The remote host is affected by the vulnerability described in GLSA-201701-58 (ICU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ICU. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition or possibly       have other unspecified impacts via a long locale string or       httpAcceptLanguage argument.  Additionally, A remote attacker, via a       specially crafted file, could cause an application using ICU to parse       untrusted font files resulting in a Denial of Service condition.
      Finally, remote attackers could affect confidentiality via unknown       vectors related to 2D.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in the International Components for Unicode (ICU) library.

  - CVE-2014-9911     Michele Spagnuolo discovered a buffer overflow     vulnerability which might allow remote attackers to     cause a denial of service or possibly execute arbitrary     code via crafted text.

  - CVE-2015-2632     An integer overflow vulnerability might lead into a     denial of service or disclosure of portion of     application memory if an attacker has control on the     input file.

  - CVE-2015-4844     Buffer overflow vulnerabilities might allow an attacker     with control on the font file to perform a denial of     service or, possibly, execute arbitrary code.

  - CVE-2016-0494     Integer signedness issues were introduced as part of the     CVE-2015-4844 fix.

  - CVE-2016-6293     A buffer overflow might allow an attacker to perform a     denial of service or disclosure of portion of     application memory.

  - CVE-2016-7415     A stack-based buffer overflow might allow an attacker     with control on the locale string to perform a denial of     service and, possibly, execute arbitrary code.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 51, 7 Update 85, or 6 Update 101. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - CORBA
 - Deployment
 - Hotspot
 - Install
 - JCE
 - JMX
 - JNDI
 - JSSE
 - Libraries
 - RMI
 - Security

The Oracle Java SE installed on the remote host is version 6 prior to Update 101, 7 prior to Update 85, or 8 prior to Update 51 and is affected by multiple vulnerabilities: 

 - A flaw in the 'ObjectInputStream::readSerialData()' function in 'share/classes/java/io/ObjectInputStream.java' that is triggered when handling OIS data allowing a context-dependent attacker to execute arbitrary code. (CVE-2015-2590) 
 - An unspecified flaw related to the Hotspot component may allow a context-dependent attacker to have an impact on integrity. (CVE-2015-2596) 
 - A flaw in the JCE component as various cryptographic operations use non-constant time comparisons allowing a remote attacker to conduct timing attacks in order to possibly glean sensitive information. (CVE-2015-2601)  
 - A flaw in the 'ECDH_Derive()' function in 'share/native/sun/security/ec/impl/ec.c' related to missing EC parameter validation when performing ECDH key derivation allowing a remote attacker to disclose potentially sensitive information. (CVE-2015-2613) 
 - An unspecified flaw related to the 2D component may allow a context-dependent attacker to gain access to sensitive information. (CVE-2015-2619) 
 - A flaw in the 'RMIConnectionImpl' constructor in 'share/classes/javax/management/remote/rmi/RMIConnectionImpl.java'. The issue is triggered due to improper permission checks when creating repository class loaders allowing a context-dependent attacker to bypass sandbox restrictions and disclose sensitive information.  (CVE-2015-2621) 
 - A flaw in the JSSE component that is triggered when performing X.509 certificate identity checks allowing a remote attacker to have a certificate for another domain being accepted as valid. (CVE-2015-2625) 
 - An unspecified flaw related to the Install component allowing a remote attacker to gain access to sensitive information. (CVE-2015-2627) 
 - A typecasting flaw in 'share/classes/com/sun/corba/se/impl/io/IIOPInputStream.java' that is triggered when handling IIOP operations allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-2628) 
 - International Components for Unicode for C/C++ (ICU4C) contains an integer overflow condition in the 'LETableReference::verifyLength()' function in 'layout/LETableReference.h'. With a specially crafted font, a context-dependent attacker can crash an application linked against the library or potentially disclose memory contents. (CVE-2015-2632) 
 - An unspecified flaw related to the 2D component allowing a context-dependent attacker to gain access to sensitive information. (CVE-2015-2637) 
 - An unspecified flaw related to the 2D component allowing a context-dependent attacker to execute arbitrary code. (CVE-2015-2638) 
 - A NULL pointer dereference flaw in 'share/classes/com/sun/crypto/provider/GCTR.java' related to the GCM (Galois Counter Mode) implementation. The issue is triggered when performing encryption using a block cipher in GCM mode and may allow a remote attacker to cause a crash. (CVE-2015-2659) 
 - An unspecified flaw in the Deployment component allowing a local attacker to gain elevated privileges. (CVE-2015-2664) 
 - An unspecified flaw related to the Deployment component may allow a remote attacker to have an impact on confidentiality and integrity. (CVE-2015-4729) 
 - A flaw in 'share/classes/javax/management/MBeanServerInvocationHandler.java' is triggered when handling MBean connection proxy classes allowing a context-dependent attacker to bypass sandbox restrictions and potentially execute arbitrary code. (CVE-2015-4731) 
 - A flaw in 'share/classes/java/io/ObjectInputStream.java' and 'share/classes/java/io/SerialCallbackContext.java' related to insufficient context checks allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-4732) 
 - A flaw in the 'RemoteObjectInvocationHandler::invoke()' function in 'share/classes/java/rmi/server/RemoteObjectInvocationHandler.java'. The issue is triggered as calls to the finalize() method are permitted allowing a context-dependent attacker to bypass sandbox protections and potentially execute arbitrary code. (CVE-2015-4733) 
 - An unspecified flaw related to the Deployment component may allow a context-dependent attacker to execute arbitrary code. (CVE-2015-4736) 
  -  A flaw that is triggered when handling Online Certificate Status Protocol (OCSP) responses with no 'nextUpdate' date specified allowing a remote attacker to cause an application to accept a revoked X.509 certificate. (CVE-2015-4748) 
 - A flaw in the 'DnsClient::query()' function in 'share/classes/com/sun/jndi/dns/DnsClient.java'. The issue is triggered as JNDI DnsClient's exception handling fails to release request information allowing a remote attacker to exhaust memory resources and cause a denial of service. (CVE-2015-4749) 
 -International Components for Unicode for C/C++ (ICU4C) contains overflow conditions in the layout engine. With a specially crafted font, a context-dependent attacker can cause a buffer overflow, crashing an application linked against the library or potentially allowing execution of arbitrary code. (CVE-2015-4760) 

ID	Name	Product	Family	Published	Updated	Severity
96744	GLSA-201701-58 : ICU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/25/2017	1/11/2021	critical
95361	Debian DSA-3725-1 : icu - security update	Nessus	Debian Local Security Checks	11/28/2016	1/11/2021	critical
700651	Oracle Java SE Multiple 6 < Update 101 / 7 < Update 85 / 8 < Update 51 Multiple Vulnerabilities (July 2015 CPU) (Bar Mitzvah)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	critical
8918	Oracle Java SE 6 < Update 101 / 7 < Update 85 / 8 < Update 51 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/30/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical