The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4115 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

  - IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4113 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

  - IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 [bsc#1158442, bsc#1154212]

  - Security fixes: CVE-2019-2933 CVE-2019-2945     CVE-2019-2958 CVE-2019-2962 CVE-2019-2964 CVE-2019-2975     CVE-2019-2978 CVE-2019-2983 CVE-2019-2988 CVE-2019-2989     CVE-2019-2992 CVE-2019-2996 CVE-2019-2999 CVE-2019-2973     CVE-2019-2981 CVE-2019-17631

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0046 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

  - IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Java installed on the remote host is prior to 8.0 < 8.0.6.0. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update November 2019 advisory.

  - From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a     diagnostic file are permitted without any privilege checks. (CVE-2019-17631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0006 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

  - IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
131921	RHEL 7 : java-1.8.0-ibm (RHSA-2019:4115)	Nessus	Red Hat Local Security Checks	12/10/2019	4/27/2024	critical
131919	RHEL 6 : java-1.8.0-ibm (RHSA-2019:4113)	Nessus	Red Hat Local Security Checks	12/10/2019	4/28/2024	critical
132704	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0024-1)	Nessus	SuSE Local Security Checks	1/8/2020	4/1/2024	critical
132701	RHEL 8 : java-1.8.0-ibm (RHSA-2020:0046)	Nessus	Red Hat Local Security Checks	1/8/2020	4/27/2024	critical
160351	IBM Java 8.0 < 8.0.6.0	Nessus	Misc.	4/29/2022	4/29/2022	critical
132670	SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0001-1)	Nessus	SuSE Local Security Checks	1/6/2020	4/1/2024	critical
132684	RHEL 6 : java-1.8.0-ibm (RHSA-2020:0006)	Nessus	Red Hat Local Security Checks	1/7/2020	4/24/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical