The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - Multiple vulnerabilities exist in the zlib subcomponent     that allow an unauthenticated, remote attacker to     trigger denial of service conditions. (CVE-2016-9840,     CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

  - An unspecified flaw exists in the XML subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-1289)

  - An unspecified flaw exists in the Networking     subcomponent that allows an unauthenticated, remote     attacker to impact confidentiality and integrity.
    (CVE-2017-3509)

  - An unspecified flaw exists in the JCE subcomponent that     allows a local attacker to gain elevated privileges.
    This vulnerability does not affect Java SE version 6.
    (CVE-2017-3511)

  - An unspecified flaw exists in the AWT subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. This vulnerability does not     affect Java SE version 6. (CVE-2017-3512)

  - An unspecified flaw exists in the AWT subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3514)

  - Multiple unspecified flaws exist in the Networking     subcomponent that allow an unauthenticated, remote     attacker to gain update, insert, or delete access to     unauthorized data. (CVE-2017-3533, CVE-2017-3544)

  - An unspecified flaw exists in the Security subcomponent     that allows an unauthenticated, remote attacker to gain     update, insert, or delete access to unauthorized data.
    (CVE-2017-3539)

This update for java-1_7_1-ibm fixes the following issues: Version update to 7.1-4.5 bsc#1038505

  - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in     inftrees.c

  - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in     inffast.c

  - CVE-2016-9842: zlib: Undefined left shift of negative     number

  - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer

  - CVE-2017-1289: IBM JDK: XML External Entity Injection     (XXE) error when processing XML data

  - CVE-2017-3509: OpenJDK: improper re-use of NTLM     authenticated connections

  - CVE-2017-3511: OpenJDK: untrusted extension directories     search path in Launcher

  - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification

  - CVE-2017-3533: OpenJDK: newline injection in the FTP     client

  - CVE-2017-3544: OpenJDK: newline injection in the SMTP     client

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_6_0-ibm fixes the following issues :

  - Version update to 6.0-16.45 bsc#1038505

  - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in     inftrees.c

  - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in     inffast.c

  - CVE-2016-9842: zlib: Undefined left shift of negative     number

  - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer

  - CVE-2017-1289: IBM JDK: XML External Entity Injection     (XXE) error when processing XML data

  - CVE-2017-3509: OpenJDK: improper re-use of NTLM     authenticated connections

  - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification

  - CVE-2017-3533: OpenJDK: newline injection in the FTP     client

  - CVE-2017-3544: OpenJDK: newline injection in the SMTP     client

  - Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Java SE installed on the remote host is prior to 6 Update 151, 7 Update 141, or 8 Update 131, and is therefore affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3509)
  - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges. This vulnerability does not affect Java SE version 6. (CVE-2017-3511)
  - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512)
  - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514)
  - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526)
  - Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544)
  - An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3539)

ID	Name	Product	Family	Published	Updated	Severity
103189	AIX Java Advisory : java_apr2017_advisory.asc (April 2017 CPU)	Nessus	AIX Local Security Checks	9/13/2017	4/21/2023	high
100378	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:1387-1)	Nessus	SuSE Local Security Checks	5/24/2017	1/19/2021	critical
119998	SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2017:1389-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/11/2024	critical
700090	Oracle Java SE 6 < Update 151 / 7 < Update 141 / 8 < Update 131 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/10/2017	3/6/2019	high

Detections

Analytics

Plugins Search

high

critical

critical

high