The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3023-1 advisory.

    Updated to version jdk-17.0.8+7 (July 2023 CPU):

      - CVE-2023-22006: Fixed vulnerability in the network component (bsc#1213473).
      - CVE-2023-22036: Fixed vulnerability in the utility component (bsc#1213474).
      - CVE-2023-22041: Fixed vulnerability in the hotspot component (bsc#1213475).
      - CVE-2023-22044: Fixed vulnerability in the hotspot component (bsc#1213479).
      - CVE-2023-22045: Fixed vulnerability in the hotspot component (bsc#1213481).
      - CVE-2023-22049: Fixed vulnerability in the libraries component (bsc#1213482).
      - CVE-2023-25193: Fixed vulnerability in the embedded harfbuzz module (bsc#1207922).

      - JDK-8294323: Improve Shared Class Data
      - JDK-8296565: Enhanced archival support
      - JDK-8298676, JDK-8300891: Enhanced Look and Feel
      - JDK-8300285: Enhance TLS data handling
      - JDK-8300596: Enhance Jar Signature validation
      - JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1
      - JDK-8302475: Enhance HTTP client file downloading
      - JDK-8302483: Enhance ZIP performance
      - JDK-8303376: Better launching of JDI
      - JDK-8304460: Improve array usages
      - JDK-8304468: Better array usages
      - JDK-8305312: Enhanced path handling
      - JDK-8308682: Enhance AES performance

      Bugfixes:

      - JDK-8178806: Better exception logging in crypto code
      - JDK-8201516: DebugNonSafepoints generates incorrect         information
      - JDK-8224768: Test ActalisCA.java fails
      - JDK-8227060: Optimize safepoint cleanup subtask order
      - JDK-8227257: javax/swing/JFileChooser/4847375/bug4847375.java         fails with AssertionError
      - JDK-8238274: (sctp) JDK-7118373 is not fixed for SctpChannel
      - JDK-8244976: vmTestbase/nsk/jdi/Event/request/request001.java         doesn' initialize eName
      - JDK-8245877: assert(_value != __null) failed: resolving NULL
        _value in JvmtiExport::post_compiled_method_load
      - JDK-8248001: javadoc generates invalid HTML pages whose         ftp:// links are broken
      - JDK-8252990: Intrinsify Unsafe.storeStoreFence
      - JDK-8254711: Add java.security.Provider.getService JFR Event
      - JDK-8257856: Make ClassFileVersionsTest.java robust to JDK         version updates
      - JDK-8261495: Shenandoah: reconsider update references memory         ordering
      - JDK-8268288: jdk/jfr/api/consumer/streaming/         /TestOutOfProcessMigration.java fails with 'Error:
        ShouldNotReachHere()'
      - JDK-8268298: jdk/jfr/api/consumer/log/TestVerbosity.java         fails: unexpected log message
      - JDK-8268582: javadoc throws NPE with --ignore-source-errors         option
      - JDK-8269821: Remove is-queue-active check in inner loop of         write_ref_array_pre_work
      - JDK-8270434: JDI+UT: Unexpected event in JDI tests
      - JDK-8270859: Post JEP 411 refactoring: client libs with         maximum covering > 10K
      - JDK-8270869: G1ServiceThread may not terminate
      - JDK-8271519: java/awt/event/SequencedEvent/         /MultipleContextsFunctionalTest.java failed with 'Total [200]
        - Expected [400]'
      - JDK-8273909: vmTestbase/nsk/jdi/Event/request/request001 can         still fail with 'ERROR: new event is not ThreadStartEvent'
      - JDK-8274243: Implement fast-path for ASCII-compatible         CharsetEncoders on aarch64
      - JDK-8274615: Support relaxed atomic add for linux-aarch64
      - JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
      - JDK-8275233: Incorrect line number reported in exception         stack trace thrown from a lambda expression
      - JDK-8275287: Relax memory ordering constraints on updating         instance class and array class counters
      - JDK-8275721: Name of UTC timezone in a locale changes         depending on previous code
      - JDK-8275735: [linux] Remove deprecated Metrics api (kernel         memory limit)
      - JDK-8276058: Some swing test fails on specific CI macos system
      - JDK-8277407: javax/swing/plaf/synth/SynthButtonUI/6276188/         /bug6276188.java fails to compile after JDK-8276058
      - JDK-8277775: Fixup bugids in RemoveDropTargetCrashTest.java -         add 4357905
      - JDK-8278146: G1: Rework VM_G1Concurrent VMOp to clearly         identify it as pause
      - JDK-8278434: timeouts in test  java/time/test/java/time/         /format/TestZoneTextPrinterParser.java
      - JDK-8278834: Error 'Cannot read field 'sym' because         'this.lvar[od]' is null' when compiling
      - JDK-8282077: PKCS11 provider C_sign() impl should handle         CKR_BUFFER_TOO_SMALL error
      - JDK-8282201: Consider removal of expiry check in         VerifyCACerts.java test
      - JDK-8282227: Locale information for nb is not working properly
      - JDK-8282704: runtime/Thread/StopAtExit.java may leak memory
      - JDK-8283057: Update GCC to version 11.2.0 for Oracle builds         on Linux
      - JDK-8283062: Uninitialized warnings in libgtest with GCC 11.2
      - JDK-8283520: JFR: Memory leak in dcmd_arena
      - JDK-8283566: G1: Improve G1BarrierSet::enqueue performance
      - JDK-8284331: Add sanity check for signal handler modification         warning.
      - JDK-8285635: javax/swing/JRootPane/DefaultButtonTest.java         failed with Default Button not pressed for L&F:
        com.sun.java.swing.plaf.motif.MotifLookAndFeel
      - JDK-8285987: executing shell scripts without #! fails on         Alpine linux
      - JDK-8286191: misc tests fail due to JDK-8285987
      - JDK-8286287: Reading file as UTF-16 causes Error which         'shouldn't happen'
      - JDK-8286331: jni_GetStringUTFChars() uses wrong heap allocator
      - JDK-8286346: 3-parameter version of AllocateHeap should not         ignore AllocFailType
      - JDK-8286398: Address possibly lossy conversions in         jdk.internal.le
      - JDK-8287007: [cgroups] Consistently use stringStream         throughout parsing code
      - JDK-8287246: DSAKeyValue should check for missing params         instead of relying on KeyFactory provider
      - JDK-8287541: Files.writeString fails to throw IOException for         charset 'windows-1252'
      - JDK-8287854: Dangling reference in ClassVerifier::verify_class
      - JDK-8287876: The recently de-problemlisted         TestTitledBorderLeak test is unstable
      - JDK-8287897: Augment src/jdk.internal.le/share/legal/jline.md         with information on 4th party dependencies
      - JDK-8288589: Files.readString ignores encoding errors for         UTF-16
      - JDK-8289509: Improve test coverage for XPath Axes:
        descendant, descendant-or-self, following, following-sibling
      - JDK-8289735: UTIL_LOOKUP_PROGS fails on pathes with space
      - JDK-8289949: Improve test coverage for XPath: operators
      - JDK-8290822: C2: assert in PhaseIdealLoop::do_unroll() is         subject to undefined behavior
      - JDK-8291226: Create Test Cases to cover scenarios for         JDK-8278067
      - JDK-8291637: HttpClient default keep alive timeout not         followed if server sends invalid value
      - JDK-8291638: Keep-Alive timeout of 0 should close connection         immediately
      - JDK-8292206: TestCgroupMetrics.java fails as getMemoryUsage()         is lower than expected
      - JDK-8292301: [REDO v2] C2 crash when allocating array of size         too large
      - JDK-8292407: Improve Weak CAS VarHandle/Unsafe tests         resilience under spurious failures
      - JDK-8292713: Unsafe.allocateInstance should be intrinsified         without UseUnalignedAccesses
      - JDK-8292755: Non-default method in interface leads to a stack         overflow in JShell
      - JDK-8292990: Improve test coverage for XPath Axes: parent
      - JDK-8293295: Add type check asserts to         java_lang_ref_Reference accessors
      - JDK-8293492: ShenandoahControlThread missing from hs-err log         and thread dump
      - JDK-8293858: Change PKCS7 code to use default SecureRandom         impl instead of SHA1PRNG
      - JDK-8293887: AArch64 build failure with GCC 12 due to         maybe-uninitialized warning in libfdlibm k_rem_pio2.c
      - JDK-8294183: AArch64: Wrong macro check in         SharedRuntime::generate_deopt_blob
      - JDK-8294281: Allow warnings to be disabled on a per-file basis
      - JDK-8294673: JFR: Add SecurityProviderService#threshold to         TestActiveSettingEvent.java
      - JDK-8294717: (bf) DirectByteBuffer constructor will leak if         allocating Deallocator or Cleaner fails with OOME
      - JDK-8294906: Memory leak in PKCS11 NSS TLS server
      - JDK-8295564: Norwegian Nynorsk Locale is missing formatting
      - JDK-8295974: jni_FatalError and Xcheck:jni warnings should         print the native stack when there are no Java frames
      - JDK-8296084: javax/swing/JSpinner/4788637/bug4788637.java         fails intermittently on a VM
      - JDK-8296318: use-def assert: special case undetected loops         nested in infinite loops
      - JDK-8296343: CPVE thrown on missing content-length in OCSP         response
      - JDK-8296412: Special case infinite loops with unmerged         backedges in IdealLoopTree::check_safepts
      - JDK-8296545: C2 Blackholes should allow load optimizations
      - JDK-8296934: Write a test to verify whether Undecorated Frame         can be iconified or not
      - JDK-8297000: [jib] Add more friendly warning for proxy issues
      - JDK-8297154: Improve safepoint cleanup logging
      - JDK-8297450: ScaledTextFieldBorderTest.java fails when run         with -show parameter
      - JDK-8297587: Upgrade JLine to 3.22.0
      - JDK-8297730: C2: Arraycopy intrinsic throws incorrect         exception
      - JDK-8297955: LDAP CertStore should use LdapName and not         String for DNs
      - JDK-8298488: [macos13] tools/jpackage tests failing with         'Exit code: 137' on macOS
      - JDK-8298887: On the latest macOS+XCode the Robot API may         report wrong colors
      - JDK-8299179: ArrayFill with store on backedge needs to reduce         length by 1
      - JDK-8299259: C2: Div/Mod nodes without zero check could be         split through iv phi of loop resulting in SIGFPE
      - JDK-8299544: Improve performance of CRC32C intrinsics         (non-AVX-512) for small inputs
      - JDK-8299570: [JVMCI] Insufficient error handling when         CodeBuffer is exhausted
      - JDK-8299959: C2: CmpU::Value must filter overflow computation         against local sub computation
      - JDK-8300042: Improve CPU related JFR events descriptions
      - JDK-8300079: SIGSEGV in LibraryCallKit::inline_string_copy         due to constant NULL src argument
      - JDK-8300823: UB: Compile::_phase_optimize_finished is         initialized too late
      - JDK-8300939: sun/security/provider/certpath/OCSP/         /OCSPNoContentLength.java fails due to network errors
      - JDK-8301050: Detect Xen Virtualization on Linux aarch64
      - JDK-8301119: Support for GB18030-2022
      - JDK-8301123: Enable Symbol refcounting underflow checks in         PRODUCT
      - JDK-8301190: [vectorapi] The typeChar of LaneType is         incorrect when default locale is tr
      - JDK-8301216: ForkJoinPool invokeAll() ignores timeout
      - JDK-8301338: Identical branch conditions in         CompileBroker::print_heapinfo
      - JDK-8301491: C2: java.lang.StringUTF16::indexOfChar intrinsic         called with negative character argument
      - JDK-8301637: ThreadLocalRandom.current().doubles().parallel()         contention
      - JDK-8301661: Enhance os::pd_print_cpu_info on macOS and         Windows
      - JDK-8302151: BMPImageReader throws an exception reading BMP         images
      - JDK-8302172: [JVMCI] HotSpotResolvedJavaMethodImpl.canBeInlined         must respect ForceInline
      - JDK-8302320: AsyncGetCallTrace obtains too few frames in         sanity test
      - JDK-8302491: NoClassDefFoundError omits the original cause of         an error
      - JDK-8302508: Add timestamp to the output TraceCompilerThreads
      - JDK-8302594: use-after-free in Node::destruct
      - JDK-8302595: use-after-free related to GraphKit::clone_map
      - JDK-8302791: Add specific ClassLoader object to Proxy         IllegalArgumentException message
      - JDK-8302849: SurfaceManager might expose partially         constructed object
      - JDK-8303069: Memory leak in CompilerOracle::parse_from_line
      - JDK-8303102: jcmd: ManagementAgent.status truncates the text         longer than O_BUFLEN
      - JDK-8303130: Document required Accessibility permissions on         macOS
      - JDK-8303354: addCertificatesToKeystore in KeystoreImpl.m         needs CFRelease call in early potential CHECK_NULL return
      - JDK-8303433: Bump update version for OpenJDK: jdk-17.0.8
      - JDK-8303440: The 'ZonedDateTime.parse' may not accept the         'UTC+XX' zone id
      - JDK-8303465: KeyStore of type KeychainStore, provider Apple         does not show all trusted certificates
      - JDK-8303476: Add the runtime version in the release file of a         JDK image
      - JDK-8303482: Update LCMS to 2.15
      - JDK-8303508: Vector.lane() gets wrong value on x86
      - JDK-8303511: C2: assert(get_ctrl(n) == cle_out) during         unrolling
      - JDK-8303564: C2: 'Bad graph detected in build_loop_late'         after a CMove is wrongly split thru phi
      - JDK-8303575: adjust Xen handling on Linux aarch64
      - JDK-8303576: addIdentitiesToKeystore in KeystoreImpl.m needs         CFRelease call in early potential CHECK_NULL return
      - JDK-8303588: [JVMCI] make JVMCI source directories conform         with standard layout
      - JDK-8303809: Dispose context in SPNEGO NegotiatorImpl
      - JDK-8303822: gtestMain should give more helpful output
      - JDK-8303861: Error handling step timeouts should never be         blocked by OnError and others
      - JDK-8303937: Corrupted heap dumps due to missing retries for         os::write()
      - JDK-8303949: gcc10 warning Linux ppc64le - note: the layout         of aggregates containing vectors with 8-byte alignment has         changed in GCC 5
      - JDK-8304054: Linux: NullPointerException from         FontConfiguration.getVersion in case no fonts are installed
      - JDK-8304063: tools/jpackage/share/AppLauncherEnvTest.java         fails when checking LD_LIBRARY_PATH
      - JDK-8304134: jib bootstrapper fails to quote filename when         checking download filetype
      - JDK-8304291: [AIX] Broken build after JDK-8301998
      - JDK-8304295: harfbuzz build fails with GCC 7 after JDK-8301998
      - JDK-8304350: Font.getStringBounds calculates wrong width for         TextAttribute.TRACKING other than 0.0
      - JDK-8304671: javac regression: Compilation with --release 8         fails on underscore in enum identifiers
      - JDK-8304683: Memory leak in WB_IsMethodCompatible
      - JDK-8304760: Add 2 Microsoft TLS roots
      - JDK-8304867: Explicitly disable dtrace for ppc builds
      - JDK-8304880: [PPC64] VerifyOops code in C1 doesn't work with         ZGC
      - JDK-8305088: SIGSEGV in Method::is_method_handle_intrinsic
      - JDK-8305113: (tz) Update Timezone Data to 2023c
      - JDK-8305400: ISO 4217 Amendment 175 Update
      - JDK-8305403: Shenandoah evacuation workers may deadlock
      - JDK-8305481: gtest is_first_C_frame failing on ARM
      - JDK-8305690: [X86] Do not emit two REX prefixes in         Assembler::prefix
      - JDK-8305711: Arm: C2 always enters slowpath for monitorexit
      - JDK-8305721: add `make compile-commands` artifacts to         .gitignore
      - JDK-8305975: Add TWCA Global Root CA
      - JDK-8305993: Add handleSocketErrorWithMessage to extend nio         Net.c exception message
      - JDK-8305994: Guarantee eventual async monitor deflation
      - JDK-8306072: Open source several AWT MouseInfo related tests
      - JDK-8306133: Open source few AWT Drag & Drop related tests
      - JDK-8306409: Open source AWT KeyBoardFocusManger,         LightWeightComponent related tests
      - JDK-8306432: Open source several AWT Text Component related         tests
      - JDK-8306466: Open source more AWT Drag & Drop related tests
      - JDK-8306489: Open source AWT List related tests
      - JDK-8306543: GHA: MSVC installation is failing
      - JDK-8306640: Open source several AWT TextArea related tests
      - JDK-8306652: Open source AWT MenuItem related tests
      - JDK-8306658: GHA: MSVC installation could be optional since         it might already be pre-installed
      - JDK-8306664: GHA: Update MSVC version to latest stepping
      - JDK-8306681: Open source more AWT DnD related tests
      - JDK-8306683: Open source several clipboard and color AWT tests
      - JDK-8306752: Open source several container and component AWT         tests
      - JDK-8306753: Open source several container AWT tests
      - JDK-8306755: Open source few Swing JComponent and         AbstractButton tests
      - JDK-8306768: CodeCache Analytics reports wrong threshold
      - JDK-8306774: Make runtime/Monitor/         /GuaranteedAsyncDeflationIntervalTest.java more reliable
      - JDK-8306825: Monitor deflation might be accidentally disabled         by zero intervals
      - JDK-8306850: Open source AWT Modal related tests
      - JDK-8306871: Open source more AWT Drag & Drop tests
      - JDK-8306883: Thread stacksize is reported with wrong units in         os::create_thread logging
      - JDK-8306941: Open source several datatransfer and dnd AWT         tests
      - JDK-8306943: Open source several dnd AWT tests
      - JDK-8306954: Open source five Focus related tests
      - JDK-8306955: Open source several JComboBox jtreg tests
      - JDK-8306976: UTIL_REQUIRE_SPECIAL warning on grep
      - JDK-8306996: Open source Swing MenuItem related tests
      - JDK-8307080: Open source some more JComboBox jtreg tests
      - JDK-8307128: Open source some drag and drop tests 4
      - JDK-8307130: Open source few Swing JMenu tests
      - JDK-8307133: Open source some JTable jtreg tests
      - JDK-8307134: Add GTS root CAs
      - JDK-8307135: java/awt/dnd/NotReallySerializableTest/         /NotReallySerializableTest.java failed
      - JDK-8307331: Correctly update line maps when class redefine         rewrites bytecodes
      - JDK-8307346: Add missing gc+phases logging for         ObjectCount(AfterGC) JFR event collection code
      - JDK-8307347: serviceability/sa/ClhsdbDumpclass.java could         leave files owned by root on macOS
      - JDK-8307378: Allow collectors to provide specific values for         GC notifications' actions
      - JDK-8307381: Open Source JFrame, JIF related Swing Tests
      - JDK-8307425: Socket input stream read burns CPU cycles with         back-to-back poll(0) calls
      - JDK-8307799: Newly added java/awt/dnd/MozillaDnDTest.java has         invalid jtreg `@requires` clause
      - JDK-8308554: [17u] Fix commit of 8286191. vm.musl was not         removed from ExternalEditorTest
      - JDK-8308880: [17u] micro bench ZoneStrings missed in backport         of 8278434
      - JDK-8308884: [17u/11u] Backout JDK-8297951
      - JDK-8311467: [17u] Remove designator         DEFAULT_PROMOTED_VERSION_PRE=ea for release 17.0.8

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6272-1 advisory.

    Motoyasu Saburi discovered that OpenJDK 20 incorrectly handled special characters in file name parameters.
    An attacker could possibly use this issue to insert, edit or obtain sensitive information.
    (CVE-2023-22006)

    Eirik Bjrsns discovered that OpenJDK 20 incorrectly handled certain ZIP archives. An attacker could     possibly use this issue to cause a denial of service. (CVE-2023-22036)

    David Stancu discovered that OpenJDK 20 had a flaw in the AES cipher implementation. An attacker could     possibly use this issue to obtain sensitive information. (CVE-2023-22041)

    Zhiqiang Zang discovered that OpenJDK 20 incorrectly handled array accesses when using the binary '%'     operator. An attacker could possibly use this issue to obtain sensitive information. (CVE-2023-22044)

    Zhiqiang Zang discovered that OpenJDK 20 incorrectly handled array accesses. An attacker could possibly     use this issue to obtain sensitive information. (CVE-2023-22045)

    It was discovered that OpenJDK 20 incorrectly sanitized URIs strings. An attacker could possibly use this     issue to insert, edit or obtain sensitive information. (CVE-2023-22049)

    It was discovered that OpenJDK 20 incorrectly handled certain glyphs. An attacker could possibly use this     issue to cause a denial of service. (CVE-2023-25193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 7 prior to 7.63.0.14 / 8 prior to 8.71.0.14 / 11 prior to 11.65.14 / 17 prior to 17.43.14 / 20 prior to 20.32.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023-07-18 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf,     11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for     JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to     the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK     executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-22041)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19,     17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7     and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for     JDK. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-22006)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of     Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19,     17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7     and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for     JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial     of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
    (CVE-2023-22036)

  - Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java     SE: 8u371. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-22043)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf,     17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and     20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for     JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle     Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This     vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which     supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2023-22044)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4170 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4177 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Installing the same java-17-openjdk-headless package on two different systems resulted in distinct     classes.jsa files getting generated. This was because the CDS archive was being generated by a post script     action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the     checksum in the archive would be different on each system. This is resolved in this release by using the     .jsa files generated during the initial build. (RHBZ#2221653)

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [rhel-9] (BZ#2222852)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202407-24 (HarfBuzz: Denial of Service)

    Multiple vulnerabilities have been discovered in HarfBuzz. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3406-1 advisory.

    - Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)
    - CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute     arbitrary code on the system. (bsc#1213934)
    - CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access.
    (bsc#1213475)
    - CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)
    - CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)
    - CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)
    - CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of     service. (bsc#1213474)
    - CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks     during the process of looking back for base glyphs when attaching marks. (bsc#1207922)
    - CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK     accessible data. (bsc#1213473)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
179116	openSUSE 15: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2023:3023-1)	Nessus	SuSE Local Security Checks	2023/8/1	2026/6/26	medium
179340	Ubuntu 23.04 : OpenJDK 20 vulnerabilities (USN-6272-1)	Nessus	Ubuntu Local Security Checks	2023/8/3	2024/8/27	medium
178473	Azul Zulu Java Multiple Vulnerabilities (2023-07-18)	Nessus	Misc.	2023/7/19	2026/9/10	medium
178565	RHEL 8 : java-17-openjdk (RHSA-2023:4170)	Nessus	Red Hat Local Security Checks	2023/7/20	2024/11/7	medium
178632	RHEL 9 : java-17-openjdk (RHSA-2023:4177)	Nessus	Red Hat Local Security Checks	2023/7/20	2025/3/14	medium
202107	GLSA-202407-24 : HarfBuzz: Denial of Service	Nessus	Gentoo Local Security Checks	2024/7/10	2024/7/10	medium
180149	SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2023:3406-1)	Nessus	SuSE Local Security Checks	2023/8/24	2026/6/26	critical

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

critical