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2981)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component:
    Libraries). Supported versions that are affected are     Java SE: 7u231, 8u221, 11.0.4 and 13 Java SE Embedded:
    8u221. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or     modification access to critical data or all Java SE,     Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the     APIs.(CVE-2019-2958)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component:
    Networking). Supported versions that are affected are     Java SE: 7u231, 8u221, 11.0.4 and 13 Java SE Embedded:
    8u221. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks require human interaction     from a person other than the attacker. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an     administrator).(CVE-2019-2945)Vulnerability in the Java     SE, Java SE Embedded product of Oracle Java SE     (component: Networking). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13 Java     SE Embedded: 8u221. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2978)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component:
    Networking). Supported versions that are affected are     Java SE: 7u231, 8u221, 11.0.4 and 13 Java SE Embedded:
    8u221. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. While the vulnerability is in Java SE, Java     SE Embedded, attacks may significantly impact     additional products. Successful attacks of this     vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all     Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the     APIs.(CVE-2019-2989)Vulnerability in the Java SE, Java     SE Embedded product of Oracle Java SE (component:
    Serialization). Supported versions that are affected     are Java SE: 7u231, 8u221, 11.0.4 and 13 Java SE     Embedded: 8u221. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs.(CVE-2019-2983)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
128736	Photon OS 2.0: Openjdk8 PHSA-2019-2.0-0173	Nessus	PhotonOS Local Security Checks	9/12/2019	2/24/2025	medium
128858	RHEL 6 : java-1.8.0-ibm (RHSA-2019:2737)	Nessus	Red Hat Local Security Checks	9/16/2019	11/6/2024	critical
130102	Photon OS 3.0: Openjdk8 PHSA-2019-3.0-0035	Nessus	PhotonOS Local Security Checks	10/22/2019	8/22/2025	medium
131614	EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2019-2460)	Nessus	Huawei Local Security Checks	12/4/2019	4/8/2024	medium
133911	EulerOS 2.0 SP5 : java-1.7.0-openjdk (EulerOS-SA-2020-1110)	Nessus	Huawei Local Security Checks	2/24/2020	5/18/2022	medium
134409	NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	3/11/2020	1/14/2021	high
144227	Virtuozzo 7 : java-1.7.0-openjdk / etc (VZLSA-2019-1839)	Nessus	Virtuozzo Local Security Checks	12/15/2020	5/11/2022	medium

Detections

Analytics

Plugins Search

medium

critical

medium

medium

medium

high

medium