Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

For Debian 6 'Squeeze', these problems have been fixed in version 6b35-1.13.7-1~deb6u1.

We recommend that you upgrade your openjdk-6 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

Multiple flaws were discovered in the Beans and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-0477 , CVE-2015-0470)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080 , CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs.

Tabulated information can be found on: <a href='http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_ Update_May_2015'>http://www.ibm.com/developerworks/java/jdk/alerts/#IB M_Security_Update_May_2015</a>

CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This version update for java-1_6_0-ibm to version 6.0.16.15 fixes the following issues :

CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204

For more information please visit: <a href='http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_ Update_November_2015'>http://www.ibm.com/developerworks/java/jdk/alert s/#IBM_Security_Update_November_2015</a>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 45, 7 Update 79, 6 Update 95, or 5 Update 85. It is, therefore, affected by security vulnerabilities in the following components :

  - 2D
  - Beans
  - Deployment
  - Hotspot
  - JavaFX
  - JCE
  - JSSE
  - Tools

The Oracle Java SE installed on the remote host is version 8 prior to Update 41; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Deployment running on client deployments of Oracle Java (CVE-2015-0458, CVE-2015-0486)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460, CVE-2015-0470)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)
 - Several undisclosed attack vectors which affect client and server deployments of Oracle Java (CVE-2015-0492, CVE-2015-0484)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 45, 7 Update 79, 6 Update 95, or 5 Update 85. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - Beans
 - Deployment
 - Hotspot
 - JavaFX
 - JCE
 - JSSE
 - Tools

The Oracle Java SE installed on the remote host is version 6 prior to Update 92; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Deployment running on client deployments of Oracle Java (CVE-2015-0458)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)

The Oracle Java SE installed on the remote host is version 7 prior to Update 77; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Deployment running on client deployments of Oracle Java (CVE-2015-0458)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)
 - Several undisclosed attack vectors which affect client and server deployments of Oracle Java (CVE-2015-0492, CVE-2015-0484)

The Oracle Java SE installed on the remote host is version 5 prior to Update 82; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D running on client deployments of Oracle Java (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469)
 - Beans running on both client and server deployments of Java Secure Socket Extension (CVE-2015-0477)
 - Hotspot running on client deployments of Oracle Java (CVE-2015-0460)
 - JSSE running on client or server deployments of Oracle Java (CVE-2015-0488)
 - Tools running on client deployments of Oracle Java (CVE-2015-0480)
 - JCE running on client or server deployments of Oracle Java (CVE-2015-0478)

ID	Name	Product	Family	Published	Updated	Severity
83165	Debian DLA-213-1 : openjdk-6 security update	Nessus	Debian Local Security Checks	5/1/2015	1/11/2021	critical
83268	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2015-517)	Nessus	Amazon Linux Local Security Checks	5/7/2015	4/18/2018	critical
84286	SUSE SLES11 Security Update : IBM Java (SUSE-SU-2015:1086-1) (Bar Mitzvah) (FREAK)	Nessus	SuSE Local Security Checks	6/19/2015	1/19/2021	critical
87914	SUSE SLES10 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0113-1) (Bar Mitzvah) (FREAK)	Nessus	SuSE Local Security Checks	1/14/2016	3/8/2022	critical
82821	Oracle Java SE Multiple Vulnerabilities (April 2015 CPU) (Unix) (FREAK)	Nessus	Misc.	4/16/2015	4/19/2024	high
8748	Oracle Java SE 8 < Update 41 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical
700650	Oracle Java SE 5 < Update 85 / 6 < Update 95 / 7 < Update 79 / 8 < Update 45 Multiple Vulnerabilities (April 2015 CPU) (FREAK)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	critical
8750	Oracle Java SE 6 < Update 92 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical
8749	Oracle Java SE 7 < Update 77 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical
8751	Oracle Java SE 5 < Update 82 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/22/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

critical

critical

critical

critical

critical