The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4080-1 advisory.

    Keegan Ryan discovered that the ECC implementation in OpenJDK was not sufficiently resilient to side-     channel attacks. An attacker could possibly use this to expose sensitive information. (CVE-2019-2745)

    It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing     suppressed exceptions in some situations. An attacker could use this to specially craft an object that,     when deserialized, would cause a denial of service. (CVE-2019-2762)

    It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated     during object deserialization. An attacker could use this to specially craft an object that, when     deserialized, would cause a denial of service (excessive memory consumption). (CVE-2019-2769)

    It was discovered that OpenJDK did not properly restrict privileges in certain situations. An attacker     could use this to specially construct an untrusted Java application or applet that could escape sandbox     restrictions. (CVE-2019-2786)

    Jonathan Birch discovered that the Networking component of OpenJDK did not properly validate URLs in some     situations. An attacker could use this to bypass restrictions on characters in URLs. (CVE-2019-2816)

    Nati Nimni discovered that the Java Cryptography Extension component in OpenJDK did not properly perform     array bounds checking in some situations. An attacker could use this to cause a denial of service.
    (CVE-2019-2842)

    It was discovered that OpenJDK incorrectly handled certain memory operations. If a user or automated     system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to     cause OpenJDK to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-7317)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-4080-1)

medium Nessus Plugin ID 127797

Version 1.10

Version 1.6

Version 1.10 Oct 21, 2023, 5:06 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") CVSSv3 score source (set to "CVE-2019-2745") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210506
Version 1.6 Dec 6, 2022, 6:51 PM Reference Plugin Feed: 202212061851