Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform. These vulnerabilities relate to execution of arbitrary code, breakouts of the Java sandbox, information disclosure and denial of service.

For Debian 6 'Squeeze', these problems have been fixed in openjdk-6 version 6b37-1.13.9-1~deb6u1.

We recommend you to upgrade your openjdk-6 packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Oracle reports :

This Critical Patch Update contains 25 new security fixes for Oracle Java SE. 24 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

This update for java-1_6_0-ibm fixes the following issues :

  - Version update to 6.0-16.15 bsc#955131: CVE-2015-4734     CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810     CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843     CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872     CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902     CVE-2015-4903 CVE-2015-4911 CVE-2015-5006

    CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459     CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488     CVE-2015-0478 CVE-2015-0477 CVE-2015-0204

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1430 advisory.

  - OpenJDK: kerberos realm name leak (JGSS, 8048030) (CVE-2015-4734)

  - OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842) (CVE-2015-4803)

  - OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671)     (CVE-2015-4805)

  - OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193) (CVE-2015-4806)

  - Oracle JDK: unspecified vulnerability fixed in 7u91 and 8u65 (Deployment) (CVE-2015-4810)

  - OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383) (CVE-2015-4835)

  - OpenJDK: OOB access in CMS code (2D, 8086092) (CVE-2015-4840)

  - OpenJDK: leak of user.dir location (JAXP, 8078427) (CVE-2015-4842)

  - OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891) (CVE-2015-4843)

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042) (CVE-2015-4844)

  - OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688) (CVE-2015-4860)

  - OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries)     (CVE-2015-4871)

  - OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291) (CVE-2015-4872)

  - OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387) (CVE-2015-4882)

  - OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413) (CVE-2015-4883)

  - OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733) (CVE-2015-4893)

  - Oracle JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment) (CVE-2015-4902)

  - OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339) (CVE-2015-4903)

  - IBM JDK: local disclosure of kerberos credentials cache (CVE-2015-5006)

  - IBM JDK: J9 JVM allows code to invoke non-public interface methods (CVE-2015-5041)

  - TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) (CVE-2015-7575)

  - libpng: Out-of-bounds read in png_convert_to_rfc1123 (CVE-2015-7981)

  - libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (CVE-2015-8126,     CVE-2015-8472)

  - libpng: underflow read in png_check_keyword() (CVE-2015-8540)

  - IBM JDK: buffer overflow vulnerability in the IBM JVM (CVE-2016-0264)

  - IBM JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (CVE-2016-0363)

  - IBM JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (CVE-2016-0376)

  - OpenJDK: URL deserialization inconsistencies (Networking, 8059054) (CVE-2016-0402)

  - OpenJDK: logging of RMI connection secrets (JMX, 8130710) (CVE-2016-0448)

  - OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) (CVE-2016-0466)

  - OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) (CVE-2016-0483)

  - ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) (CVE-2016-0494)

  - OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)     (CVE-2016-0686)

  - OpenJDK: insufficient byte type checks (Hotspot, 8132051) (CVE-2016-0687)

  - Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D) (CVE-2016-3422, CVE-2016-3443)

  - OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945) (CVE-2016-3426)

  - OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430) (CVE-2016-3427)

  - Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (Deployment) (CVE-2016-3449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Oracle Java SE installed on the remote host is version 6 prior to Update 105, 7 prior to Update 91, or 8 prior to Update 65 and is therefore affected by security vulnerabilities in the following components :

 - 2D
 - CORBA
 - Deployment
 - JavaFX
 - JAXP
 - JGSS
 - Libraries
 - RMI
 - Security
 - Serialization

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 65, 7 Update 91, or 6 Update 105. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - CORBA
 - Deployment
 - JavaFX
 - JAXP
 - JGSS
 - Libraries
 - RMI
 - Security
 - Serialization

ID	Name	Product	Family	Published	Updated	Severity
87056	Debian DLA-346-1 : openjdk-6 security update	Nessus	Debian Local Security Checks	11/25/2015	1/11/2021	critical
87386	FreeBSD : java -- multiple vulnerabilities (a5934ba8-a376-11e5-85e9-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	12/16/2015	3/8/2022	critical
87180	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2015:2166-1) (Bar Mitzvah) (FREAK)	Nessus	SuSE Local Security Checks	12/3/2015	3/8/2022	critical
92400	RHEL 5 / 6 : java-1.7.0-ibm and java-1.7.1-ibm (RHSA-2016:1430)	Nessus	Red Hat Local Security Checks	7/19/2016	4/21/2024	critical
9352	Oracle Java SE 6 < Update 105 / 7 < Update 91 / 8 < Update 65 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/9/2016	3/6/2019	critical
700652	Oracle Java SE 6 < Update 105 / 7 < Update 91 / 8 < Update 65 Multiple Vulnerabilities (October 2015 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical