An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 8 to version 8 Update 191.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)

* Oracle JDK: unspecified vulnerability fixed in 8u191 (JavaFX) (CVE-2018-3209)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* Oracle JDK: unspecified vulnerability fixed in 8u191 and 11.0.1 (Serviceability) (CVE-2018-3211)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

* libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service (CVE-2018-13785)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update of the openjdk8 package has been released.

An update of the openjdk11 package has been released.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 11 Update 1, 8 Update 191, 7 Update 201, or 6 Update 211. It is, therefore, affected by multiple vulnerabilities related to the following components :

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the Deployment     (libpng) subcomponent could allow an unauthenticated,     remote attacker with network access via HTTP to     compromise Java SE, Java SE Embedded. (CVE-2018-13785)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the Hotspot     subcomponent could allow an unauthenticated, remote     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. (CVE-2018-3169)

  - An unspecified vulnerability in the Java SE component     of Oracle Java SE in the JavaFX subcomponent could allow     an unauthenticated, remote attacker with network access     via multiple protocols to compromise Java SE.
    (CVE-2018-3209)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE in the     JNDI subcomponent could allow an unauthenticated, remote     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, JRockit.
    (CVE-2018-3149)  
  - An unspecified vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE in the     JSSE subcomponent could allow an unauthenticated,     remote attacker with network access via SSL/TLS to     compromise Java SE, Java SE Embedded, JRockit.
    (CVE-2018-3180)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the     Networking subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded.
    (CVE-2018-3139)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE in the     Scripting subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded,     JRockit. (CVE-2018-3183)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the Security     subcomponent could allow an unauthenticated, remote     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. (CVE-2018-3136)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the     Serviceability subcomponent could allow a low privileged     attacker with logon to the infrastructure where Java SE,     Java SE Embedded executes to compromise Java SE, Java SE     Embedded. (CVE-2018-3211)

  - An unspecified vulnerability in the Java SE component of     Oracle Java SE in the Sound subcomponent could allow an     unauthenticated, remote attacker with network access via     multiple protocols to compromise Java SE.
    (CVE-2018-3157)

  - An unspecified vulnerability in the Java SE component of     Oracle Java SE in the Utility subcomponent could allow     an unauthenticated, remote attacker with network access     via multiple protocols to compromise Java SE.
    (CVE-2018-3150)

Please consult the CVRF details for the applicable CVEs for additional information.

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201908-10 (Oracle JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s JDK and JRE       software suites. Please review the CVE identifiers referenced below for       details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An update of the openjdk package has been released.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 11 Update 1, 8 Update 191, 7 Update 201, or 6 Update 211. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified vulnerability in the Java SE Embedded     component of Oracle Java SE in the Deployment (libpng)     subcomponent could allow an unauthenticated, remote     attacker with network access via HTTP to compromise     Java SE. (CVE-2018-13785)  
  - An unspecified vulnerability in the Java SE Embedded     component of Oracle Java SE in the Hotspot subcomponent     that could allow an unauthenticated, remote attacker     with network access via multiple protocols to compromise     Java SE (CVE-2018-3169)

  - An unspecified vulnerability in the Java SE component of     Oracle Java SE in the JavaFX subcomponent could allow an     unauthenticated, remote attacker with network access via     multiple protocols to compromise Java SE.
    (CVE-2018-3209)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded, and JRockit component of Oracle Java SE in     the JNDI subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded, and     JRockit. (CVE-2018-3149)     
  - An unspecified vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE in the     JSSE subcomponent could allow an unauthenticated,     remote attacker with network access via SSL/TLS to     compromise Java SE, Java SE Embedded, or JRockit.
    (CVE-2018-3180)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the Networking     subcomponent could allow an unauthenticated, remote     attacker with network access via multiple protocols to     compromise Java SE or Java SE Embedded. (CVE-2018-3139)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE in the     Scripting subcomponent could allow an unauthenticated,     remote attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded, or     JRockit. (CVE-2018-3183)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the Security     subcomponent could allow an unauthenticated, remote     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. (CVE-2018-3136)

  - An unspecified vulnerability in the Java SE, Java SE     Embedded component of Oracle Java SE in the     Serviceability subcomponent could allow a low privileged     attacker with logon to the infrastructure where Java SE,     Java SE Embedded executes to compromise Java SE, Java SE     Embedded. (CVE-2018-3211)

  - An unspecified vulnerability in the Java SE component of     Oracle Java SE in the Sound subcomponent could allow an     unauthenticated, remote attacker with network access via     multiple protocols to compromise Java SE.
    (CVE-2018-3157)

  - An unspecified vulnerability in the Java SE component of     Oracle Java SE in the Utility subcomponent could allow an     unauthenticated, remote attacker with network access via     multiple protocols to compromise Java SE.
    (CVE-2018-3150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3002 advisory.

  - OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)     (CVE-2018-3136)

  - OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

  - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

  - OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

  - OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)

  - OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)

  - Oracle JDK: unspecified vulnerability fixed in 8u191 (JavaFX) (CVE-2018-3209)

  - Oracle JDK: unspecified vulnerability fixed in 8u191 and 11.0.1 (Serviceability) (CVE-2018-3211)

  - OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

  - libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for     denial of service (CVE-2018-13785)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 11 Update 1, 8 Update 191, 7 Update 201, or 6 Update 211. It is, therefore, affected by multiple vulnerabilities related to the following components :

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Deployment (libpng) subcomponent could allow an unauthenticated, remote attacker with network access via HTTP to compromise Java SE, Java SE Embedded. (CVE-2018-13785)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Hotspot subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. (CVE-2018-3169)

 - An unspecified vulnerability in the Java SE component of Oracle Java SE in the JavaFX subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE.
 (CVE-2018-3209)

 - An unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE in the JNDI subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.
 (CVE-2018-3149) 
 - An unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE in the JSSE subcomponent could allow an unauthenticated, remote attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded, JRockit.
 (CVE-2018-3180)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Networking subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.
 (CVE-2018-3139)

 - An unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE in the Scripting subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. (CVE-2018-3183)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Security subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. (CVE-2018-3136)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Serviceability subcomponent could allow a low privileged attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. (CVE-2018-3211)

 - An unspecified vulnerability in the Java SE component of Oracle Java SE in the Sound subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE.
 (CVE-2018-3157)
 - An unspecified vulnerability in the Java SE component of Oracle Java SE in the Utility subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE. (CVE-2018-3150)

ID	Name	Product	Family	Published	Updated	Severity
118372	RHEL 6 : java-1.8.0-oracle (RHSA-2018:3003)	Nessus	Red Hat Local Security Checks	10/25/2018	2/3/2022	critical
122001	Photon OS 2.0: Openjdk8 PHSA-2018-2.0-0106	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	critical
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	4/29/2020	3/14/2024	critical
118228	Oracle Java SE Multiple Vulnerabilities (October 2018 CPU)	Nessus	Windows	10/19/2018	4/11/2022	critical
127959	GLSA-201908-10 : Oracle JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/20/2019	5/2/2024	critical
121892	Photon OS 1.0: Openjdk PHSA-2018-1.0-0192	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	critical
118227	Oracle Java SE Multiple Vulnerabilities (October 2018 CPU) (Unix)	Nessus	Misc.	10/19/2018	4/19/2024	critical
118371	RHEL 7 : java-1.8.0-oracle (RHSA-2018:3002)	Nessus	Red Hat Local Security Checks	10/25/2018	4/27/2024	critical
136109	Photon OS 1.0: Openjdk11 PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	4/29/2020	3/14/2024	critical
700659	Oracle Java SE 6 < Update 211 / 7 < Update 201 / 8 < Update 191 / 11 < Update 1 Multiple Vulnerabilities (October 2018 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium