Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

The remote host is affected by the vulnerability described in GLSA-201502-12 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s Java SE       Development Kit and Runtime Environment. Please review the CVE       identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       disclose, update, insert, or delete certain data.
  Workaround :

    There is no known workaround at this time.

Oracle Critical Patch Update Advisory - October 2014

Description :

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.

Find more information here:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.h tml

Updated java-1.8.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain entries with a NUL byte used in the file names. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2014-6562)

Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2014-6506, CVE-2014-6531, CVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519)

It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents.
(CVE-2014-6517)

It was discovered that the Hotspot component in OpenJDK failed to properly handle malformed Shared Archive files. A local attacker able to modify a Shared Archive file used by a virtual machine of a different user could possibly use this flaw to escalate their privileges. (CVE-2014-6468)

It was discovered that the DatagramSocket implementation in OpenJDK failed to perform source address checks for packets received on a connected socket. A remote attacker could use this flaw to have their packets processed as if they were received from the expected source.
(CVE-2014-6512)

It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication. (CVE-2014-6457)

It was discovered that the CipherInputStream class implementation in OpenJDK did not properly handle certain exceptions. This could possibly allow an attacker to affect the integrity of an encrypted stream handled by this class. (CVE-2014-6558)

The CVE-2014-6512 was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.8.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain entries with a NUL byte used in the file names. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2014-6562)

Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2014-6506, CVE-2014-6531, CVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519)

It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents.
(CVE-2014-6517)

It was discovered that the Hotspot component in OpenJDK failed to properly handle malformed Shared Archive files. A local attacker able to modify a Shared Archive file used by a virtual machine of a different user could possibly use this flaw to escalate their privileges. (CVE-2014-6468)

It was discovered that the DatagramSocket implementation in OpenJDK failed to perform source address checks for packets received on a connected socket. A remote attacker could use this flaw to have their packets processed as if they were received from the expected source.
(CVE-2014-6512)

It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication. (CVE-2014-6457)

It was discovered that the CipherInputStream class implementation in OpenJDK did not properly handle certain exceptions. This could possibly allow an attacker to affect the integrity of an encrypted stream handled by this class. (CVE-2014-6558)

All running instances of OpenJDK Java must be restarted for the update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1636 advisory.

    [1:1.8.0.25-1.b17]
    - Update to October CPU patch update.
    - Resolves: RHBZ#1148896

    [1:1.8.0.20-3.b26]
    - fixed headless (policytool moved to normal)
     - jre/bin/policytool added to not headless exclude list
    - updated aarch694 source
    - ppc64le synced from fedora
    - Resolves: rhbz#1081073

    [1:1.8.0.20-2.b26]
    - forcing build by itself (jdk8 by jdk8)
    - Resolves: rhbz#1081073

    [1:1.8.0.20-1.b26]
    - updated to u20-b26
    - adapted patch9999 enableArm64.patch
    - adapted patch100 s390-java-opts.patch
    - adapted patch102 size_t.patch
    - removed upstreamed patch  0001-PPC64LE-arch-support-in-openjdk-1.8.patch
    - adapted  system-lcms.patch
    - removed patch8 set-active-window.patch
    - removed patch9 javadoc-error-jdk-8029145.patch
    - removed patch10 javadoc-error-jdk-8037484.patch
    - removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it
    - Resolves: rhbz#1081073

    [1:1.8.0.11-19.b12]
    - fixed desktop icons
    - Icon set to java-1.8.0
    - Development removed from policy tool
    - Resolves: rhbz#1081073

    [1:1.8.0.11-18.b12]
    - fixed jstack
    - Resolves: rhbz#1081073

    [1:1.8.0.11-15.b12]
    - fixed provides/obsolates
    - Resolves: rhbz#1081073

    [1:1.8.0.11-14.b12]
    - mayor rework of specfile - sync with f21
     - accessibility kept removed
     - lua script kept unsync
     - priority and epoch kept on 0 - not included disable-doclint patch
     - kept bundled lcms
     - unused OrderWithRequires
     - used with-stdcpplib instead of with-stdc++lib
    - Resolves: rhbz#1081073

    [1:1.8.0.11-4.b13]
    - Added security patches
    - Resolves: rhbz#1081073

    [1:1.8.0.5-6.b13]
    - Removed accessibility package
     - removed patch3 java-atk-wrapper-security.patch
     - removed its files and declaration
     - removed creation of libatk-wrapper.so and java-atk-wrapper.jar symlinks
     - removed generation of accessibility.properties
    - Resolves: rhbz#1113078

    [1:1.8.0.5-5.b13]
    - priority lowered to 00000
    - Resolves: rhbz#1081073

    [1:1.8.0.5-4.b13]
    - Initial import from fedora
    - Used bundled lcms2
     - added java-1.8.0-openjdk-disable-system-lcms.patch
     - --with-lcms changed to bundled
     - removed build requirement
     - excluded removal of lcms from remove-intree-libraries.sh
    - removed --with-extra-cflags=-fno-devirtualize and --with-extra-cxxflags=-fn     o-devirtualize---
    - added patch998, rhel6-built.patch  to
     - fool autotools
     - replace all ++ chars in autoconfig files by pp
    - --with-stdc++lib=dynamic  replaced by --with-stdcpplib=dynamic
    - Bumped release
    - Set epoch to 0
    - removed patch6, disable-doclint-by-default.patch
    - Resolves: rhbz#1081073

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain entries with a NUL byte used in the file names. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2014-6562)

Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2014-6506 , CVE-2014-6531 , CVE-2014-6502 , CVE-2014-6511 , CVE-2014-6504 , CVE-2014-6519)

It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents.
(CVE-2014-6517)

It was discovered that the Hotspot component in OpenJDK failed to properly handle malformed Shared Archive files. A local attacker able to modify a Shared Archive file used by a virtual machine of a different user could possibly use this flaw to escalate their privileges. (CVE-2014-6468)

It was discovered that the DatagramSocket implementation in OpenJDK failed to perform source address checks for packets received on a connected socket. A remote attacker could use this flaw to have their packets processed as if they were received from the expected source.
(CVE-2014-6512)

It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication. (CVE-2014-6457)

It was discovered that the CipherInputStream class implementation in OpenJDK did not properly handle certain exceptions. This could possibly allow an attacker to affect the integrity of an encrypted stream handled by this class. (CVE-2014-6558)

Oracle's October 2014 security update for Java fixes remote and local vulnerabilities in the following components of the Java SE JDK/JRE:

  - 2D
  - AWT
  - Deployment
  - Hotspot
  - JAXP
  - JSSE
  - JavaFX
  - Libraries
  - Security

Twenty-two of these 25 fixed vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. no further details have been released by the vendor.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 25, 7 Update 71, 6 Update 85, or 5 Update 75. It is, therefore, affected by security issues in the following components :

  - 2D
  - AWT
  - Deployment
  - Hotspot
  - JAXP
  - JSSE
  - JavaFX
  - Libraries
  - Security

ID	Name	Product	Family	Severity
81370	GLSA-201502-12 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
79208	SuSE 11.3 Security Update : Java OpenJDK (SAT Patch Number 9906)	Nessus	SuSE Local Security Checks	critical
79186	CentOS 6 : java-1.8.0-openjdk (CESA-2014:1636)	Nessus	CentOS Local Security Checks	high
78849	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20141015)	Nessus	Scientific Linux Local Security Checks	high
78638	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2014-1636)	Nessus	Oracle Linux Local Security Checks	high
78562	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2014-432)	Nessus	Amazon Linux Local Security Checks	high
8550	Oracle Java Update (October 2014) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
78482	Oracle Java SE Multiple Vulnerabilities (October 2014 CPU) (Unix)	Nessus	Misc.	critical
78481	Oracle Java SE Multiple Vulnerabilities (October 2014 CPU)	Nessus	Windows	critical
78459	RHEL 6 : java-1.8.0-openjdk (RHSA-2014:1636)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2014-6468

critical

Tenable Plugins

critical

critical

high

high

high

high

critical

critical

critical

high