Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 65, 7 Update 91, or 6 Update 105. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - CORBA
 - Deployment
 - JavaFX
 - JAXP
 - JGSS
 - Libraries
 - RMI
 - Security
 - Serialization

The Oracle Java SE installed on the remote host is version 6 prior to Update 105, 7 prior to Update 91, or 8 prior to Update 65 and is therefore affected by security vulnerabilities in the following components :

 - 2D
 - CORBA
 - Deployment
 - JavaFX
 - JAXP
 - JGSS
 - Libraries
 - RMI
 - Security
 - Serialization

The remote host is affected by the vulnerability described in GLSA-201603-11 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK.  Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, and cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

java-1_8_0-openjdk was updated to version 7u95 to fix several security issues. (bsc#962743)

The following vulnerabilities were fixed :

  - CVE-2015-7575: Further reduce use of MD5 (SLOTH)     (bsc#960996)

  - CVE-2015-8126: Vulnerability in the AWT component     related to splashscreen displays

  - CVE-2015-8472: Vulnerability in the AWT component,     addressed by same fix

  - CVE-2016-0402: Vulnerability in the Networking component     related to URL processing

  - CVE-2016-0448: Vulnerability in the JMX comonent related     to attribute processing

  - CVE-2016-0466: Vulnerability in the JAXP component,     related to limits

  - CVE-2016-0483: Vulnerability in the AWT component     related to image decoding

  - CVE-2016-0494: Vulnerability in 2D component related to     font actions

Includes the following fixes from the October 2015 update:
(bsc#951376)

  - CVE-2015-4734: A remote user can exploit a flaw in the     Embedded JGSS component to partially access data

  - CVE-2015-4803: A remote user can exploit a flaw in the     JRockit JAXP component to cause partial denial of     service conditions

  - CVE-2015-4805: A remote user can exploit a flaw in the     Embedded Serialization component to gain elevated     privileges

  - CVE-2015-4806: A remote user can exploit a flaw in the     Java SE Embedded Libraries component to partially access     and partially modify data

  - CVE-2015-4835: A remote user can exploit a flaw in the     Embedded CORBA component to gain elevated privileges

  - CVE-2015-4842: A remote user can exploit a flaw in the     Embedded JAXP component to partially access data

  - CVE-2015-4843: A remote user can exploit a flaw in the     Java SE Embedded Libraries component to gain elevated     privileges

  - CVE-2015-4844: A remote user can exploit a flaw in the     Embedded 2D component to gain elevated privileges

  - CVE-2015-4860: A remote user can exploit a flaw in the     Embedded RMI component to gain elevated privileges

  - CVE-2015-4872: A remote user can exploit a flaw in the     JRockit Security component to partially modify data [].

  - CVE-2015-4881: A remote user can exploit a flaw in the     Embedded CORBA component to gain elevated privileges

  - CVE-2015-4882: A remote user can exploit a flaw in the     Embedded CORBA component to cause partial denial of     service conditions

  - CVE-2015-4883: A remote user can exploit a flaw in the     Embedded RMI component to gain elevated privileges

  - CVE-2015-4893: A remote user can exploit a flaw in the     JRockit JAXP component to cause partial denial of     service conditions

  - CVE-2015-4902: A remote user can exploit a flaw in the     Java SE Deployment component to partially modify data

  - CVE-2015-4903: A remote user can exploit a flaw in the     Embedded RMI component to partially access data

  - CVE-2015-4911: A remote user can exploit a flaw in the     JRockit JAXP component to cause partial denial of     service conditions

  - CVE-2015-4810: A local user can exploit a flaw in the     Java SE Deployment component to gain elevated privileges

  - CVE-2015-4840: A remote user can exploit a flaw in the     Embedded 2D component to partially access data

  - CVE-2015-4868: A remote user can exploit a flaw in the     Java SE Embedded Libraries component to gain elevated     privileges

  - CVE-2015-4901: A remote user can exploit a flaw in the     JavaFX component to gain elevated privileges

  - CVE-2015-4906: A remote user can exploit a flaw in the     JavaFX component to partially access data

  - CVE-2015-4908: A remote user can exploit a flaw in the     JavaFX component to partially access data

  - CVE-2015-4916: A remote user can exploit a flaw in the     JavaFX component to partially access data

Oracle reports :

This Critical Patch Update contains 25 new security fixes for Oracle Java SE. 24 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

java-1_8_0-openjdk was updated to fix 24 security issues.

These security issues were fixed :

  - CVE-2015-4734: A remote user can exploit a flaw in the     Embedded JGSS component to partially access data

  - CVE-2015-4803: A remote user can exploit a flaw in the     JRockit JAXP component to cause partial denial of     service conditions

  - CVE-2015-4805: A remote user can exploit a flaw in the     Embedded Serialization component to gain elevated     privileges

  - CVE-2015-4806: A remote user can exploit a flaw in the     Java SE Embedded Libraries component to partially access     and partially modify data

  - CVE-2015-4835: A remote user can exploit a flaw in the     Embedded CORBA component to gain elevated privileges

  - CVE-2015-4842: A remote user can exploit a flaw in the     Embedded JAXP component to partially access data

  - CVE-2015-4843: A remote user can exploit a flaw in the     Java SE Embedded Libraries component to gain elevated     privileges

  - CVE-2015-4844: A remote user can exploit a flaw in the     Embedded 2D component to gain elevated privileges

  - CVE-2015-4860: A remote user can exploit a flaw in the     Embedded RMI component to gain elevated privileges

  - CVE-2015-4872: A remote user can exploit a flaw in the     JRockit Security component to partially modify data [].

  - CVE-2015-4881: A remote user can exploit a flaw in the     Embedded CORBA component to gain elevated privileges

  - CVE-2015-4882: A remote user can exploit a flaw in the     Embedded CORBA component to cause partial denial of     service conditions

  - CVE-2015-4883: A remote user can exploit a flaw in the     Embedded RMI component to gain elevated privileges

  - CVE-2015-4893: A remote user can exploit a flaw in the     JRockit JAXP component to cause partial denial of     service conditions

  - CVE-2015-4902: A remote user can exploit a flaw in the     Java SE Deployment component to partially modify data

  - CVE-2015-4903: A remote user can exploit a flaw in the     Embedded RMI component to partially access data

  - CVE-2015-4911: A remote user can exploit a flaw in the     JRockit JAXP component to cause partial denial of     service conditions

  - CVE-2015-4810: A local user can exploit a flaw in the     Java SE Deployment component to gain elevated privileges

  - CVE-2015-4840: A remote user can exploit a flaw in the     Embedded 2D component to partially access data

  - CVE-2015-4868: A remote user can exploit a flaw in the     Java SE Embedded Libraries component to gain elevated     privileges

  - CVE-2015-4901: A remote user can exploit a flaw in the     JavaFX component to gain elevated privileges

  - CVE-2015-4906: A remote user can exploit a flaw in the     JavaFX component to partially access data

  - CVE-2015-4908: A remote user can exploit a flaw in the     JavaFX component to partially access data

  - CVE-2015-4916: A remote user can exploit a flaw in the     JavaFX component to partially access data

Updated java-1.8.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4868, CVE-2015-4872, CVE-2015-4881, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4901, CVE-2015-4902, CVE-2015-4903, CVE-2015-4906, CVE-2015-4908, CVE-2015-4911, CVE-2015-4916)

Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the CVE-2015-4806 issue.

All users of java-1.8.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 8 Update 65 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 65, 7 Update 91, or 6 Update 105. It is, therefore, affected by security vulnerabilities in the following components :

  - 2D
  - CORBA
  - Deployment
  - JavaFX
  - JAXP
  - JGSS
  - Libraries
  - RMI
  - Security
  - Serialization

ID	Name	Product	Family	Severity
700652	Oracle Java SE 6 < Update 105 / 7 < Update 91 / 8 < Update 65 Multiple Vulnerabilities (October 2015 CPU)	Nessus Network Monitor	Web Clients	critical
9352	Oracle Java SE 6 < Update 105 / 7 < Update 91 / 8 < Update 65 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
89904	GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	low
88537	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-106) (SLOTH)	Nessus	SuSE Local Security Checks	high
87386	FreeBSD : java -- multiple vulnerabilities (a5934ba8-a376-11e5-85e9-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	critical
86731	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2015-696)	Nessus	SuSE Local Security Checks	critical
86560	RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2015:1926)	Nessus	Red Hat Local Security Checks	critical
86543	Oracle Java SE Multiple Vulnerabilities (October 2015 CPU) (Unix)	Nessus	Misc.	critical
86542	Oracle Java SE Multiple Vulnerabilities (October 2015 CPU)	Nessus	Windows	critical

Detections

Analytics

CVE-2015-4906

critical

Tenable Plugins

critical

critical

low

high

critical

critical

critical

critical

critical