Security Fix(es) :

  - OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS     (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via     jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

  - OpenJDK: Improper checks of SASL message properties in     GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler causing URL     normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Excessive memory usage in OID processing in     X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incorrect exception processing during     deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

  - OpenJDK: Incomplete enforcement of maxDatagramSockets     limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

Security Fix(es) :

  - OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS     (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via     jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

  - OpenJDK: Improper checks of SASL message properties in     GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler check causing     URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Excessive memory usage in OID processing in     X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incorrect exception processing during     deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

  - OpenJDK: Incomplete enforcement of maxDatagramSockets     limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE component of Oracle Java     SE (subcomponent: JCE). The supported version that is     affected is Java SE: 8u212. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs.(CVE-2019-2842)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Java SE,     Java SE Embedded. While the vulnerability is in Java     SE, Java SE Embedded, attacks may significantly impact     additional products. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java     SE Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs.(CVE-2020-2601)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE. Note: This     vulnerability can only be exploited by supplying data     to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java     applets, such as through a web service.(CVE-2020-2654)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Kerberos). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Java SE,     Java SE Embedded. While the vulnerability is in Java     SE, Java SE Embedded, attacks may significantly impact     additional products. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java     SE Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs.(CVE-2019-2949)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u241 and 8u231     Java SE Embedded: 8u231. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability applies     to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted     code (e.g., code that comes from the internet) and rely     on the Java sandbox for security. This vulnerability     can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs.(CVE-2020-2659)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java     SE Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs.(CVE-2020-2593)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Java SE,     Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted     code (e.g., code that comes from the internet) and rely     on the Java sandbox for security. This vulnerability     can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs.(CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u241, 8u231,     11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the     APIs.(CVE-2020-2583)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-2583)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2020-2590 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-2593)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2020-2601)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2020-2604)

Vulnerability in the Java SE product of Oracle Java SE (component:
Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-2654)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.
Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-2659)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0465 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP5.

    Security Fix(es):

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-openjdk fixes the following issues :

Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January 2020 CPU, bsc#1160968) :

  - CVE-2020-2583: Unlink Set of LinkedHashSets

  - CVE-2020-2590: Improve Kerberos interop capabilities

  - CVE-2020-2593: Normalize normalization for all

  - CVE-2020-2601: Better Ticket Granting Services

  - CVE-2020-2604: Better serial filter handling

  - CVE-2020-2659: Enhance datagram socket support

  - CVE-2020-2654: Improve Object Identifier Processing

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0196 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

    * OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0157 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

    * OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0469 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP5.

    Security Fix(es):

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0468 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP60.

    Security Fix(es):

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0467 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP60.

    Security Fix(es):

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 251, 8 Update 241, 11 Update 6, or 13 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Oracle Java SE and Java SE Embedded are prone to a severe division by zero, over 'Multiple' protocol.
    This issue affects the 'SQLite' component.(CVE-2019-16168)

  - Oracle Java SE and Java SE Embedded are prone to format string vulnerability, leading to a read     uninitialized stack data over 'Multiple' protocol. This issue affects the 'libxst' component.
    (CVE-2019-13117, CVE-2019-13118)

  - Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this over 'Kerberos' protocol. This issue affects the 'Security' component.
    (CVE-2020-2601, CVE-2020-2590)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this overmultiple protocols. This issue affects the 'Serialization' component.
    (CVE-2020-2604, CVE-2020-2583)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. Tn unauthenticated     remote attacker can exploit this over multiple protocols. This issue affects the 'Networking' component.
    (CVE-2020-2593, CVE-2020-2659)

  - Oracle Java SE are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'Libraries' component. (CVE-2020-2654)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'JavaFX' component. (CVE-2020-2585)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticate remote attacker can exploit     this over 'HTTPS' protocols. This issue affects the 'JSSE' component. (CVE-2020-2655)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
133169	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20200121)	Nessus	Scientific Linux Local Security Checks	1/22/2020	2/24/2020	high
133788	Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20200218)	Nessus	Scientific Linux Local Security Checks	2/19/2020	3/27/2024	high
134798	EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2020-1307)	Nessus	Huawei Local Security Checks	3/23/2020	5/18/2022	medium
134409	NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	3/11/2020	1/14/2021	high
134678	Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2020-1403)	Nessus	Amazon Linux Local Security Checks	3/19/2020	3/21/2024	high
133634	RHEL 8 : java-1.8.0-ibm (RHSA-2020:0465)	Nessus	Red Hat Local Security Checks	2/12/2020	11/7/2024	high
133346	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2020-147)	Nessus	SuSE Local Security Checks	1/30/2020	3/28/2024	high
133167	RHEL 7 : java-1.8.0-openjdk (RHSA-2020:0196)	Nessus	Red Hat Local Security Checks	1/22/2020	11/8/2024	high
133125	RHEL 6 : java-1.8.0-openjdk (RHSA-2020:0157)	Nessus	Red Hat Local Security Checks	1/21/2020	11/7/2024	high
133638	RHEL 6 : java-1.8.0-ibm (RHSA-2020:0469)	Nessus	Red Hat Local Security Checks	2/12/2020	11/7/2024	high
133637	RHEL 7 : java-1.7.1-ibm (RHSA-2020:0468)	Nessus	Red Hat Local Security Checks	2/12/2020	11/7/2024	high
133636	RHEL 6 : java-1.7.1-ibm (RHSA-2020:0467)	Nessus	Red Hat Local Security Checks	2/12/2020	11/7/2024	high
132960	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU) (Unix)	Nessus	Misc.	1/16/2020	10/21/2022	high

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

high

high

high

high

high

high

high