远程主机上安装的 Oracle（旧称 Sun）Java SE 或 Java for Business 的版本低于 8 Update 11、7 Update 65、6 Update 81 或 5 Update 71。因此，它受到以下组件中的安全问题影响：

- Deployment
 - Hotspot
 - JavaFX
 - JMX
 - Libraries
 - Security
 - Serviceability
 - Swing

已发现 OpenJDK（Oracle Java 平台的实现）中存在多个漏洞，导致任意代码执行、Java 沙盒中断、信息泄露或拒绝服务。

远程主机上安装的 VMware vCenter 版本是未应用 Update 3c 的 5.0、未应用 Update 3 的 5.1 或未应用 Update 2 的 5.5。
因此，它受到第三方库中库中多种漏洞的影响：

- 由于连接到 ESXi 主机上的 CIM 服务器时未正确验证证书，攻击者可执行中间人攻击。(CVE-2014-8371)

- Oracle JRE 的捆绑版本低于 1.6.0_81，因此受到多种漏洞影响。请注意，这仅影响 vCenter 的 5.1 和 5.0 版，但仅在 5.1 Update 3 中修复。

Oracle's July 2014 security update for Java fixes the following vulnerabilities:

  - The Hotspot component in OpenJDK did not properly verify bytecode from the class files, which could allow a Java application or applet to bypass Java sandbox restrictions (CVE-2014-4216, CVE-2014-4219)

  - A format string flaw was discovered in the Hotspot component event logger in OpenJDK, which could be leveraged by an untrusted Java application or applet to crash the Java Virtual Machine or execute arbitrary code with the privileges of the Java Virtual Machine (CVE-2014-2490)

  - Multiple improper permission check issues were discovered in the Libraries component in OpenJDK, which could be leveraged to bypass Java sandbox restrictions (CVE-2014-4223, CVE-2014-4262, CVE-2014-2483)

  - Multiple flaws were discovered in the JMX, Libraries, Security, and Serviceability components in OpenJDK that could be leveraged to bypass certain Java sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221, CVE-2014-4252, CVE-2014-4266)

  - The RSA algorithm in the Security component in OpenJDK did not sufficiently perform blinding while performing operations that were using private keys, which could allow an attacker with the ability to measure timing differences of those operations to obtain information about the used keys (CVE-2014-4244)

  - Diffie-Hellman (DH) key exchange algorithm implementation in the Security component in OpenJDK failed to validate public DH parameters properly, which could result in an attacker recovering the negotiated key (CVE-2014-4263)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
76532	Oracle Java SE 多种漏洞（2014 年 7 月 CPU）	Nessus	Windows	2014/7/16	2024/12/19	critical
76842	Debian DSA-2987-1：openjdk-7 - 安全更新	Nessus	Debian Local Security Checks	2014/7/26	2021/1/11	high
76533	Oracle Java SE 多种漏洞（2014 年 7 月 CPU）(Unix)	Nessus	Misc.	2014/7/16	2022/4/11	critical
79865	适用于 vCenter Server 的 VMware 安全更新 (VMSA-2014-0012)	Nessus	Misc.	2014/12/12	2018/11/15	critical
8332	Oracle Java Update (July 2014) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/7/23	2019/3/6	high

検出

プラグインの検索

critical

high

critical

critical

high