Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494)

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16-FP20 release. All running instances of IBM Java must be restarted for the update to take effect.

Latest upstream release, includes fixes for security vulnerabilities:
CVE-2015-7981, CVE-2015-8126, CVE-2015-8540

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126. (CVE-2015-8472)

Impact

This vulnerability may allow unauthorized disclosure of information, unauthorized modification, or disruption of service.

Important : A low severity rating applies when the attack is considered to be local only. A medium security rating applies when the BIG-IP APM module is enabled and configured with a Citrix VDI back end.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2594 advisory.

  - libpng: Out-of-bounds read in png_convert_to_rfc1123 (CVE-2015-7981)

  - libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (CVE-2015-8126,     CVE-2015-8472)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1430 advisory.

  - OpenJDK: kerberos realm name leak (JGSS, 8048030) (CVE-2015-4734)

  - OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842) (CVE-2015-4803)

  - OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671)     (CVE-2015-4805)

  - OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193) (CVE-2015-4806)

  - Oracle JDK: unspecified vulnerability fixed in 7u91 and 8u65 (Deployment) (CVE-2015-4810)

  - OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383) (CVE-2015-4835)

  - OpenJDK: OOB access in CMS code (2D, 8086092) (CVE-2015-4840)

  - OpenJDK: leak of user.dir location (JAXP, 8078427) (CVE-2015-4842)

  - OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891) (CVE-2015-4843)

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042) (CVE-2015-4844)

  - OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688) (CVE-2015-4860)

  - OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries)     (CVE-2015-4871)

  - OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291) (CVE-2015-4872)

  - OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387) (CVE-2015-4882)

  - OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413) (CVE-2015-4883)

  - OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733) (CVE-2015-4893)

  - Oracle JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment) (CVE-2015-4902)

  - OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339) (CVE-2015-4903)

  - IBM JDK: local disclosure of kerberos credentials cache (CVE-2015-5006)

  - IBM JDK: J9 JVM allows code to invoke non-public interface methods (CVE-2015-5041)

  - TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) (CVE-2015-7575)

  - libpng: Out-of-bounds read in png_convert_to_rfc1123 (CVE-2015-7981)

  - libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (CVE-2015-8126,     CVE-2015-8472)

  - libpng: underflow read in png_check_keyword() (CVE-2015-8540)

  - IBM JDK: buffer overflow vulnerability in the IBM JVM (CVE-2016-0264)

  - IBM JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (CVE-2016-0363)

  - IBM JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (CVE-2016-0376)

  - OpenJDK: URL deserialization inconsistencies (Networking, 8059054) (CVE-2016-0402)

  - OpenJDK: logging of RMI connection secrets (JMX, 8130710) (CVE-2016-0448)

  - OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) (CVE-2016-0466)

  - OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) (CVE-2016-0483)

  - ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) (CVE-2016-0494)

  - OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)     (CVE-2016-0686)

  - OpenJDK: insufficient byte type checks (Hotspot, 8132051) (CVE-2016-0687)

  - Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D) (CVE-2016-3422, CVE-2016-3443)

  - OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945) (CVE-2016-3426)

  - OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430) (CVE-2016-3427)

  - Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (Deployment) (CVE-2016-3449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the png_combine_row     function in libpng before 1.5.21 and 1.6.x before     1.6.16, when running on 64-bit systems, might allow     context-dependent attackers to execute arbitrary code     via a 'very wide interlaced' PNG image.(CVE-2014-9495)

  - Buffer overflow in the png_read_IDAT_data function in     pngrutil.c in libpng before 1.5.21 and 1.6.x before     1.6.16 allows context-dependent attackers to execute     arbitrary code via IDAT data with a large width, a     different vulnerability than     CVE-2014-9495.(CVE-2015-0973)

  - Buffer overflow in the png_set_PLTE function in libpng     before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x,     1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x     before 1.6.20 allows remote attackers to cause a denial     of service (application crash) or possibly have     unspecified other impact via a small bit-depth value in     an IHDR (aka image header) chunk in a PNG image. NOTE:
    this vulnerability exists because of an incomplete fix     for CVE-2015-8126.(CVE-2015-8472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running VLC 2.x prior to 2.0.2 and is affected by multiple vulnerabilities :

 - An invalid pointer dereference flaw exists in the 3GP file format parser. With a specially crafted 3GP file, a context-dependent attacker can potentially execute arbitrary code.
 - The libpng library used by VLC contains an out-of-bounds read flaw in the 'png_convert_to_rfc1123()' function in 'png.c' that may allow a context-dependent attacker to crash an application linked against the library or disclose memory contents.
 - The libEBML library used by VLC contains a use-after-free error in the 'EblMaster::Read()' function in 'EbmlMaster.cpp' that is triggered when handling deeply nested elements with an infinite size. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - The libEBML library used by VLC contains an out-of-bounds read condition in the 'UTFstring::UpdateFromUTF8()' function in 'EbmlUnicodeString.cpp' that is triggered when reading UTF-8 strings. This may allow a context-dependent attacker to crash an application linked against the library or potentially disclose memory contents.
 - The libpng library contains overflow conditions in the 'png_set_PLTE()' function in 'pngset.c' and 'png_get_PLTE()' function in 'pngget.c' that are triggered when handling bit depths less than 8. With a specially crafted PNG image, a context-dependent attacker can cause a buffer overflow, crashing an application linked against the library or potentially execute arbtirary code.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the web interface does not validate files' title metadata before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling a specially crafted MP4 file. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified double-free flaw exists in the ADPCM decoder, which may allow an attacker to have an unspecified impact.
 - Multiple unspecified double-frees, integer overflows, infinite loops, read overflows, invalid frees, and division-by-zero flaws exist. No further details have been provided by the vendor.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the HTTP interface does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - An off-by-one overflow condition exists in the RealRtsp module. The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.4 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppleRAID
 - AppleUSBNetworking
 - Bluetooth
 - Carbon
 - dyld
 - FontParser
 - HTTPProtocol
 - Intel Graphics Driver
 - IOFireWireFamily
 - IOGraphics
 - IOHIDFamily
 - IOUSBFamily
 - Kernel
 - libxml2
 - Messages
 - NVIDIA Graphics Drivers
 - OpenSSH
 - OpenSSL
 - Python
 - QuickTime
 - Reminders
 - Ruby
 - Security
 - Tcl
 - TrueTypeScaler
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
88557	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2016:0101) (SLOTH)	Nessus	Red Hat Local Security Checks	2/3/2016	10/24/2019	critical
89213	Fedora 23 : libpng12-1.2.56-1.fc23 (2015-39499d9af8)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
91331	F5 Networks BIG-IP : Libpng vulnerability (K81903701)	Nessus	F5 Networks Local Security Checks	5/26/2016	5/9/2019	high
87305	RHEL 6 : libpng (RHSA-2015:2594)	Nessus	Red Hat Local Security Checks	12/10/2015	4/27/2024	high
92400	RHEL 5 / 6 : java-1.7.0-ibm and java-1.7.1-ibm (RHSA-2016:1430)	Nessus	Red Hat Local Security Checks	7/19/2016	4/21/2024	critical
137503	EulerOS 2.0 SP2 : libpng (EulerOS-SA-2020-1661)	Nessus	Huawei Local Security Checks	6/17/2020	3/6/2024	high
9267	VLC Media Player < 2.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	4/22/2016	3/6/2019	critical
9327	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	5/27/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

high

high

high

critical

high

critical

critical