This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues.

These security issues were fixed :

  - CVE-2016-0686: Ensure thread consistency (bsc#976340).

  - CVE-2016-0687: Better byte behavior (bsc#976340).

  - CVE-2016-0695: Make DSA more fair (bsc#976340).

  - CVE-2016-3425: Better buffering of XML strings     (bsc#976340).

  - CVE-2016-3427: Improve JMX connections (bsc#976340).

An update for java-1.6.0-openjdk is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit.

Security Fix(es) :

* Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions.
(CVE-2016-0686, CVE-2016-0687)

* It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427)

* It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed.
(CVE-2016-3425)

* It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures.
The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected.
(CVE-2016-0695)

The remote host is affected by the vulnerability described in GLSA-201606-18 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  Many       of the vulnerabilities can only be exploited through sandboxed Java Web       Start applications and java applets. Please review the CVE identifiers       referenced below for details.
  Impact :

    Remote attackers may execute arbitrary code, compromise information, or       cause Denial of Service.
  Workaround :

    There is no known work around at this time.

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were discovered in the Serialization and     Hotspot components in OpenJDK. An untrusted Java     application or applet could use these flaws to     completely bypass Java sandbox     restrictions.(CVE-2016-0686, CVE-2016-0687)

  - It was discovered that the RMI server implementation in     the JMX component in OpenJDK did not restrict which     classes can be deserialized when deserializing     authentication credentials. A remote, unauthenticated     attacker able to connect to a JMX port could possibly     use this flaw to trigger deserialization flaws.
    (CVE-2016-3427)

  - It was discovered that the JAXP component in OpenJDK     failed to properly handle Unicode surrogate pairs used     as part of the XML attribute values. Specially crafted     XML input could cause a Java application to use an     excessive amount of memory when parsed.(CVE-2016-3425)

  - It was discovered that the Security component in     OpenJDK failed to check the digest algorithm strength     when generating DSA signatures.The use of a digest     weaker than the key strength could lead to the     generation of signatures that were weaker than     expected.(CVE-2016-0695)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of IBM Java installed on the remote host is prior to 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 19 2016 CPU advisory.

  - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote     attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.
    (CVE-2016-0686)

  - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote     attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-     component. (CVE-2016-0687)

  - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect     availability via vectors related to 2D. (CVE-2016-3422)

  - Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to     affect confidentiality via vectors related to JCE. (CVE-2016-3426)

  - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit     R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related     to JMX. (CVE-2016-3427)

  - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect     confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is     from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote     attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read.
    (CVE-2016-3443)

  - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect     confidentiality, integrity, and availability via vectors related to Deployment. (CVE-2016-3449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This IBM Java 1.6.0 SR16 FP25 release fixes the following issues :

Security issues fixed :

  - CVE-2016-0264: buffer overflow vulnerability in the IBM     JVM (bsc#977648)

  - CVE-2016-0363: insecure use of invoke method in CORBA     component, incorrect CVE-2013-3009 fix (bsc#977650)

  - CVE-2016-0376: insecure deserialization in CORBA,     incorrect CVE-2013-5456 fix (bsc#977646)

  - The following CVEs got also fixed during this update.
    (bsc#979252) CVE-2016-3443, CVE-2016-0687,     CVE-2016-0686, CVE-2016-3427, CVE-2016-3449,     CVE-2016-3422, CVE-2016-3426

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.7.1-ibm is now available for Red Hat Satellite 5.7 and Red Hat Satellite 5.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP1.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3241, CVE-2017-3259, CVE-2016-5573, CVE-2016-5554, CVE-2016-5542, CVE-2016-5597, CVE-2016-5556, CVE-2016-3598, CVE-2016-3511, CVE-2016-0363, CVE-2016-0686, CVE-2016-0687, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449, CVE-2016-3422, CVE-2016-0376, CVE-2016-0264)

The version of Oracle Java SE installed on the remote host is prior to 6 Update 115, 7 Update 101, or 8 Update 92 and is affected by multiple vulnerabilities :

 - An unspecified flaw related to the 'Serialization' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0686)
 - An unspecified flaw related to the 'Hotspot' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0687)
 - An unspecified flaw related to the 'Security' subcomponent may allow a remote attacker to gain access to potentially sensitive information. (CVE-2016-0695)
 - An unspecified flaw related to the '2D' subcomponent may allow a context-dependent attacker to cause a denial of service. (CVE-2016-3422)
 - An unspecified flaw related to the 'JAXP' subcomponent may allow a remote attacker to cause a denial of service. (CVE-2016-3425)
 - An unspecified flaw related to the 'JCE' subcomponent may allow a context-dependent attacker to gain access to potentially sensitive information. (CVE-2016-3426)
 - A flaw related to the 'JMX' subcomponent may allow a remote attacker to execute arbitrary code through Java deserialization. (CVE-2016-3427)
 - An out-of-bounds read flaw within the '2D' subcomponent is triggered when handling specially crafted files. This may allow a context-dependent attacker gain unauthorized access to potentially sensitive information. (CVE-2016-3443)
 - An unspecified flaw related to the 'Deployment' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-3449)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 91, 7 Update 101, or 6 Update 115. It is, therefore, affected by security vulnerabilities in the following subcomponents :

 - 2D
 - Deployment
 - Hotspot
 - JAXP
 - JCE
 - JMX
 - Security
 - Serialization

ID	Name	Product	Family	Published	Updated	Severity
90905	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-553)	Nessus	SuSE Local Security Checks	5/5/2016	5/14/2023	critical
91018	CentOS 5 / 6 / 7 : java-1.6.0-openjdk (CESA-2016:0723)	Nessus	CentOS Local Security Checks	5/11/2016	5/14/2023	critical
91863	GLSA-201606-18 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/28/2016	5/14/2023	critical
99778	EulerOS 2.0 SP1 : java-1.7.0-openjdk (EulerOS-SA-2016-1015)	Nessus	Huawei Local Security Checks	5/1/2017	5/14/2023	critical
160348	IBM Java 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0 Multiple Vulnerabilities (Apr 19, 2016)	Nessus	Misc.	4/29/2022	5/14/2023	critical
119977	SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2016:1303-1)	Nessus	SuSE Local Security Checks	1/2/2019	5/14/2023	critical
100094	RHEL 6 : java-1.7.1-ibm (RHSA-2017:1216)	Nessus	Red Hat Local Security Checks	5/10/2017	5/14/2023	critical
9448	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 92 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/8/2016	3/6/2019	critical
700653	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 91 Multiple Vulnerabilities (April 2016 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

high