This update for java-1_7_0-ibm fixes the following issues by updating to 7.0-9.30 (bsc#963937) :

  - CVE-2015-5041: Could could have invoked non-public     interface methods under certain circumstances

  - CVE-2015-7575: The TLS protocol could allow weaker than     expected security caused by a collision attack when     using the MD5 hash function for signing a     ServerKeyExchange message during a TLS handshake. An     attacker could exploit this vulnerability using     man-in-the-middle techniques to impersonate a TLS server     and obtain credentials

  - CVE-2015-7981: libpng could allow a remote attacker to     obtain sensitive information, caused by an out-of-bounds     read in the png_convert_to_rfc1123 function. An attacker     could exploit this vulnerability to obtain sensitive     information

  - CVE-2015-8126: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8472: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8540: libpng is vulnerable to a buffer     overflow, caused by a read underflow in     png_check_keyword in pngwutil.c. By sending an overly     long argument, a remote attacker could overflow a buffer     and execute arbitrary code on the system or cause the     application to crash.

  - CVE-2016-0402: An unspecified vulnerability related to     the Networking component has no confidentiality impact,     partial integrity impact, and no availability impact

  - CVE-2016-0448: An unspecified vulnerability related to     the JMX component could allow a remote attacker to     obtain sensitive information

  - CVE-2016-0466: An unspecified vulnerability related to     the JAXP component could allow a remote attacker to     cause a denial of service

  - CVE-2016-0483: An unspecified vulnerability related to     the AWT component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

  - CVE-2016-0494: An unspecified vulnerability related to     the 2D component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

The following bugs were fixed :

  - bsc#960402: resolve package conflicts in devel package

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_6_0-ibm fixes the following issues by updating to 6.0-16.20 (bsc#963937)

  - CVE-2015-5041: Could could have invoked non-public     interface methods under certain circumstances

  - CVE-2015-7575: The TLS protocol could allow weaker than     expected security caused by a collision attack when     using the MD5 hash function for signing a     ServerKeyExchange message during a TLS handshake. An     attacker could exploit this vulnerability using     man-in-the-middle techniques to impersonate a TLS server     and obtain credentials

  - CVE-2015-7981: libpng could allow a remote attacker to     obtain sensitive information, caused by an out-of-bounds     read in the png_convert_to_rfc1123 function. An attacker     could exploit this vulnerability to obtain sensitive     information

  - CVE-2015-8126: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8472: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8540: libpng is vulnerable to a buffer     overflow, caused by a read underflow in     png_check_keyword in pngwutil.c. By sending an overly     long argument, a remote attacker could overflow a buffer     and execute arbitrary code on the system or cause the     application to crash.

  - CVE-2016-0402: An unspecified vulnerability related to     the Networking component has no confidentiality impact,     partial integrity impact, and no availability impact

  - CVE-2016-0448: An unspecified vulnerability related to     the JMX component could allow a remote attacker to     obtain sensitive information

  - CVE-2016-0466: An unspecified vulnerability related to     the JAXP component could allow a remote attacker to     cause a denial of service

  - CVE-2016-0483: An unspecified vulnerability related to     the AWT component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

  - CVE-2016-0494: An unspecified vulnerability related to     the 2D component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

The following bugs were fixed :

  - bsc#960402: resolve package conflicts in devel package

  - bsc#960286: resolve package conflicts in the fonts     subpackage

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743)

  - CVE-2015-4871: Rebinding of the receiver of a     DirectMethodHandle may allow a protected method to be     accessed

  - CVE-2015-7575: Further reduce use of MD5 (SLOTH)     (bsc#960996)

  - CVE-2015-8126: Vulnerability in the AWT component     related to splashscreen displays

  - CVE-2015-8472: Vulnerability in the AWT component,     addressed by same fix

  - CVE-2016-0402: Vulnerability in the Networking component     related to URL processing

  - CVE-2016-0448: Vulnerability in the JMX comonent related     to attribute processing

  - CVE-2016-0466: Vulnerability in the JAXP component,     related to limits

  - CVE-2016-0483: Vulnerability in the AWT component     related to image decoding

  - CVE-2016-0494: Vulnerability in 2D component related to     font actions

The following bugs were fixed :

  - bsc#939523: java-1_7_0-openjdk-headless had X     dependencies, move libjavagtk to full package

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0053 advisory.

    [1.7.0.95-2.6.4.0.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.95-2.6.4.0]
    - Remove reference to jre/lib/audio.
    - Resolves: rhbz#1295765

    [1:1.7.0.95-2.6.4.0]
    - Bump to 2.6.4 and u95b00.
    - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
    - Drop 8072932or8074489 patch as applied upstream in u91b01.
    - Drop installation of soundfont symlink following inclusion of 8140620/PR2710 in 2.6.3
    - Resolves: rhbz#1295765

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-7575, CVE-2015-8126, CVE-2015-8472, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494)

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 95 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code.
An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483)

An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.
(CVE-2016-0466)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)

Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4871, CVE-2016-0402, CVE-2016-0448)

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All running instances of OpenJDK Java must be restarted for the update to take effect.

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code.
An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483)

An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.
(CVE-2016-0466)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575)

Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2015-4871, CVE-2016-0402, CVE-2016-0448)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file.

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1430 advisory.

    IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 7 to versions 7 SR9-FP40 and 7R1 SR3-FP40.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software     Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page,     listed in the References section. (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806,     CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860,     CVE-2015-4871, CVE-2015-4872, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903,     CVE-2015-5006, CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540,     CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483,     CVE-2016-0494, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443,     CVE-2016-3449)

    Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the     CVE-2015-4806 issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201603-14 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  This       includes the possibility of remote execution of arbitrary code,       information disclosure, or Denial of Service.  Many of the       vulnerabilities can only be exploited through sandboxed Java Web Start       applications and java applets.  Please reference the CVEs listed for       specific details.
  Impact :

    Remote attackers may remotely execute arbitrary code, compromise       information, or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
89657	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2016:0636-1) (SLOTH)	Nessus	SuSE Local Security Checks	2016/3/4	2021/1/19	critical
89961	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0770-1) (SLOTH)	Nessus	SuSE Local Security Checks	2016/3/16	2021/1/19	critical
88485	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2016:0265-1) (SLOTH)	Nessus	SuSE Local Security Checks	2016/1/29	2021/1/6	high
88070	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2016-0053)	Nessus	Oracle Linux Local Security Checks	2016/1/22	2025/2/18	high
88075	RHEL 5 / 6 / 7 : java-1.7.0-oracle (RHSA-2016:0056) (SLOTH)	Nessus	Red Hat Local Security Checks	2016/1/22	2019/10/24	high
88079	Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x, SL7.x i386/x86_64 (20160121) (SLOTH)	Nessus	Scientific Linux Local Security Checks	2016/1/22	2021/1/14	medium
88080	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20160121) (SLOTH)	Nessus	Scientific Linux Local Security Checks	2016/1/22	2021/1/14	medium
92400	RHEL 6 : java-1.7.0-ibm and java-1.7.1-ibm (RHSA-2016:1430)	Nessus	Red Hat Local Security Checks	2016/7/19	2025/4/15	critical
89907	GLSA-201603-14 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/3/14	2022/3/8	critical

検出

プラグインの検索

critical

critical

high

high

high

medium

medium

critical

critical