This update for java-1_7_0-ibm provides the following fixes: The version was updated to 7.0.10.20 [bsc#1082810] :

  - Following security issues were fixed :

  - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582     CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603     CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677     CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

  - Defect fixes :

  - IJ04281 Class Libraries: Startup time increase after     applying apar IV96905

  - IJ03822 Class Libraries: Update timezone information to     tzdata2017c

  - IJ03605 Java Virtual Machine: Legacy security for     com.ibm.jvm.dump, trace, log was not enabled by default

  - IJ03607 JIT Compiler: Result String contains a redundant     dot when converted from BigDecimal with 0 on all     platforms

  - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01

  - IJ04282 Security: Change in location and default of     jurisdiction policy files

  - IJ03853 Security: IBMCAC provider does not support     SHA224

  - IJ02679 Security: IBMPKCS11Impl     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; Bad sessions     are being allocated internally

  - IJ02706 Security: IBMPKCS11Impl     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; Bad sessions     are being allocated internally

  - IJ03552 Security: IBMPKCS11Impl - Config file problem     with the slot specification attribute

  - IJ01901 Security: IBMPKCS11Impl     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147;
    SecureRandom.setSeed() exception

  - IJ03801 Security: Issue with same DN certs, iKeyman GUI     error with stash, JKS Chain issue and JVM argument parse     issue with iKeyman

  - IJ02284 JIT Compiler: Division by zero in JIT compiler

  - Make it possible to run Java jnlp files from Firefox.
    (bsc#1057460)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1463 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP10.

    Security Fix(es):

    * IBM JDK: J9 JVM allows untrusted code running under a security manager to elevate its privileges     (CVE-2018-1417)

    * Oracle JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Deployment) (CVE-2018-2638)

    * Oracle JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Deployment) (CVE-2018-2639)

    * OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962) (CVE-2018-2582)

    * Oracle JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Installer) (CVE-2018-2627)

    * OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606) (CVE-2018-2633)

    * OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600) (CVE-2018-2634)

    * OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998) (CVE-2018-2637)

    * OpenJDK: GTK library loading use-after-free (AWT, 8185325) (CVE-2018-2641)

    * Oracle JDK: unspecified vulnerability fixed in 7u171, 8u161, and 9.0.4 (JavaFX) (CVE-2018-2581)

    * OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449) (CVE-2018-2588)

    * OpenJDK: DnsClient missing source port randomization (JNDI, 8182125) (CVE-2018-2599)

    * OpenJDK: loading of classes from untrusted locations (I18n, 8182601) (CVE-2018-2602)

    * OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387) (CVE-2018-2603)

    * OpenJDK: insufficient strength of key agreement (JCE, 8185292) (CVE-2018-2618)

    * OpenJDK: GSS context use-after-free (JGSS, 8186212) (CVE-2018-2629)

    * Oracle JDK: unspecified vulnerability fixed in 6u181 and 7u171 (Serialization) (CVE-2018-2657)

    * OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284)     (CVE-2018-2663)

    * OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289) (CVE-2018-2677)

    * OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142) (CVE-2018-2678)

    * OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525) (CVE-2018-2579)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, execution of arbitrary code, incorrect LDAP/GSS authentication, insecure use of cryptography or bypass of deserialisation restrictions.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 9 Update 4, 8 Update 161, 7 Update 171, or 6 Update 181. It is, therefore, affected by multiple vulnerabilities related to the following components :

 - AWT
 - Deployment
 - Hotspot
 - I18n
 - Installer
 - JCE
 - JGSS
 - JMX
 - JNDI
 - JavaFX
 - LDAP
 - Libraries
 - Serialization

ID	Name	Product	Family	Published	Updated	Severity
107288	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0645-1)	Nessus	SuSE Local Security Checks	3/12/2018	1/19/2021	high
109908	RHEL 6 : java-1.8.0-ibm (RHSA-2018:1463)	Nessus	Red Hat Local Security Checks	5/18/2018	6/3/2024	high
108853	Debian DSA-4166-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	4/6/2018	11/13/2018	high
700656	Oracle Java SE 6 < Update 181 / 7 < Update 171 / 8 < Update 161 / 9 < Update 4 Multiple Vulnerabilities (January 2018 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	high

Detections

Analytics

Plugins Search

high

high

high

high