This update for java-1_8_0-ibm fixes the following issues :

Java 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)

CVE-2020-2583: Unlink Set of LinkedHashSets

CVE-2019-4732: Untrusted DLL search path vulnerability

CVE-2020-2593: Normalize normalization for all

CVE-2020-2604: Better serial filter handling

CVE-2020-2659: Enhance datagram socket support

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2020:0632 :

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

* OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

* OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

* OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

* OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

* OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

* OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0632 advisory.

  - OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

  - OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)     (CVE-2020-2604)

  - OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS     (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via     jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

  - OpenJDK: Improper checks of SASL message properties in     GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler check causing     URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Excessive memory usage in OID processing in     X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incorrect exception processing during     deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

  - OpenJDK: Incomplete enforcement of maxDatagramSockets     limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Java SE,     Java SE Embedded. While the vulnerability is in Java     SE, Java SE Embedded, attacks may significantly impact     additional products. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java     SE Embedded accessible data.(CVE-2020-2601)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE.(CVE-2020-2654)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-2583)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Java SE,     Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data.(CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java     SE Embedded accessible data.(CVE-2020-2593)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in takeover of     Java SE, Java SE Embedded.(CVE-2020-2604)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u241 and 8u231     Java SE Embedded: 8u231. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2020-2659)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenJDK installed on the remote host is prior to 7 <= 7u241 / 8 <= 8u232 / 11.0.0 <= 11.0.5 / 13.0.0 <= 13.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020-01-14 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2020-2604)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). (CVE-2020-2601)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8     (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2020-2655)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-2593)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the     specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as     through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2654)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2659)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2583)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.1.1 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2601)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. (CVE-2020-2604)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the     specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as     through a web service. (CVE-2020-2654)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2659)

  - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive     information, cause a denial of service, or possibly have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip     driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly     execute arbitrary code. (CVE-2019-14816)

  - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before     4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection     negotiation during the handling of the remote devices country settings. This could allow the remote device     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14895)

  - The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could     use this flaw to obtain sensitive information, cause a denial of service, or possibly have other     unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
    (CVE-2019-14898)

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer     overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS;
    however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an     administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
    (CVE-2019-18634)

  - Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2019-13734)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
134080	SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0466-1)	Nessus	SuSE Local Security Checks	2/26/2020	5/18/2022	high
134143	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2020-0632)	Nessus	Oracle Linux Local Security Checks	2/28/2020	3/25/2024	high
134146	RHEL 6 : java-1.7.0-openjdk (RHSA-2020:0632)	Nessus	Red Hat Local Security Checks	2/28/2020	4/28/2024	high
134149	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20200227)	Nessus	Scientific Linux Local Security Checks	2/28/2020	3/25/2024	high
135524	EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2020-1395)	Nessus	Huawei Local Security Checks	4/15/2020	3/18/2024	high
151210	OpenJDK 7 <= 7u241 / 8 <= 8u232 / 11.0.0 <= 11.0.5 / 13.0.0 <= 13.0.1 Multiple Vulnerabilities (2020-01-14)	Nessus	Misc.	7/6/2021	12/11/2023	high
164561	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17)	Nessus	Misc.	9/1/2022	2/23/2024	critical
164606	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.1.1)	Nessus	Misc.	9/1/2022	1/10/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

critical