The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0136 advisory.

  - ICU: font parsing OOB read (OpenJDK 2D, 8055489) (CVE-2014-6585)

  - ICU: font parsing OOB read (OpenJDK 2D, 8056276) (CVE-2014-6591)

  - OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) (CVE-2014-6593)

  - IBM JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8891)

  - IBM JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8892)

  - OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) (CVE-2015-0395)

  - OpenJDK: directory information leak via file chooser (Swing, 8055304) (CVE-2015-0407)

  - OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) (CVE-2015-0408)

  - OpenJDK: DER decoder infinite loop  (Security, 8059485) (CVE-2015-0410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:0136)

critical Nessus Plugin ID 81204

Version 1.23