Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

The version of Oracle Java SE or Java for Business installed on the remote host is prior to 8 Update 31, 7 Update 75, 6 Update 91, or 5 Update 81. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - Deployment
 - Hotspot
 - Install
 - JAX-WS
 - JSSE
 - Libraries
 - RMI
 - Security
 - Serviceability
 - Swing

The remote host is affected by the vulnerability described in GLSA-201603-14 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems.  This       includes the possibility of remote execution of arbitrary code,       information disclosure, or Denial of Service.  Many of the       vulnerabilities can only be exploited through sandboxed Java Web Start       applications and java applets.  Please reference the CVEs listed for       specific details.
  Impact :

    Remote attackers may remotely execute arbitrary code, compromise       information, or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

The remote host is affected by the vulnerability described in GLSA-201507-14 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle JRE/JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    An context-dependent attacker may be able to influence the       confidentiality, integrity, and availability of Java       applications/runtime.
  Workaround :

    There is no workaround at this time.

This update fixes 13 security issues.

These security issues were fixed :

  - CVE-2015-0395: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality, integrity, and availability     via unknown vectors related to Hotspot (bnc#914041).

  - CVE-2015-0400: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed remote attackers to     affect confidentiality via unknown vectors related to     Libraries (bnc#914041).

  - CVE-2015-0383: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71     and 8u6; and JRockit R27.8.4 and R28.3.4 allowed local     users to affect integrity and availability via unknown     vectors related to Hotspot (bnc#914041).

  - CVE-2015-0412: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed remote attackers to     affect confidentiality, integrity, and availability via     vectors related to JAX-WS (bnc#914041).

  - CVE-2015-0407: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality via unknown vectors related to     Swing (bnc#914041).

  - CVE-2015-0408: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality, integrity, and availability     via vectors related to RMI (bnc#914041).

  - CVE-2014-6585: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers     to affect confidentiality via unknown vectors reelated     to 2D, a different vulnerability than CVE-2014-6591     (bnc#914041).

  - CVE-2014-6587: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed local users to affect     confidentiality, integrity, and availability via unknown     vectors related to Libraries (bnc#914041).

  - CVE-2014-6591: Unspecified vulnerability in the Java SE     component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25     allowed remote attackers to affect confidentiality via     unknown vectors related to 2D, a different vulnerability     than CVE-2014-6585 (bnc#914041).

  - CVE-2014-6593: Unspecified vulnerability in Oracle Java     SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71     and 8u6; and JRockit 27.8.4 and 28.3.4 allowed remote     attackers to affect confidentiality and integrity via     vectors related to JSSE (bnc#914041).

  - CVE-2014-6601: Unspecified vulnerability in Oracle Java     SE 6u85, 7u72, and 8u25 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to Hotspot (bnc#914041).

  - CVE-2015-0410: Unspecified vulnerability in the Java SE,     Java SE Embedded, JRockit component in Oracle Java SE     5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and     8u6; and JRockit R27.8.4 and R28.3.4 allowed remote     attackers to affect availability via unknown vectors     related to Security (bnc#914041).

  - CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL     through 1.0.1i and other products, used nondeterministic     CBC padding, which made it easier for man-in-the-middle     attackers to obtain cleartext data via a padding-oracle     attack, aka the 'POODLE' issue (bnc#901223).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The VMware vCenter Server installed on the remote host is version 5.0 prior to 5.0u3d, 5.1 prior to 5.1u3a, 5.5 prior to 5.5u2e, or 6.0 prior to 6.0.0a. It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE, related to the bundled JRE component. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

Additionally, multiple unspecified vulnerabilities also exist in the following bundled JRE components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

The version of VMware vCenter Chargeback Manager installed on the remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode.
MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.
(CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

The VMware Workspace Portal (formerly known as VMware Horizon Workspace) installed on the remote host is version 2.x prior to 2.1.1.
It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode.
MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.
(CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability, known as POODLE, exists due to the way     SSL 3.0 handles padding bytes when decrypting messages     encrypted using block ciphers in cipher block chaining     (CBC) mode. A MitM attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections.
    (CVE-2014-3566)

  - An XML external entity (XXE) injection vulnerability     exists in the included Flex BlazeDS component due to an     incorrect configuration of the XML parser that allows     external XML entities to be accepted from untrusted     sources. An unauthenticated, remote attacker can exploit     this vulnerability, via a via a crafted AMF message, to     gain access to sensitive information. (CVE-2015-3269)

  - A flaw exists in the bundled Adobe ColdFusion and     LiveCycle Data Services components related to request     handling between a user and the server. A remote     attacker can exploit this, via a specially crafted     request, to bypass access restrictions (e.g. host or     network ACLs), conduct port scanning of internal     networks, enumerate internal hosts, or possibly invoke     additional protocols (e.g. Gopher, TFTP).
    (CVE-2015-5255)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

The version of VMware vCenter Operations Manager installed on the remote Windows host has a bundled version of the Java JRE prior to version 1.7.0_76-b13 (aka 7.0.760.13). It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

VMware has released a patch that updates the JRE bundled with the appliance.

The version of VMware vCenter Operations Manager installed on the remote host has a bundled version of the Java JRE prior to version 1.7.0_76-b13 (aka 7.0.760). It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

VMware has released a patch that updates the JRE bundled with the appliance.

The version of VMware vCenter Operations Manager installed on the remote Linux host has a bundled version of the Java JRE prior to version 1.7.0_76-b13 (aka 7.0.760.13). It is, therefore, affected by a man-in-the-middle (MitM) information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. MitM attackers can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

VMware has released a patch that updates the JRE bundled with the appliance.

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to Fix Pack 37. It is, therefore, affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566 / PI27101)

  - An input validation error exists related to session     input using URL rewriting that can allow cross-site     scripting attacks. (CVE-2014-6167 / PI23819)

  - An error exists related to the administrative console     that can allow 'click-jacking' attacks.
    (CVE-2014-6174 / PI27152)

  - Multiple errors exist in the bundled IBM Java SDK. These     errors are corrected by the October 2014 IBM Java SDK     updates. (CVE-2014-6457, CVE-2014-6512, CVE-2014-6558 /     PI27101)

  - Multiple errors exist in the bundled IBM Java SDK. These     errors are corrected by the January 2015 IBM Java SDK     updates. (CVE-2014-6593, CVE-2015-0400, CVE-2015-0410) /     PI33407

The version of Java SDK installed on the remote host is affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

  - Information disclosure flaws exist in the font parsing     code in the 2D component in OpenJDK. A specially crafted     font file can exploit boundary check flaws and allow an     untrusted Java applet or application to disclose     portions of the Java Virtual Machine memory.
    (CVE-2014-6585, CVE-2014-6591)

  - A NULL pointer dereference flaw exists in the     MulticastSocket implementation in the Libraries     component of OpenJDK. An untrusted Java applet or     application can use this flaw to bypass certain     Java sandbox restrictions. (CVE-2014-6587)

  - The SSL/TLS implementation in the JSSE component in     OpenJDK fails to properly check whether the     ChangeCipherSpec was received during a SSL/TLS     connection handshake. An MitM attacker can use this     flaw to force a connection to be established without     encryption being enabled. (CVE-2014-6593)

  - An unspecified privilege escalation vulnerability exists     in IBM Java Virtual Machine. (CVE-2014-8891)

  - An unspecified information disclosure vulnerability     exists in the Libraries component of Oracle Java SE.
    (CVE-2015-0400)

  - An unspecified information disclosure vulnerability     exists in the Deployment component of Oracle Java SE.
    (CVE-2015-0403)

  - Unspecified denial of service and information     disclosure vulnerabilities exist in the Deployment     component of Oracle Java SE. (CVE-2015-0406)

  - An information disclosure vulnerability exists in the     Swing component in OpenJDK. An untrusted Java applet or     application can use this flaw to bypass certain Java     sandbox restrictions. (CVE-2015-0407)

  - Multiple improper permission check vulnerabilities exist     in the JAX-WS, Libraries, and RMI components in OpenJDK.
    An untrusted Java applet or application can use these     flaws to bypass Java sandbox restrictions.
    (CVE-2015-0412, CVE-2014-6549, CVE-2015-0408)

  - A denial of service vulnerability exists in the DER     (Distinguished Encoding Rules) decoder in the Security     component in OpenJDK when handling negative length     values. A specially crafted, DER-encoded input can cause     a Java application to enter an infinite loop when     decoded. (CVE-2015-0410)

java-1_7_0-openjdk was updated to fix 19 security issues.

Details are available at http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.h tml#AppendixJAVA

The Oracle Java SE installed on the remote host is version 6 prior to Update 91, 7 prior to Update 75, or 8 prior to Update 26; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - Deployment (CVE-2015-0403, CVE-2015-0406)
 - Hotspot (CVE-2014-6601)
 - Libraries (CVE-2014-6587, CVE-2015-0400)
 - JAX-WS (CVE-2015-0412)

OpenJDK was updated to 2.5.4 - OpenJDK 7u75 to fix security issues and bugs :

  - Security fixes

  - S8046656: Update protocol support

  - S8047125, CVE-2015-0395: (ref) More phantom object     references

  - S8047130: Fewer escapes from escape analysis

  - S8048035, CVE-2015-0400: Ensure proper proxy protocols

  - S8049253: Better GC validation

  - S8050807, CVE-2015-0383: Better performing performance     data handling

  - S8054367, CVE-2015-0412: More references for endpoints

  - S8055304, CVE-2015-0407: More boxing for     DirectoryComboBoxModel

  - S8055309, CVE-2015-0408: RMI needs better transportation     considerations

  - S8055479: TLAB stability

  - S8055489, CVE-2014-6585: Better substitution formats

  - S8056264, CVE-2014-6587: Multicast support improvements

  - S8056276, CVE-2014-6591: Fontmanager feature     improvements

  - S8057555, CVE-2014-6593: Less cryptic cipher suite     management

  - S8058982, CVE-2014-6601: Better verification of an     exceptional invokespecial

  - S8059485, CVE-2015-0410: Resolve parsing ambiguity

  - S8061210, CVE-2014-3566: Issues in TLS

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2487-1 advisory.

    Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data     integrity and availability. An attacker could exploit these to cause a denial of service or expose     sensitive data over the network. (CVE-2014-3566, CVE-2014-6587, CVE-2014-6601, CVE-2015-0395,     CVE-2015-0408, CVE-2015-0412)

    Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker     could exploit these to expose sensitive data over the network. (CVE-2014-6585, CVE-2014-6591,     CVE-2015-0400, CVE-2015-0407)

    A vulnerability was discovered in the OpenJDK JRE related to information disclosure and integrity. An     attacker could exploit this to expose sensitive data over the network. (CVE-2014-6593)

    A vulnerability was discovered in the OpenJDK JRE related to integrity and availability. An attacker could     exploit this to cause a denial of service. (CVE-2015-0383)

    A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could this exploit     to cause a denial of service. (CVE-2015-0410)

    A vulnerability was discovered in the OpenJDK JRE related to data integrity. (CVE-2015-0413)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-3566, CVE-2014-6587, CVE-2014-6601, CVE-2015-0395, CVE-2015-0408, CVE-2015-0412)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2014-6585, CVE-2014-6591, CVE-2015-0400, CVE-2015-0407)

A vulnerability was discovered in the OpenJDK JRE related to information disclosure and integrity. An attacker could exploit this to expose sensitive data over the network. (CVE-2014-6593)

A vulnerability was discovered in the OpenJDK JRE related to integrity and availability. An attacker could exploit this to cause a denial of service. (CVE-2015-0383)

A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could this exploit to cause a denial of service. (CVE-2015-0410).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Java SE or Java for Business installed on the remote host is prior to 8 Update 31, 7 Update 75, 6 Update 91, or 5 Update 81. It is, therefore, affected by security vulnerabilities in the following components :

  - 2D
  - Deployment
  - Hotspot
  - Install
  - JAX-WS
  - JSSE
  - Libraries
  - RMI
  - Security
  - Serviceability
  - Swing

ID	Name	Product	Family	Severity
700649	Oracle Java SE 5 < Update 81 / 6 < Update 91 / 7 < Update 75 / 8 < Update 31 Multiple Vulnerabilities (January 2015 CPU) (POODLE)	Nessus Network Monitor	Web Clients	critical
89907	GLSA-201603-14 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
84719	GLSA-201507-14 : Oracle JRE/JDK: Multiple vulnerabilities (POODLE)	Nessus	Gentoo Local Security Checks	low
83699	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:0503-1) (POODLE)	Nessus	SuSE Local Security Checks	low
83186	VMware vCenter Server Multiple Java Vulnerabilities (VMSA-2015-0003) (POODLE)	Nessus	Misc.	critical
82899	VMware vCenter Chargeback Manager Multiple Java Vulnerabilities (VMSA-2015-0003) (POODLE)	Nessus	Windows	critical
82742	VMware Workspace Portal Multiple Java Vulnerabilities (VMSA-2015-0003) (POODLE)	Nessus	Misc.	critical
82741	VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)	Nessus	Windows	critical
82707	VMware vCenter Operations Management Windows JRE Update 1.7.0_76-b13 (VMSA-2015-0003) (POODLE)	Nessus	Misc.	critical
82706	VMware vCenter Operations Management vApp JRE Update 1.7.0_76-b13 (VMSA-2015-0003) (POODLE)	Nessus	Misc.	critical
82705	VMware vCenter Operations Management Linux JRE Update 1.7.0_76-b13 (VMSA-2015-0003) (POODLE)	Nessus	Misc.	critical
81825	IBM WebSphere Application Server 7.0 < Fix Pack 37 Multiple Vulnerabilities (POODLE)	Nessus	Web Servers	medium
81491	AIX Java Advisory : java_feb2015_advisory.asc (POODLE)	Nessus	AIX Local Security Checks	critical
81419	SuSE 11.3 Security Update : java-1_7_0-openjdk (SAT Patch Number 10286)	Nessus	SuSE Local Security Checks	critical
8899	Oracle Java SE 6 < Update 86 / 7 < Update 73 / 8 < Update 26 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
81141	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2015:0190-1) (POODLE)	Nessus	SuSE Local Security Checks	low
81045	Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-2487-1)	Nessus	Ubuntu Local Security Checks	low
81043	Ubuntu 10.04 LTS / 12.04 LTS : openjdk-6 vulnerabilities (USN-2486-1) (POODLE)	Nessus	Ubuntu Local Security Checks	low
80908	Oracle Java SE Multiple Vulnerabilities (January 2015 CPU) (POODLE)	Nessus	Windows	critical
80907	Oracle Java SE Multiple Vulnerabilities (January 2015 CPU) (Unix) (POODLE)	Nessus	Misc.	critical

Detections

Analytics

CVE-2015-0400

high

Tenable Plugins

critical

critical

low

low

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

low

low

low

critical

critical