This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803

  - Class libraries :

  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for     more time that the set timeout

  - Z/OS specific C function send_file is changing the file     pointer position

  - Java Virtual Machine :

  - Crash on iterate java stack

  - Java process hang on SIGTERM

  - JIT Compiler :

  - JMS performance regression from JDK8 SR5 FP40 TO FP41

  - Class Libraries :

  - z15 high utilization following Z/VM and Linux migration     from z14 To z15

  - Java Virtual Machine :

  - Assertion failed when trying to write a class file

  - Assertion failure at modronapi.cpp

  - Improve the performance of defining and finding classes

  - JIT Compiler :

  - An assert in ppcbinaryencoding.cpp may trigger when     running with traps disabled on power

  - AOT field offset off by n bytes

  - Segmentation fault in jit module on ibm z platform

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1.56. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1460 advisory.

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-14779)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2020-14781)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-14782)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1     Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). (CVE-2020-14792)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2020-14796)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-14797)

    Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base     Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2020-14803)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JNDI). Supported versions     that are affected are Java SE: 7u271, 8u261, 11.0.8 and     15 Java SE Embedded: 8u261. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14796)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible     data.(CVE-2020-14797)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE accessible data.(CVE-2020-14803)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible     data.(CVE-2020-14782)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE accessible data.(CVE-2020-14803)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JAXP). Supported versions     that are affected are Java SE: 7u261, 8u251, 11.0.7 and     14.0.1 Java SE Embedded: 8u251. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data.(CVE-2020-14621)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 8u251, 11.0.7     and 14.0.1 Java SE Embedded: 8u251. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java     SE Embedded accessible data.(CVE-2020-14556)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 5.15.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.6 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a     malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-     axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-     tmff.c, and drivers/hid/hid-zpff.c. (CVE-2019-19532)

  - In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     (CVE-2020-0427)

  - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
143791	SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2020:3159-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	medium
143794	SUSE SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2020:3460-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
144599	SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:3932-1)	Nessus	SuSE Local Security Checks	12/24/2020	12/6/2022	medium
145003	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1460)	Nessus	Amazon Linux Local Security Checks	1/14/2021	12/11/2024	medium
146108	EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2021-1198)	Nessus	Huawei Local Security Checks	2/4/2021	12/5/2022	medium
149597	EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2021-1877)	Nessus	Huawei Local Security Checks	5/18/2021	12/6/2022	medium
252143	Linux Distros Unpatched Vulnerability : CVE-2020-14803	Nessus	Misc.	8/19/2025	8/19/2025	medium
164567	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.6)	Nessus	Misc.	9/1/2022	7/22/2025	critical

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium

medium

critical