The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0902 advisory.

  - OpenJDK: Restrict use of privileged annotations (Libraries, 8034985) (CVE-2014-2483)

  - OpenJDK: Event logger format string vulnerability (Hotspot, 8037076) (CVE-2014-2490)

  - Oracle JDK: unspecified vulnerability fixed in 7u65 and 8u11 (Deployment) (CVE-2014-4208, CVE-2014-4220)

  - OpenJDK: SubjectDelegator protection insufficient (JMX, 8029755) (CVE-2014-4209)

  - OpenJDK: Incorrect generic signature attribute parsing (Hotspot, 8037076) (CVE-2014-4216)

  - OpenJDK: Clone interfaces passed to proxy methods (Libraries, 8035009) (CVE-2014-4218)

  - OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119)     (CVE-2014-4219)

  - OpenJDK: MethodHandles.Lookup insufficient modifiers checks (Libraries, 8035788) (CVE-2014-4221)

  - OpenJDK: Incorrect handling of invocations with exhausted ranks (Libraries, 8035793) (CVE-2014-4223)

  - Oracle JDK: unspecified vulnerability fixed in 6u81, 7u65 and 8u11 (Deployment) (CVE-2014-4227,     CVE-2014-4265)

  - OpenJDK: RSA blinding issues (Security, 8031346) (CVE-2014-4244)

  - OpenJDK: Prevent instantiation of service with non-public constructor (Security, 8035004) (CVE-2014-4252)

  - OpenJDK: AtomicReferenceFieldUpdater missing primitive type check (Libraries, 8039520) (CVE-2014-4262)

  - OpenJDK: insufficient Diffie-Hellman public key validation (Security, 8037162) (CVE-2014-4263)

  - OpenJDK: Incorrect TLS/EC management (Security, 8031340) (CVE-2014-4264)

  - OpenJDK: InfoBuilder incorrect return values (Serviceability, 8033301) (CVE-2014-4266)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : java-1.7.0-oracle (RHSA-2014:0902)

high Nessus Plugin ID 79036

Version 1.18