The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3007 advisory.

  - Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) (CVE-2018-2940)

  - OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)     (CVE-2018-2952)

  - Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) (CVE-2018-2973)

  - OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)     (CVE-2018-3136)

  - OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

  - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

  - OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)

  - OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

  - libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for     denial of service (CVE-2018-13785)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : java-1.6.0-sun (RHSA-2018:3007)

high Nessus Plugin ID 118376

Version 1.6