From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.

The version of IBM Java installed on the remote host is prior to 8.0 < 8.0.6.0. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update November 2019 advisory.

  - From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a     diagnostic file are permitted without any privilege checks. (CVE-2019-17631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 [bsc#1158442, bsc#1154212]

  - Security fixes: CVE-2019-2933 CVE-2019-2945     CVE-2019-2958 CVE-2019-2962 CVE-2019-2964 CVE-2019-2975     CVE-2019-2978 CVE-2019-2983 CVE-2019-2988 CVE-2019-2989     CVE-2019-2992 CVE-2019-2996 CVE-2019-2999 CVE-2019-2973     CVE-2019-2981 CVE-2019-17631

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0046 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6.

    Security Fix(es):

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

    * IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0006 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6.

    Security Fix(es):

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

    * IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4115 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6.

    Security Fix(es):

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

    * IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4113 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6.

    Security Fix(es):

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

    * IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
160351	IBM Java 8.0 < 8.0.6.0	Nessus	Misc.	critical
132704	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0024-1)	Nessus	SuSE Local Security Checks	critical
132701	RHEL 8 : java-1.8.0-ibm (RHSA-2020:0046)	Nessus	Red Hat Local Security Checks	critical
132684	RHEL 6 : java-1.8.0-ibm (RHSA-2020:0006)	Nessus	Red Hat Local Security Checks	critical
132670	SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0001-1)	Nessus	SuSE Local Security Checks	critical
131921	RHEL 7 : java-1.8.0-ibm (RHSA-2019:4115)	Nessus	Red Hat Local Security Checks	critical
131919	RHEL 6 : java-1.8.0-ibm (RHSA-2019:4113)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2019-17631

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical