The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0716 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR3.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software     Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page,     listed in the References section. (CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0686,     CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0675 advisory.

    [1:1.7.0.101-2.6.6.1.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.101-2.6.6.1]
    - added Patch666 fontpath.patch to fix tck regressions
    - Resolves: rhbz#1325425

    [1:1.7.0.101-2.6.6.0]
    - Fix ztos handling in templateTable_ppc_64.cpp to be same as others in 7.
    - Resolves: rhbz#1325425

    [1:1.7.0.101-2.6.6.0]
    - Bump to 2.6.6 and u101b00.
    - Drop a leading zero from the priority as the update version is now three digits
    - Resolves: rhbz#1325425

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0686)

It was discovered that the Hotspot component of OpenJDK did not properly handle byte types. An untrusted Java application or applet could use this flaw to corrupt Java virtual machine memory and possibly execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2016-0687)

It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427)

It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed.
(CVE-2016-3425)

It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures.
The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected.
(CVE-2016-0695)

This IBM Java 1.7.1 SR3 FP40 relese fixes the following issues :

Security issues fixed :

  - CVE-2016-0264: buffer overflow vulnerability in the IBM     JVM (bsc#977648)

  - CVE-2016-0363: insecure use of invoke method in CORBA     component, incorrect CVE-2013-3009 fix (bsc#977650)

  - CVE-2016-0376: insecure deserialization in CORBA,     incorrect CVE-2013-5456 fix (bsc#977646)

  - The following CVEs got also fixed during this update.
    (bsc#979252) CVE-2016-3443, CVE-2016-0687,     CVE-2016-0686, CVE-2016-3427, CVE-2016-3449,     CVE-2016-3422, CVE-2016-3426

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in breakouts of the Java sandbox, denial of service or information disclosure.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2964-1 advisory.

    Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data     integrity, and availability. An attacker could exploit these to cause a denial of service, expose     sensitive data over the network, or possibly execute arbitrary code. (CVE-2016-0686, CVE-2016-0687,     CVE-2016-3427)

    A vulnerability was discovered in the OpenJDK JRE related to information disclosure. An attacker could     exploit this to expose sensitive data over the network. (CVE-2016-0695)

    A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could exploit this     to cause a denial of service. (CVE-2016-3425)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.6.0-ibm is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 6 to version 6 SR16-FP25.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)

The version of Oracle Java SE installed on the remote host is prior to 6 Update 115, 7 Update 101, or 8 Update 92 and is affected by multiple vulnerabilities :

 - An unspecified flaw related to the 'Serialization' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0686)
 - An unspecified flaw related to the 'Hotspot' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0687)
 - An unspecified flaw related to the 'Security' subcomponent may allow a remote attacker to gain access to potentially sensitive information. (CVE-2016-0695)
 - An unspecified flaw related to the '2D' subcomponent may allow a context-dependent attacker to cause a denial of service. (CVE-2016-3422)
 - An unspecified flaw related to the 'JAXP' subcomponent may allow a remote attacker to cause a denial of service. (CVE-2016-3425)
 - An unspecified flaw related to the 'JCE' subcomponent may allow a context-dependent attacker to gain access to potentially sensitive information. (CVE-2016-3426)
 - A flaw related to the 'JMX' subcomponent may allow a remote attacker to execute arbitrary code through Java deserialization. (CVE-2016-3427)
 - An out-of-bounds read flaw within the '2D' subcomponent is triggered when handling specially crafted files. This may allow a context-dependent attacker gain unauthorized access to potentially sensitive information. (CVE-2016-3443)
 - An unspecified flaw related to the 'Deployment' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-3449)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 91, 7 Update 101, or 6 Update 115. It is, therefore, affected by security vulnerabilities in the following subcomponents :

 - 2D
 - Deployment
 - Hotspot
 - JAXP
 - JCE
 - JMX
 - Security
 - Serialization

ID	Name	Product	Family	Published	Updated	Severity
90882	RHEL 7 : java-1.8.0-ibm (RHSA-2016:0716)	Nessus	Red Hat Local Security Checks	5/4/2016	11/4/2024	critical
90666	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2016-0675)	Nessus	Oracle Linux Local Security Checks	4/22/2016	10/22/2024	critical
90777	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2016-693)	Nessus	Amazon Linux Local Security Checks	4/29/2016	5/14/2023	critical
91161	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2016:1300-1)	Nessus	SuSE Local Security Checks	5/16/2016	6/18/2024	critical
90725	Debian DSA-3558-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	4/27/2016	6/18/2024	critical
90918	Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-2964-1)	Nessus	Ubuntu Local Security Checks	5/5/2016	8/27/2024	critical
90853	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2016:0708)	Nessus	Red Hat Local Security Checks	5/3/2016	5/14/2023	critical
9448	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 92 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/8/2016	3/6/2019	critical
700653	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 91 Multiple Vulnerabilities (April 2016 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

high