Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 6.5 (Confidentiality impacts).

The version of IBM Java installed on the remote host is prior to 6.0 < 6.0.16.41 / 6.1 < 6.1.8.41 / 7.0 < 7.0.10.1 / 7.1 < 7.1.4.1 / 8.0 < 8.0.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 17 2017 CPU advisory.

  - The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and     products, have a birthday bound of approximately four billion blocks, which makes it easier for remote     attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as     demonstrated by an HTTPS session using Triple DES in CBC mode, aka a Sweet32 attack. (CVE-2016-2183)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded:
    8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2016-5546)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2016-5547)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). (CVE-2016-5548)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). (CVE-2016-5549)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded:
    8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE     Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2016-5552)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2017-3231, CVE-2017-3261)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in     Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful     attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2017-3241)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAAS).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Difficult to exploit vulnerability allows low privileged attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE     Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2017-3252)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;
    JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2017-3253)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions     that are affected are Java SE: 6u131, 7u121 and 8u112. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2017-3259)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are     affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2017-3260)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2017-3272)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).
    Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2017-3289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjre package has been released.

An update of the openjdk package has been released.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - A vulnerability exists in the Libraries subcomponent,     known as SWEET32, in the 3DES and Blowfish algorithms     due to the use of weak 64-bit block ciphers by default.
    A man-in-the-middle attacker who has sufficient     resources can exploit this vulnerability, via a     'birthday' attack, to detect a collision that leaks the     XOR between the fixed secret and a known plaintext,     allowing the disclosure of the secret text, such as     secure HTTPS cookies, and possibly resulting in the     hijacking of an authenticated session. (CVE-2016-2183)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-5546)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2016-5547)

  - Multiple unspecified flaws exist in the Libraries     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5548, CVE-2016-5549)

  - An unspecified flaw exists in the Networking     subcomponent that allows an unauthenticated, remote     attacker to impact integrity. (CVE-2016-5552)

  - Multiple unspecified flaws exist in the Networking     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3231, CVE-2017-3261)

  - An unspecified flaw exists in the RMI subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3241)

  - An unspecified flaw exists in the JAAS subcomponent that     allows an unauthenticated, remote attacker to impact     integrity. (CVE-2017-3252)

  - An unspecified flaw exists in the 2D subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3253)

  - An unspecified flaw exists in the Deployment     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3259)

  - An unspecified flaw exists in the AWT subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3260)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3272)

  - An unspecified flaw exists in the Hotspot subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3289)

Note that CVE-2017-3241 can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.
Note that CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, and CVE-2017-3253 can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. They can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

The remote host is affected by the vulnerability described in GLSA-201707-01 (IcedTea: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in IcedTea. Please review       the CVE identifiers referenced below for details.
    Note: If the web browser plug-in provided by the dev-java/icedtea-web       package was installed, the issues exposed via Java applets could have       been exploited without user interaction if a user visited a malicious       website.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, gain access to information, or cause a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

An update for java-1.7.1-ibm is now available for Red Hat Satellite 5.7 and Red Hat Satellite 5.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP1.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3241, CVE-2017-3259, CVE-2016-5573, CVE-2016-5554, CVE-2016-5542, CVE-2016-5597, CVE-2016-5556, CVE-2016-3598, CVE-2016-3511, CVE-2016-0363, CVE-2016-0686, CVE-2016-0687, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449, CVE-2016-3422, CVE-2016-0376, CVE-2016-0264)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0338 advisory.

    IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 6 to version 6 SR16-FP41.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software     Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page,     listed in the References section. (CVE-2016-2183, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549,     CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3261,     CVE-2017-3272)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0337 advisory.

  - SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183)

  - OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714) (CVE-2016-5546)

  - OpenJDK: missing ObjectIdentifier length check (Libraries, 8168705) (CVE-2016-5547)

  - OpenJDK: DSA implementation timing attack (Libraries, 8168728) (CVE-2016-5548)

  - OpenJDK: ECDSA implementation timing attack (Libraries, 8168724) (CVE-2016-5549)

  - OpenJDK: incorrect URL parsing in URLStreamHandler (Networking, 8167223) (CVE-2016-5552)

  - OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934) (CVE-2017-3231)

  - OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802) (CVE-2017-3241)

  - OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743) (CVE-2017-3252)

  - OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988)     (CVE-2017-3253)

  - Oracle JDK: unspecified vulnerability fixed in 6u141, 7u131, and 8u121 (Deployment) (CVE-2017-3259)

  - OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147) (CVE-2017-3261)

  - OpenJDK: insufficient protected field access checks in atomic field updaters (Libraries, 8165344)     (CVE-2017-3272)

  - OpenJDK: insecure class construction (Hotspot, 8167104) (CVE-2017-3289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0336 advisory.

  - SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183)

  - OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714) (CVE-2016-5546)

  - OpenJDK: missing ObjectIdentifier length check (Libraries, 8168705) (CVE-2016-5547)

  - OpenJDK: DSA implementation timing attack (Libraries, 8168728) (CVE-2016-5548)

  - OpenJDK: ECDSA implementation timing attack (Libraries, 8168724) (CVE-2016-5549)

  - OpenJDK: incorrect URL parsing in URLStreamHandler (Networking, 8167223) (CVE-2016-5552)

  - OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934) (CVE-2017-3231)

  - OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802) (CVE-2017-3241)

  - OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743) (CVE-2017-3252)

  - OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988)     (CVE-2017-3253)

  - Oracle JDK: unspecified vulnerability fixed in 6u141, 7u131, and 8u121 (Deployment) (CVE-2017-3259)

  - OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147) (CVE-2017-3261)

  - OpenJDK: insufficient protected field access checks in atomic field updaters (Libraries, 8165344)     (CVE-2017-3272)

  - OpenJDK: insecure class construction (Hotspot, 8167104) (CVE-2017-3289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk fixes the following issues :

  - Oracle Critical Patch Update of January 2017 to OpenJDK     7u131 (bsc#1020905) :

  - Security Fixes

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvments

  - S8168724, CVE-2016-5549: ECDSA signing improvments

  - S6253144: Long narrowing conversion should describe the     algorithm used and implied 'risks'

  - S6328537: Improve javadocs for Socket class by adding     references to SocketOptions

  - S6978886: javadoc shows stacktrace after print error     resulting from disk full

  - S6995421: Eliminate the static dependency to     sun.security.ec.ECKeyFactory

  - S6996372: synchronizing handshaking hash

  - S7027045: (doc) java/awt/Window.java has several typos     in javadoc

  - S7054969: Null-check-in-finally pattern in java/security     documentation

  - S7072353: JNDI libraries do not build with javac
    -Xlint:all -Werror

  - S7075563: Broken link in 'javax.swing.SwingWorker'

  - S7077672: jdk8_tl nightly fail in step-2 build on     8/10/11

  - S7088502: Security libraries don't build with javac
    -Werror

  - S7092447: Clarify the default locale used in each locale     sensitive operation

  - S7093640: Enable client-side TLS 1.2 by default

  - S7103570: AtomicIntegerFieldUpdater does not work when     SecurityManager is installed

  - S7117360: Warnings in java.util.concurrent.atomic     package

  - S7117465: Warning cleanup for IMF classes

  - S7187144: JavaDoc for ScriptEngineFactory.getProgram()     contains an error

  - S8000418: javadoc should used a standard 'generated by     javadoc' string

  - S8000666: javadoc should write directly to Writer     instead of composing strings

  - S8000673: remove dead code from HtmlWriter and subtypes

  - S8000970: break out auxiliary classes that will prevent     multi-core compilation of the JDK

  - S8001669: javadoc internal DocletAbortException should     set cause when appropriate

  - S8008949: javadoc stopped copying doc-files

  - S8011402: Move blacklisting certificate logic from hard     code to data

  - S8011547: Update XML Signature implementation to Apache     Santuario 1.5.4

  - S8012288: XML DSig API allows wrong tag names and extra     elements in SignedInfo

  - S8016217: More javadoc warnings

  - S8017325: Cleanup of the javadoc <code> tag in     java.security.cert

  - S8017326: Cleanup of the javadoc <code> tag in     java.security.spec

  - S8019772: Fix doclint issues in javax.crypto and     javax.security subpackages

  - S8020557: javadoc cleanup in javax.security

  - S8020688: Broken links in documentation at     http://docs.oracle.com/javase/6/docs/api/index.

  - S8021108: Clean up doclint warnings and errors in     java.text package

  - S8021417: Fix doclint issues in java.util.concurrent

  - S8021833: javadoc cleanup in java.net

  - S8022120: JCK test     api/javax_xml/crypto/dsig/TransformService/index_ParamMe     thods fails

  - S8022175: Fix doclint warnings in javax.print

  - S8022406: Fix doclint issues in java.beans

  - S8022746: List of spelling errors in API doc

  - S8024779: [macosx] SwingNode crashes on exit

  - S8025085: [javadoc] some errors in javax/swing

  - S8025218: [javadoc] some errors in java/awt classes

  - S8025249: [javadoc] fix some javadoc errors in     javax/swing/

  - S8025409: Fix javadoc comments errors and warning     reported by doclint report

  - S8026021: more fix of javadoc errors and warnings     reported by doclint, see the description

  - S8037099: [macosx] Remove all references to GC from     native OBJ-C code

  - S8038184: XMLSignature throws     StringIndexOutOfBoundsException if ID attribute value is     empty String

  - S8038349: Signing XML with DSA throws Exception when key     is larger than 1024 bits

  - S8049244: XML Signature performance issue caused by     unbuffered signature data

  - S8049432: New tests for TLS property     jdk.tls.client.protocols

  - S8050893: (smartcardio) Invert reset argument in tests     in sun/security/smartcardio

  - S8059212: Modify regression tests so that they do not     just fail if no cardreader found

  - S8068279: (typo in the spec)     javax.script.ScriptEngineFactory.getLanguageName

  - S8068491: Update the protocol for references of     docs.oracle.com to HTTPS.

  - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java     needs to be updated for JDK-8061210

  - S8076369: Introduce the jdk.tls.client.protocols system     property for JDK 7u

  - S8139565: Restrict certificates with DSA keys less than     1024 bits

  - S8140422: Add mechanism to allow non default root CAs to     be not subject to algorithm restrictions

  - S8140587: Atomic*FieldUpdaters should use     Class.isInstance instead of direct class check

  - S8143959: Certificates requiring blacklisting

  - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks

  - S8148516: Improve the default strength of EC in JDK

  - S8149029: Secure validation of XML based digital     signature always enabled when checking wrapping attacks

  - S8151893: Add security property to configure XML     Signature secure validation mode

  - S8155760: Implement Serialization Filtering

  - S8156802: Better constraint checking

  - S8161228: URL objects with custom protocol handlers have     port changed after deserializing

  - S8161571: Verifying ECDSA signatures permits trailing     bytes

  - S8163304: jarsigner -verbose -verify should print the     algorithms used to sign the jar

  - S8164908: ReflectionFactory support for IIOP and custom     serialization

  - S8165230: RMIConnection addNotificationListeners failing     with specific inputs

  - S8166393: disabledAlgorithms property should not be     strictly parsed

  - S8166591: [macos 10.12] Trackpad scrolling of text on OS     X 10.12 Sierra is very fast (Trackpad, Retina only)

  - S8166739: Improve extensibility of ObjectInputFilter     information passed to the filter

  - S8166875: (tz) Support tzdata2016g

  - S8166878: Connection reset during TLS handshake

  - S8167356: Follow up fix for jdk8 backport of 8164143.
    Changes for CMenuComponent.m were missed

  - S8167459: Add debug output for indicating if a chosen     ciphersuite was legacy

  - S8167472: Chrome interop regression with JDK-8148516

  - S8167591: Add MD5 to signed JAR restrictions

  - S8168861: AnchorCertificates uses hard-coded password     for cacerts keystore

  - S8168993: JDK8u121 L10n resource file update

  - S8169191: (tz) Support tzdata2016i

  - S8169688: Backout (remove) MD5 from     jdk.jar.disabledAlgorithms for January CPU

  - S8169911: Enhanced tests for jarsigner -verbose -verify     after JDK-8163304

  - S8170131: Certificates not being blocked by     jdk.tls.disabledAlgorithms property

  - S8170268: 8u121 L10n resource file update - msgdrop 20

  - S8173622: Backport of 7180907 is incomplete

  - S8173849: Fix use of java.util.Base64 in test cases

  - S8173854: [TEST] Update DHEKeySizing test case following     8076328 & 8081760

  - CVE-2017-3259 Vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE.

  - Backports

  - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef     on __APPLE__and _LLP64 systems.

  - S8000351, PR3316, RH1390708: Tenuring threshold should     be unsigned

  - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never     deleted when processing invokeMethod command

  - S8170888, PR3316, RH1390708: [linux] support for cgroup     memory limits in container (ie Docker) environments

  - Bug fixes

  - PR3318: Replace 'infinality' with 'improved font     rendering' (--enable-improved-font-rendering)

  - PR3318: Fix compatibility with vanilla Fontconfig

  - PR3318: Fix glyph y advance

  - PR3318: Always round glyph advance in 26.6 space

  - PR3318: Simplify glyph advance handling

  - PR3324: Fix NSS_LIBDIR substitution in     make_generic_profile.sh broken by PR1989

  - AArch64 port

  - S8165673, PR3320: AArch64: Fix JNI floating point     argument handling</code></code>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk fixes the following issues :

  - Oracle Critical Patch Update of January 2017 to OpenJDK     7u131 (bsc#1020905) :

  - Security Fixes

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvments

  - S8168724, CVE-2016-5549: ECDSA signing improvments

  - S6253144: Long narrowing conversion should describe the     algorithm used and implied 'risks'

  - S6328537: Improve javadocs for Socket class by adding     references to SocketOptions

  - S6978886: javadoc shows stacktrace after print error     resulting from disk full

  - S6995421: Eliminate the static dependency to     sun.security.ec.ECKeyFactory

  - S6996372: synchronizing handshaking hash

  - S7027045: (doc) java/awt/Window.java has several typos     in javadoc

  - S7054969: Null-check-in-finally pattern in java/security     documentation

  - S7072353: JNDI libraries do not build with javac
    -Xlint:all -Werror

  - S7075563: Broken link in 'javax.swing.SwingWorker'

  - S7077672: jdk8_tl nightly fail in step-2 build on     8/10/11

  - S7088502: Security libraries don't build with javac
    -Werror

  - S7092447: Clarify the default locale used in each locale     sensitive operation

  - S7093640: Enable client-side TLS 1.2 by default

  - S7103570: AtomicIntegerFieldUpdater does not work when     SecurityManager is installed

  - S7117360: Warnings in java.util.concurrent.atomic     package

  - S7117465: Warning cleanup for IMF classes

  - S7187144: JavaDoc for ScriptEngineFactory.getProgram()     contains an error

  - S8000418: javadoc should used a standard 'generated by     javadoc' string

  - S8000666: javadoc should write directly to Writer     instead of composing strings

  - S8000673: remove dead code from HtmlWriter and subtypes

  - S8000970: break out auxiliary classes that will prevent     multi-core compilation of the JDK

  - S8001669: javadoc internal DocletAbortException should     set cause when appropriate

  - S8008949: javadoc stopped copying doc-files

  - S8011402: Move blacklisting certificate logic from hard     code to data

  - S8011547: Update XML Signature implementation to Apache     Santuario 1.5.4

  - S8012288: XML DSig API allows wrong tag names and extra     elements in SignedInfo

  - S8016217: More javadoc warnings

  - S8017325: Cleanup of the javadoc <code> tag in     java.security.cert

  - S8017326: Cleanup of the javadoc <code> tag in     java.security.spec

  - S8019772: Fix doclint issues in javax.crypto and     javax.security subpackages

  - S8020557: javadoc cleanup in javax.security

  - S8020688: Broken links in documentation at     http://docs.oracle.com/javase/6/docs/api/index.

  - S8021108: Clean up doclint warnings and errors in     java.text package

  - S8021417: Fix doclint issues in java.util.concurrent

  - S8021833: javadoc cleanup in java.net

  - S8022120: JCK test     api/javax_xml/crypto/dsig/TransformService/index_ParamMe     thods fails

  - S8022175: Fix doclint warnings in javax.print

  - S8022406: Fix doclint issues in java.beans

  - S8022746: List of spelling errors in API doc

  - S8024779: [macosx] SwingNode crashes on exit

  - S8025085: [javadoc] some errors in javax/swing

  - S8025218: [javadoc] some errors in java/awt classes

  - S8025249: [javadoc] fix some javadoc errors in     javax/swing/

  - S8025409: Fix javadoc comments errors and warning     reported by doclint report

  - S8026021: more fix of javadoc errors and warnings     reported by doclint, see the description

  - S8037099: [macosx] Remove all references to GC from     native OBJ-C code

  - S8038184: XMLSignature throws     StringIndexOutOfBoundsException if ID attribute value is     empty String

  - S8038349: Signing XML with DSA throws Exception when key     is larger than 1024 bits

  - S8049244: XML Signature performance issue caused by     unbuffered signature data

  - S8049432: New tests for TLS property     jdk.tls.client.protocols

  - S8050893: (smartcardio) Invert reset argument in tests     in sun/security/smartcardio

  - S8059212: Modify regression tests so that they do not     just fail if no cardreader found

  - S8068279: (typo in the spec)     javax.script.ScriptEngineFactory.getLanguageName

  - S8068491: Update the protocol for references of     docs.oracle.com to HTTPS.

  - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java     needs to be updated for JDK-8061210

  - S8076369: Introduce the jdk.tls.client.protocols system     property for JDK 7u

  - S8139565: Restrict certificates with DSA keys less than     1024 bits

  - S8140422: Add mechanism to allow non default root CAs to     be not subject to algorithm restrictions

  - S8140587: Atomic*FieldUpdaters should use     Class.isInstance instead of direct class check

  - S8143959: Certificates requiring blacklisting

  - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks

  - S8148516: Improve the default strength of EC in JDK

  - S8149029: Secure validation of XML based digital     signature always enabled when checking wrapping attacks

  - S8151893: Add security property to configure XML     Signature secure validation mode

  - S8155760: Implement Serialization Filtering

  - S8156802: Better constraint checking

  - S8161228: URL objects with custom protocol handlers have     port changed after deserializing

  - S8161571: Verifying ECDSA signatures permits trailing     bytes

  - S8163304: jarsigner -verbose -verify should print the     algorithms used to sign the jar

  - S8164908: ReflectionFactory support for IIOP and custom     serialization

  - S8165230: RMIConnection addNotificationListeners failing     with specific inputs

  - S8166393: disabledAlgorithms property should not be     strictly parsed

  - S8166591: [macos 10.12] Trackpad scrolling of text on OS     X 10.12 Sierra is very fast (Trackpad, Retina only)

  - S8166739: Improve extensibility of ObjectInputFilter     information passed to the filter

  - S8166875: (tz) Support tzdata2016g

  - S8166878: Connection reset during TLS handshake

  - S8167356: Follow up fix for jdk8 backport of 8164143.
    Changes for CMenuComponent.m were missed

  - S8167459: Add debug output for indicating if a chosen     ciphersuite was legacy

  - S8167472: Chrome interop regression with JDK-8148516

  - S8167591: Add MD5 to signed JAR restrictions

  - S8168861: AnchorCertificates uses hardcoded password for     cacerts keystore

  - S8168993: JDK8u121 L10n resource file update

  - S8169191: (tz) Support tzdata2016i

  - S8169688: Backout (remove) MD5 from     jdk.jar.disabledAlgorithms for January CPU

  - S8169911: Enhanced tests for jarsigner -verbose -verify     after JDK-8163304

  - S8170131: Certificates not being blocked by     jdk.tls.disabledAlgorithms property

  - S8170268: 8u121 L10n resource file update - msgdrop 20

  - S8173622: Backport of 7180907 is incomplete

  - S8173849: Fix use of java.util.Base64 in test cases

  - S8173854: [TEST] Update DHEKeySizing test case following     8076328 & 8081760

  - CVE-2017-3259 Vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE.

  - Backports

  - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef     on __APPLE__and _LLP64 systems.

  - S8000351, PR3316, RH1390708: Tenuring threshold should     be unsigned

  - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never     deleted when processing invokeMethod command

  - S8170888, PR3316, RH1390708: [linux] support for cgroup     memory limits in container (ie Docker) environments

  - Bug fixes

  - PR3318: Replace 'infinality' with 'improved font     rendering' (--enable-improved-font-rendering)

  - PR3318: Fix compatibility with vanilla Fontconfig

  - PR3318: Fix glyph y advance

  - PR3318: Always round glyph advance in 26.6 space

  - PR3318: Simplify glyph advance handling

  - PR3324: Fix NSS_LIBDIR substitution in     make_generic_profile.sh broken by PR1989

  - AArch64 port

  - S8165673, PR3320: AArch64: Fix JNI floating point     argument handling

This update was imported from the SUSE:SLE-12:Update update project.

This update for java-1_8_0-ibm to version 8.0-4.0 fixes a lot of security issues (bsc#1024218): Following CVEs are fixed: CVE-2016-5552 CVE-2017-3231 CVE-2017-3241 CVE-2017-3253 CVE-2017-3259 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289 CVE-2016-2183 CVE-2016-5547 CVE-2016-5548 CVE-2016-5549 CVE-2017-3252 More information can be found on:
https://developer.ibm.com/javasdk/support/security-vulnerabilities/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR4.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3261, CVE-2017-3272, CVE-2017-3289)

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0) :

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvements

  - S8168724, CVE-2016-5549: ECDSA signing improvements

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0) :

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvements

  - S8168724, CVE-2016-5549: ECDSA signing improvements

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Java SE installed on the remote host is prior to 6 Update 141, 7 Update 131, or 8 Update 121 and is affected by multiple vulnerabilities :

 - A flaw exists in the 'ECDSASignature' class of the Libraries subcomponent. The issue is triggered when handling signatures from DER input. This may allow a remote attacker to cause a signature in an incorrect format to be accepted. (CVE-2016-5546)
 - An unspecified flaw exists related to the Libraries subcomponent. This may allow a remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5547)
 - An unspecified flaw exists related to the Libraries subcomponent. This may allow a context-dependent attacker to gain access to sensitive information. No further details have been provided by the vendor. (CVE-2016-5548, CVE-2016-5549)
 - An unspecified flaw exists related to the Networking subcomponent. This may allow a remote attacker to have an impact on integrity. No further details have been provided by the vendor. (CVE-2016-5552)
 - A flaw exists in the Install New Software and Update features in the Mission Control subcomponent that may allow a man-in-the-middle attacker to intercept and manipulate JAR files, potentially resulting in the installation of malicious content. (CVE-2016-8328)
 - An unspecified flaw exists related to the Networking subcomponent. This may allow a context-dependent attacker to gain access to sensitive information. No further details have been provided by the vendor. (CVE-2017-3231)
 - A flaw exists in the RMI registry and DCG (Distributed Garbage Collector) implementation that is triggered as certain input is not properly sanitized before being deserialized. This may allow a remote attacker to potentially execute arbitrary code outside of intended sandbox restrictions. (CVE-2017-3241)
 - An unspecified flaw exists related to the JAAS subcomponent. This may allow a context-dependent attacker to have an impact on integrity. No further details have been provided by the vendor. (CVE-2017-3252)
 - A flaw exists in the 'PNGImageReader::readMetadata()' function in 'imageio/plugins/png/PNGImageReader.java' that is triggered when handling 'zTXt' and 'iTXt' image chunks. With a specially crafted PNG image, a remote attacker can exhaust available memory resources. (CVE-2017-3253)
 - An unspecified flaw exists related to the Deployment subcomponent. This may allow a remote attacker to gain access to sensitive information. No further details have been provided by the vendor. (CVE-2017-3259)
 - An unspecified flaw exists related to the Networking subcomponent. This may allow a context-dependent attacker to gain access to sensitive information. No further details have been provided by the vendor. (CVE-2017-3261)
 - An unspecified flaw exists related to the Java Mission Control subcomponent. This may allow a remote attacker to gain access to sensitive information. No further details have been provided by the vendor. (CVE-2017-3262)
 - A flaw exists related to improper restrictions on protected field members for the atomic field updaters in the 'java.util.concurrent.atomic' package. This may allow a context-dependent attacker to potentially execute arbitrary code outside of intended sandbox restrictions. (CVE-2017-3272)
 - A flaw exists in the Hotspot subcomponent related to insecure class construction when handling exception stack frames. This may allow a context-dependent attacker to potentially execute arbitrary code outside of intended sandbox restrictions. (CVE-2017-3289)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3179-1 advisory.

    Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to     birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long     encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes them to be     used only if no non-legacy algorithms can be negotiated. (CVE-2016-2183)

    It was discovered that OpenJDK accepted ECSDA signatures using non-canonical DER encoding. An attacker     could use this to modify or expose sensitive data. (CVE-2016-5546)

    It was discovered that OpenJDK did not properly verify object identifier (OID) length when reading     Distinguished Encoding Rules (DER) records, as used in x.509 certificates and elsewhere. An attacker could     use this to cause a denial of service (memory consumption). (CVE-2016-5547)

    It was discovered that covert timing channel vulnerabilities existed in the DSA and ECDSA implementations     in OpenJDK. A remote attacker could use this to expose sensitive information. (CVE-2016-5548,     CVE-2016-5549)

    It was discovered that the URLStreamHandler class in OpenJDK did not properly parse user information from     a URL. A remote attacker could use this to expose sensitive information. (CVE-2016-5552)

    It was discovered that the URLClassLoader class in OpenJDK did not properly check access control context     when downloading class files. A remote attacker could use this to expose sensitive information.
    (CVE-2017-3231)

    It was discovered that the Remote Method Invocation (RMI) implementation in OpenJDK performed     deserialization of untrusted inputs. A remote attacker could use this to execute arbitrary code.
    (CVE-2017-3241)

    It was discovered that the Java Authentication and Authorization Service (JAAS) component of OpenJDK did     not properly perform user search LDAP queries. An attacker could use a specially constructed LDAP entry to     expose or modify sensitive information. (CVE-2017-3252)

    It was discovered that the PNGImageReader class in OpenJDK did not properly handle iTXt and zTXt chunks.
    An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-3253)

    It was discovered that integer overflows existed in the SocketInputStream and SocketOutputStream classes     of OpenJDK. An attacker could use this to expose sensitive information. (CVE-2017-3261)

    It was discovered that the atomic field updaters in the java.util.concurrent.atomic package in OpenJDK did     not properly restrict access to protected field members. An attacker could use this to specially craft a     Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3272)

    It was discovered that a vulnerability existed in the class construction implementation in OpenJDK. An     attacker could use this to specially craft a Java application or applet that could bypass Java sandbox     restrictions. (CVE-2017-3289)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-65 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in in Oracle&rsquo;s JRE and       JDK. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, gain access to information, or cause a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

An update for java-1.7.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 5, Oracle Java for Red Hat Enterprise Linux 6, and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 7 to version 7 Update 131.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3261, CVE-2017-3272, CVE-2017-3289)

This update mitigates the CVE-2016-2183 issue by adding 3DES cipher suites to the list of legacy algorithms (defined using the jdk.tls.legacyAlgorithms security property) so they are only used if connecting TLS/SSL client and server do not share any other non-legacy cipher suite.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0175 advisory.

    Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software     Development Kit.

    This update upgrades Oracle Java SE 8 to version 8 Update 121.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java     Software Development Kit. Further information about these flaws can be found on the Oracle Java SE     Critical Patch Update Advisory page, listed in the References section. (CVE-2016-2183, CVE-2016-5546,     CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2016-8328, CVE-2017-3231, CVE-2017-3241,     CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3261, CVE-2017-3262, CVE-2017-3272, CVE-2017-3289)

    This update mitigates the CVE-2016-2183 issue by adding 3DES cipher suites to the list of legacy     algorithms (defined using the jdk.tls.legacyAlgorithms security property) so they are only used if     connecting TLS/SSL client and server do not share any other non-legacy cipher suite.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 121, 7 Update 131, or 6 Update 141. It is, therefore, affected by multiple vulnerabilities :

  - A vulnerability exists in the Libraries subcomponent,     known as SWEET32, in the 3DES and Blowfish algorithms     due to the use of weak 64-bit block ciphers by default.
    A man-in-the-middle attacker who has sufficient     resources can exploit this vulnerability, via a     'birthday' attack, to detect a collision that leaks the     XOR between the fixed secret and a known plaintext,     allowing the disclosure of the secret text, such as     secure HTTPS cookies, and possibly resulting in the     hijacking of an authenticated session. (CVE-2016-2183)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-5546)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2016-5547)

  - Multiple unspecified flaws exist in the Libraries     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5548, CVE-2016-5549)

  - An unspecified flaw exists in the Networking     subcomponent that allows an unauthenticated, remote     attacker to impact integrity. (CVE-2016-5552)

  - An unspecified flaw exists in the Mission Control     subcomponent that allows an unauthenticated, remote     attacker to impact integrity. (CVE-2016-8328)

  - Multiple unspecified flaws exist in the Networking     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3231, CVE-2017-3261)

  - An unspecified flaw exists in the RMI subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3241)

  - An unspecified flaw exists in the JAAS subcomponent that     allows an unauthenticated, remote attacker to impact     integrity. (CVE-2017-3252)

  - An unspecified flaw exists in the 2D subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3253)

  - An unspecified flaw exists in the Deployment     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3259)

  - An unspecified flaw exists in the AWT subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3260)

  - An unspecified flaw exists in the Java Mission Control     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3262)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3272)

  - An unspecified flaw exists in the Hotspot subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3289)

Note that CVE-2017-3241 can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.
Note that CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, and CVE-2017-3253 can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. They can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

ID	Name	Product	Family	Severity
160374	IBM Java 6.0 < 6.0.16.41 / 6.1 < 6.1.8.41 / 7.0 < 7.0.10.1 / 7.1 < 7.1.4.1 / 8.0 < 8.0.4.1 Multiple Vulnerabilities	Nessus	Misc.	critical
121694	Photon OS 1.0: Openjre PHSA-2017-0016	Nessus	PhotonOS Local Security Checks	critical
121693	Photon OS 1.0: Openjdk PHSA-2017-0016	Nessus	PhotonOS Local Security Checks	critical
103190	AIX Java Advisory : java_jan2017_advisory.asc (January 2017 CPU) (SWEET32)	Nessus	AIX Local Security Checks	critical
101248	GLSA-201707-01 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
100094	RHEL 6 : java-1.7.1-ibm (RHSA-2017:1216)	Nessus	Red Hat Local Security Checks	critical
97462	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2017:0338)	Nessus	Red Hat Local Security Checks	critical
97461	RHEL 5 : java-1.7.0-ibm (RHSA-2017:0337)	Nessus	Red Hat Local Security Checks	critical
97460	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2017:0336)	Nessus	Red Hat Local Security Checks	critical
97296	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2017:0490-1)	Nessus	SuSE Local Security Checks	critical
97287	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-278)	Nessus	SuSE Local Security Checks	critical
97187	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:0460-1)	Nessus	SuSE Local Security Checks	critical
97095	RHEL 6 / 7 : java-1.8.0-ibm (RHSA-2017:0263)	Nessus	Red Hat Local Security Checks	critical
97002	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2017-201)	Nessus	SuSE Local Security Checks	critical
96926	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:0346-1)	Nessus	SuSE Local Security Checks	critical
9917	Oracle Java SE 6 < Update 141 / 7 < Update 131 / 8 < Update 121 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
96796	Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3179-1)	Nessus	Ubuntu Local Security Checks	critical
96787	GLSA-201701-65 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
96651	RHEL 5 / 6 / 7 : java-1.7.0-oracle (RHSA-2017:0176)	Nessus	Red Hat Local Security Checks	critical
96650	RHEL 7 : java-1.8.0-oracle (RHSA-2017:0175)	Nessus	Red Hat Local Security Checks	critical
96629	Oracle Java SE Multiple Vulnerabilities (January 2017 CPU) (Unix) (SWEET32)	Nessus	Misc.	critical
96628	Oracle Java SE Multiple Vulnerabilities (January 2017 CPU) (SWEET32)	Nessus	Windows	critical

Detections

Analytics

CVE-2016-5549

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical