The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0098 advisory.

  - IBM JDK: J9 JVM allows code to invoke non-public interface methods (CVE-2015-5041)

  - TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) (CVE-2015-7575)

  - libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (CVE-2015-8126,     CVE-2015-8472)

  - OpenJDK: URL deserialization inconsistencies (Networking, 8059054) (CVE-2016-0402)

  - OpenJDK: logging of RMI connection secrets (JMX, 8130710) (CVE-2016-0448)

  - OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) (CVE-2016-0466)

  - OpenJDK: PBE incorrect key lengths (Libraries, 8138589) (CVE-2016-0475)

  - OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) (CVE-2016-0483)

  - ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) (CVE-2016-0494)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : java-1.8.0-ibm (RHSA-2016:0098)

critical Nessus Plugin ID 88554

Version 2.15