The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6932-1 advisory.

    It was discovered that the Hotspot component of OpenJDK 21 was not properly performing bounds when     handling certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this     issue to cause a

    denial of service or execute arbitrary code. (CVE-2024-21131)

    It was discovered that the Hotspot component of OpenJDK 21 could be made to run into an infinite loop. If     an automated system were tricked into processing excessively large symbols, an attacker could possibly use     this issue to cause a denial of service. (CVE-2024-21138)

    It was discovered that the Hotspot component of OpenJDK 21 did not

    properly perform range check elimination. An attacker could possibly use

    this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions.
    (CVE-2024-21140)

    Sergey Bylokhov discovered that OpenJDK 21 did not properly manage memory when handling 2D images. An     attacker could possibly use this issue to obtain sensitive information. (CVE-2024-21145)

    It was discovered that the Hotspot component of OpenJDK 21 incorrectly handled memory when performing     range check elimination under certain circumstances. An attacker could possibly use this issue to cause a

    denial of service, execute arbitrary code or bypass Java sandbox

    restrictions. (CVE-2024-21147)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3162-1 advisory.

    - Update to Java 8.0 Service Refresh 8 Fix Pack 30 (bsc#1228346)
    - CVE-2024-21147: Fixed an array index overflow in RangeCheckElimination. (bsc#1228052)
    - CVE-2024-21145: Fixed an out-of-bounds access in 2D image handling. (bsc#1228051)
    - CVE-2024-21140: Fixed a range check elimination pre-loop limit overflow. (bsc#1228048)
    - CVE-2024-21144: Pack200 increase loading time due to improper header validation. (bsc#1228050)
    - CVE-2024-21138: Fixed an issue where excessive symbol length can lead to infinite loop. (bsc#1228047)
    - CVE-2024-21131: Fixed a potential UTF8 size overflow. (bsc#1228046)
    - CVE-2024-27267: Fixed an Object Request Broker (ORB) remote denial of service. (bsc#1229224)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4560 advisory.

    - CVE-2024-21131 Improve-UTF8-String-supports
    - CVE-2024-21138 Better-symbol-storage
    - CVE-2024-21140 Improved-loop-handling
    - CVE-2024-21144 Enhance-Pack-200-loading
    - CVE-2024-21145 Improve-2D-image-handling

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.432.b06-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2720 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2024-21131)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21138)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data     to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8     (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2024-21140)

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf,     11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise     Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21144)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data     to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8     (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2024-21145)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to     critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). (CVE-2024-21147)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u421,     8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM     Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21208)

    Vulnerability in Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle     Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and  23. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.
    Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to     some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2024-21210)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE:
    8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle     GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21217)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u421,     8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23;   Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;   Oracle GraalVM     Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and     Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-11-openjdk installed on the remote host is prior to 11.0.25.0.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2024-010 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2024-21131)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21138)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data     to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8     (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2024-21140)

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf,     11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise     Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21144)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data     to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8     (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2024-21145)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to     critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). (CVE-2024-21147)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.7 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7097-1 advisory.

    Andy Boothe discovered that the Networking component of OpenJDK 11 did not properly handle access under     certain circumstances. An unauthenticated

    attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208)

    It was discovered that the Hotspot component of OpenJDK 11 did not properly handle vectorization under     certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized     resources and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)

    It was discovered that the Serialization component of OpenJDK 11 did not properly handle deserialization     under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial     of service. (CVE-2024-21217)

    It was discovered that the Hotspot component of OpenJDK 11 was not properly bounding certain UTF-8     strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21131)

    It was discovered that the Hotspot component of OpenJDK 11 could be made to run into an infinite loop. If     an automated system were tricked into processing excessively large symbols, an attacker could possibly use     this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21138)

    It was discovered that the Hotspot component of OpenJDK 11 did not properly perform range check     elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary     code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21140)

    Yakov Shafranovich discovered that the Concurrency component of OpenJDK 11 incorrectly performed header     validation in the Pack200 archive format. An attacker could possibly use this issue to cause a denial of     service. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21144)

    Sergey Bylokhov discovered that OpenJDK 11 did not properly manage memory when handling 2D images. An     attacker could possibly use this issue to obtain sensitive information. This issue was only addressed in     Ubuntu 18.04 LTS. (CVE-2024-21145)

    It was discovered that the Hotspot component of OpenJDK 11 incorrectly handled memory when performing     range check elimination under certain circumstances. An attacker could possibly use this issue to cause a     denial of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only     addressed in Ubuntu 18.04 LTS. (CVE-2024-21147)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204869	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : OpenJDK 21 vulnerabilities (USN-6932-1)	Nessus	Ubuntu Local Security Checks	7/31/2024	8/27/2024	high
206747	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-ibm (SUSE-SU-2024:3162-1)	Nessus	SuSE Local Security Checks	9/7/2024	9/7/2024	high
207369	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2024-4560)	Nessus	Oracle Linux Local Security Checks	9/17/2024	11/2/2024	high
213345	Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2024-2720)	Nessus	Amazon Linux Local Security Checks	12/23/2024	12/23/2024	high
213368	Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2024-010)	Nessus	Amazon Linux Local Security Checks	12/23/2024	12/23/2024	high
233563	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.7)	Nessus	Misc.	3/31/2025	3/31/2025	critical
210737	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenJDK 11 vulnerabilities (USN-7097-1)	Nessus	Ubuntu Local Security Checks	11/11/2024	11/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high