IBM Java 7.1 < 7.1.5.22 / 8.0 < 8.0.8.25 Multiple Vulnerabilities

high Nessus Plugin ID 195219

Language:

Synopsis

IBM Java is affected by multiple vulnerabilities.

Description

The version of IBM Java installed on the remote host is prior to 7.1 < 7.1.5.22 / 8.0 < 8.0.8.25. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update May 2024 advisory.

- The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
(CVE-2023-38264)

- In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option
-Xgc:concurrentScavenge, the sequence generated for System.arrayCopy on the IBM Z platform with hardware and software support for guarded storage [1], could allow access to a buffer with an incorrect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. This allows read and write to addresses beyond the end of the array range. (CVE-2024-3933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Apply the appropriate patch according to the IBM Security Update May 2024 advisory.

Plugin Details

Severity: High

ID: 195219

File Name: ibm_java_2024_05_01.nasl

Version: 1.3

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 5/9/2024

Updated: 1/10/2025

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:P

CVSS Score Source: CVE-2024-3933

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:java

Required KB Items: installed_sw/Java

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2024

Vulnerability Publication Date: 5/1/2024

Reference Information

CVE: CVE-2023-38264, CVE-2024-3933

Detections

Analytics