This update for java-1_7_1-ibm fixes the following issues :

  - Security update to version 7.1.4.15 [bsc#1070162]

  - CVE-2017-10349: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10348: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10388: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2016-9841: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10293: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10345: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10350: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10356: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10357: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10347: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10355: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10285: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10281: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10295: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10346: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2016-10165: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-ibm fixes the following issues :

  - Security update to version 7.0.10.15 (bsc#1070162) :

  - CVE-2017-10346 CVE-2017-10285 CVE-2017-10388     CVE-2017-10356 CVE-2017-10293 CVE-2016-9841     CVE-2016-10165 CVE-2017-10355 CVE-2017-10357     CVE-2017-10348 CVE-2017-10349 CVE-2017-10347     CVE-2017-10350 CVE-2017-10281 CVE-2017-10295     CVE-2017-10345

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 9 Update 1, 8 Update 151, 7 Update 161, or 6 Update 171. It is, therefore, affected by multiple vulnerabilities related to the following components :

  - 2D (Little CMS 2)
  - Deployment
  - Hotspot
  - JAX-WS
  - JAXP
  - Javadoc
  - Libraries
  - Networking
  - RMI
  - Security
  - Serialization
  - Smart Card IO
  - Util (zlib)

An update for java-1.6.0-sun is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 6 to version 6 Update 171.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2017-10274, CVE-2017-10281, CVE-2017-10285, CVE-2017-10293, CVE-2017-10295, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348, CVE-2017-10349, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357, CVE-2017-10388)

Note: Starting with this update, Java web browser plugin and Java Web Start application are no longer included with Oracle Java SE 6. Refer to the Releases Notes and the Oracle Java SE Support Roadmap pages linked to in the References section for further information about this change.

This update for java-1_8_0-ibm fixes the following issues: Security issues fixed :

  - Security update to version 8.0.5.5 (bsc#1070162)

  - CVE-2017-10346 CVE-2017-10285 CVE-2017-10388     CVE-2017-10309 CVE-2017-10356 CVE-2017-10293     CVE-2016-9841 CVE-2016-10165 CVE-2017-10355     CVE-2017-10357 CVE-2017-10348 CVE-2017-10349     CVE-2017-10347 CVE-2017-10350 CVE-2017-10281     CVE-2017-10295 CVE-2017-10345

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 9 Update 1, 8 Update 151, 7 Update 161, or 6 Update 171. It is, therefore, affected by multiple vulnerabilities related to the following components :

 - 2D (Little CMS 2)
 - Deployment
 - Hotspot
 - JAX-WS
 - JAXP
 - Javadoc
 - Libraries
 - Networking
 - RMI
 - Security
 - Serialization
 - Smart Card IO
 - Util (zlib)

This update for java-1_7_1-ibm fixes the following issues :

  - CVE-2017-10349: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10348: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10388: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2016-9841: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10293: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10345: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10350: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10356: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10357: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10347: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10355: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10285: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10281: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10295: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2017-10346: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

  - CVE-2016-10165: 'Vulnerability in the Java SE, Java SE     Embedded, JRockit component of Oracle Java SE     (subcomponent: Serialization). Supported versions that     are affected are Java SE: 6u161, 7u151, 8u144 and 9;
    Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability can be exploited     through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-31 (Oracle JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s Java  SE.
      Please review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could cause a Denial of Service condition, modify       arbitrary data, or have numerous other impacts.
  Workaround :

    There is no known workaround at this time.

This update for java-1_6_0-ibm fixes the following issues: Security issues fixed :

  - Security update to version 6.0.16.50 (bsc#1070162)

  - CVE-2017-10346 CVE-2017-10285 CVE-2017-10388     CVE-2017-10356 CVE-2017-10293 CVE-2016-9841     CVE-2017-10355 CVE-2017-10357 CVE-2017-10348     CVE-2017-10349 CVE-2017-10347 CVE-2017-10350     CVE-2017-10281 CVE-2017-10295 CVE-2017-10345

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 8 to version 8 Update 151.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-10274, CVE-2017-10281, CVE-2017-10285, CVE-2017-10293, CVE-2017-10295, CVE-2017-10309, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348, CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357, CVE-2017-10388)

An update for java-1.7.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 7 to version 7 Update 161.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-10274, CVE-2017-10281, CVE-2017-10285, CVE-2017-10293, CVE-2017-10295, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348, CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357, CVE-2017-10388)

Note: Starting with this update, Java web browser plugin and Java Web Start application are no longer included with Oracle Java SE 7. Refer to the Releases Notes and the Oracle Java SE Support Roadmap pages linked to in the References section for further information about this change.

ID	Name	Product	Family	Published	Updated	Severity
105506	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2017:3455-1)	Nessus	SuSE Local Security Checks	2018/01/02	2019/09/11	high
105744	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0061-1)	Nessus	SuSE Local Security Checks	2018/01/11	2019/09/10	high
103963	Oracle Java SE Multiple Vulnerabilities (October 2017 CPU)	Nessus	Windows	2017/10/19	2019/11/12	high
104140	RHEL 6 / 7 : java-1.6.0-sun (RHSA-2017:3047)	Nessus	Red Hat Local Security Checks	2017/10/25	2019/10/24	high
105462	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:3411-1)	Nessus	SuSE Local Security Checks	2017/12/26	2019/09/11	high
700655	Oracle Java SE 6 < Update 171 / 7 < Update 161 / 8 < Update 151 / 9 < Update 1 Multiple Vulnerabilities (October 2017 CPU)	Nessus Network Monitor	Web Clients	2019/05/02	2019/05/02	high
105482	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:3440-1)	Nessus	SuSE Local Security Checks	2017/12/28	2019/09/11	high
104232	GLSA-201710-31 : Oracle JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/10/30	2019/04/10	medium
105388	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2017:3369-1)	Nessus	SuSE Local Security Checks	2017/12/20	2019/09/11	high
120008	SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2017:3235-1)	Nessus	SuSE Local Security Checks	2019/01/02	2019/09/11	high
104116	RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2017:2999)	Nessus	Red Hat Local Security Checks	2017/10/24	2019/10/24	high
104139	RHEL 6 / 7 : java-1.7.0-oracle (RHSA-2017:3046)	Nessus	Red Hat Local Security Checks	2017/10/25	2019/10/24	high
103964	Oracle Java SE Multiple Vulnerabilities (October 2017 CPU) (Unix)	Nessus	Misc.	2017/10/19	2019/11/12	high

Plugins Search