The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3409 advisory.

    [1:1.7.0.201-2.6.16.0.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.201-2.6.16.0]
    - Bump to 2.6.16 and u201b00.
    - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
    - Resolves: rhbz#1633817

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, incomplete TLS identity verification, information disclosure or the execution of arbitrary code.

For Debian 8 'Jessie', these problems have been fixed in version 7u181-2.6.14-2~deb8u1.

We recommend that you upgrade your openjdk-7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - OpenJDK: Improper field access checks (Hotspot, 8199226)     (CVE-2018-3169)

  - OpenJDK: Incomplete enforcement of the trustURLCodebase     restriction (JNDI, 8199177) (CVE-2018-3149)

  - OpenJDK: Incorrect handling of unsigned attributes in     signed Jar manifests (Security, 8194534) (CVE-2018-3136)

  - OpenJDK: Leak of sensitive header data via HTTP redirect     (Networking, 8196902) (CVE-2018-3139)

  - OpenJDK: Missing endpoint identification algorithm check     during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)

  - OpenJDK: Infinite loop in RIFF format reader (Sound,     8205361) (CVE-2018-3214)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-2942 advisory.

    [1:1.8.0.191.b12-0]
    - Update to aarch64-shenandoah-jdk8u191-b12.
    - Resolves: rhbz#1633817

    [1:1.8.0.191.b10-0]
    - Update to aarch64-shenandoah-jdk8u191-b10.
    - Drop 8146115/PR3508/RH1463098 applied upstream.
    - Resolves: rhbz#1633817

    [1:1.8.0.181.b16-0]
    - Add new Shenandoah patch PR3634 as upstream still fails on s390.
    - Resolves: rhbz#1633817

    [1:1.8.0.181.b16-0]
    - Update to aarch64-shenandoah-jdk8u181-b16.
    - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
    - Resolves: rhbz#1633817

    [1:1.8.0.181.b15-0]
    - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
    - Update to aarch64-shenandoah-jdk8u181-b15.
    - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
    - Move buildver to where it should be in the OpenJDK version.
    - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
    - Update pr3539-rh1548475.patch to apply after 8187045.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Remove unneeded functions from ppc shenandoahBarrierSet.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Add missing shenandoahBarrierSet implementation for ppc64{be,le}.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Fix wrong format specifiers in Shenandoah code.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Avoid changing variable types to fix size_t, at least for now.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - More size_t fixes for Shenandoah.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Add additional s390 size_t case for Shenandoah.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Actually add the patch...
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Attempt to fix Shenandoah build issues on s390.
    - Resolves: rhbz#1633817

    [1:1.8.0.181-4.b13]
    - Use the Shenandoah HotSpot on all architectures.
    - Resolves: rhbz#1633817

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2943 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

    * OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)

    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

    * OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534)     (CVE-2018-3136)

    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)

    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JSSE).
    Supported versions that are affected are Java SE:
    6u201, 7u191, 8u182 and 11 Java SE Embedded: 8u181     JRockit: R28.3.19. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     SSL/TLS to compromise Java SE, Java SE Embedded,     JRockit. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE, Java SE Embedded, JRockit     accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded, JRockit     accessible data and unauthorized ability to cause a     partial denial of service (partial DOS) of Java SE,     Java SE Embedded, JRockit. (CVE-2018-3180)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: Sound).
    Supported versions that are affected are Java SE:
    6u201, 7u191 and 8u182 Java SE Embedded: 8u181 JRockit:
    R28.3.19. Easily exploitable vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded, JRockit. (CVE-2018-3214)

  - Vulnerability in the Java SE, Java SE Embedded     component of Oracle Java SE (subcomponent: Security).
    Supported versions that are affected are Java SE:
    6u201, 7u191, 8u182 and 11 Java SE Embedded: 8u181.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks require human interaction     from a person other than the attacker and while the     vulnerability is in Java SE, Java SE Embedded, attacks     may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible     data.(CVE-2018-3136)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 11 Update 1, 8 Update 191, 7 Update 201, or 6 Update 211. It is, therefore, affected by multiple vulnerabilities related to the following components :

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Deployment (libpng) subcomponent could allow an unauthenticated, remote attacker with network access via HTTP to compromise Java SE, Java SE Embedded. (CVE-2018-13785)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Hotspot subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. (CVE-2018-3169)

 - An unspecified vulnerability in the Java SE component of Oracle Java SE in the JavaFX subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE.
 (CVE-2018-3209)

 - An unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE in the JNDI subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.
 (CVE-2018-3149) 
 - An unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE in the JSSE subcomponent could allow an unauthenticated, remote attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded, JRockit.
 (CVE-2018-3180)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Networking subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.
 (CVE-2018-3139)

 - An unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE in the Scripting subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. (CVE-2018-3183)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Security subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. (CVE-2018-3136)

 - An unspecified vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE in the Serviceability subcomponent could allow a low privileged attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. (CVE-2018-3211)

 - An unspecified vulnerability in the Java SE component of Oracle Java SE in the Sound subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE.
 (CVE-2018-3157)
 - An unspecified vulnerability in the Java SE component of Oracle Java SE in the Utility subcomponent could allow an unauthenticated, remote attacker with network access via multiple protocols to compromise Java SE. (CVE-2018-3150)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
118512	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2018-3409)	Nessus	Oracle Linux Local Security Checks	2018/10/31	2024/10/22	high
119045	CentOS 7 : java-1.7.0-openjdk (CESA-2018:3350)	Nessus	CentOS Local Security Checks	2018/11/21	2022/5/26	high
119047	CentOS 6 : java-1.7.0-openjdk (CESA-2018:3409)	Nessus	CentOS Local Security Checks	2018/11/21	2022/5/26	high
119088	Virtuozzo 7 : java-1.8.0-openjdk / etc (VZLSA-2018-2942)	Nessus	Virtuozzo Local Security Checks	2018/11/21	2021/4/8	critical
119091	Virtuozzo 6 : java-1.7.0-openjdk / java-1.7.0-openjdk-demo / etc (VZLSA-2018-3409)	Nessus	Virtuozzo Local Security Checks	2018/11/21	2022/5/26	high
119105	Debian DLA-1590-1 : openjdk-7 security update	Nessus	Debian Local Security Checks	2018/11/23	2024/7/19	high
119186	Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	high
118183	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2018-2942)	Nessus	Oracle Linux Local Security Checks	2018/10/18	2024/11/1	critical
118187	RHEL 6 : java-1.8.0-openjdk (RHSA-2018:2943)	Nessus	Red Hat Local Security Checks	2018/10/18	2024/11/5	critical
135523	EulerOS 2.0 SP3 : java-1.7.0-openjdk (EulerOS-SA-2020-1394)	Nessus	Huawei Local Security Checks	2020/4/15	2024/3/18	medium
700659	Oracle Java SE 6 < Update 211 / 7 < Update 201 / 8 < Update 191 / 11 < Update 1 Multiple Vulnerabilities (October 2018 CPU)	Nessus Network Monitor	Web Clients	2019/5/2	2019/5/2	medium

検出

プラグインの検索

high

high

high

critical

high

high

high

critical

critical

medium

medium