In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0733 advisory.

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

  - In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow     when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
    (CVE-2020-27221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0717 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14782)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

  - In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow     when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
    (CVE-2020-27221)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Java installed on the remote host is prior to 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25 / 11.0 < 11.0.10.0. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update February 2021 advisory.

  - In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow     when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
    (CVE-2020-27221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14634-1 advisory.

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base     Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2020-14803)

  - In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow     when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
    (CVE-2020-27221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0736 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP25.

    Security Fix(es):

    * IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

    * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

    * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0717 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP25.

    Security Fix(es):

    * IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

    * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

    * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0733 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP80.

    Security Fix(es):

    * IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]

  - CVE-2020-27221: Potential for a stack-based buffer     overflow when the virtual machine or JNI natives are     converting from UTF-8 characters to platform encoding.

  - CVE-2020-14803: Unauthenticated attacker with network     access via multiple protocols allows to compromise Java     SE.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_1-ibm fixes the following issues :

Update to Java 7.1 Service Refresh 4 Fix Pack 80 [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]

  - CVE-2020-27221: Potential for a stack-based buffer     overflow when the virtual machine or JNI natives are     converting from UTF-8 characters to platform encoding.

  - CVE-2020-14803: Unauthenticated attacker with network     access via multiple protocols allows to compromise Java     SE.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
208580	CentOS 7 : java-1.7.1-ibm (RHSA-2021:0733)	Nessus	CentOS Local Security Checks	critical
208569	CentOS 7 : java-1.8.0-ibm (RHSA-2021:0717)	Nessus	CentOS Local Security Checks	critical
160354	IBM Java 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25 / 11.0 < 11.0.10.0	Nessus	Misc.	critical
150631	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2021:14634-1)	Nessus	SuSE Local Security Checks	critical
147142	RHEL 8 : java-1.8.0-ibm (RHSA-2021:0736)	Nessus	Red Hat Local Security Checks	critical
147140	RHEL 7 : java-1.8.0-ibm (RHSA-2021:0717)	Nessus	Red Hat Local Security Checks	critical
147139	RHEL 7 : java-1.7.1-ibm (RHSA-2021:0733)	Nessus	Red Hat Local Security Checks	critical
146937	SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0670-1)	Nessus	SuSE Local Security Checks	critical
146889	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0652-1)	Nessus	SuSE Local Security Checks	critical
146614	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2021:0512-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-27221

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical