In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.

The version of IBM Java installed on the remote host is prior to 7.0 < 7.0.10.45 / 7.1 < 7.1.4.45 / 8.0 < 8.0.5.35. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update April 2019 advisory.

  - In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to     execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case     and rejects the attempted class load. (CVE-2019-10245)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - A flaw exists in Libraries that allows an unauthenticated, remote    attacker to cause denial of service. (CVE-2019-2602)

  - A flaw exists in the RMI component that allows an unauthenticated,     remote attacker to cause unspecified integrity impact.
    (CVE-2019-2684)

  - Flaws exist in the 2D component that allows an unauthenticated,     remote attacker to take control of the system via unspecified     means. (CVE-2019-2697, CVE-2019-2698)

  - A flaw exists in Eclipse OpenJ9 that allows an unauthenticated,     remote attacker to cause denial of service. (CVE-2019-10245)

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed :

CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).

CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).

CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).

CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component:
Libraries) (bsc#1132728).

CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1325 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP35.

    Security Fix(es):

    * Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)

    * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

    * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

    * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

    * IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_1-ibm fixes the following issues :

Update to Java 7.1 Service Refresh 4 Fix Pack 45.

Security issues fixed :

CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).

CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).

CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).

CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component:
Libraries) (bsc#1132728).

CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1238 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP35.

    Security Fix(es):

    * IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)

    * IBM JDK: missing null check when accelerating Unsafe calls (CVE-2018-12549)

    * Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)

    * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

    * OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

    * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

    * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

    * IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

    * libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

    * Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment) (CVE-2019-2449)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1166 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP45.

    Security Fix(es):

    * Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)

    * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

    * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

    * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

    * IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1165 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP45.

    Security Fix(es):

    * Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)

    * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

    * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

    * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

    * IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1164 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP35.

    Security Fix(es):

    * Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)

    * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

    * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

    * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

    * IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1163 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP35.

    Security Fix(es):

    * Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)

    * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

    * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

    * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

    * IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
160341	IBM Java 7.0 < 7.0.10.45 / 7.1 < 7.1.4.45 / 8.0 < 8.0.5.35	Nessus	Misc.	high
126924	AIX Java Advisory : java_apr2019_advisory.asc (April 2019 CPU)	Nessus	AIX Local Security Checks	high
126336	SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-2)	Nessus	SuSE Local Security Checks	high
126167	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1644-1)	Nessus	SuSE Local Security Checks	high
125756	RHEL 6 : java-1.8.0-ibm (RHSA-2019:1325)	Nessus	Red Hat Local Security Checks	high
125461	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:1345-1)	Nessus	SuSE Local Security Checks	high
125336	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2019:14059-1)	Nessus	SuSE Local Security Checks	high
125335	SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-1)	Nessus	SuSE Local Security Checks	high
125239	RHEL 8 : java-1.8.0-ibm (RHSA-2019:1238)	Nessus	Red Hat Local Security Checks	critical
125015	RHEL 7 : java-1.7.1-ibm (RHSA-2019:1166)	Nessus	Red Hat Local Security Checks	high
125014	RHEL 6 : java-1.7.1-ibm (RHSA-2019:1165)	Nessus	Red Hat Local Security Checks	high
125013	RHEL 7 : java-1.8.0-ibm (RHSA-2019:1164)	Nessus	Red Hat Local Security Checks	high
125012	RHEL 6 : java-1.8.0-ibm (RHSA-2019:1163)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-10245

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

high

high

high

high