Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Satellite 5.6 and 5.7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

Users of Red Hat Satellite 5.6 and 5.7 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR16-FP7 release.
For this update to take effect, Red Hat Satellite must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16-FP7 release. All running instances of IBM Java must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1544 advisory.

  - IBM JDK: plain text data stored in memory dumps (CVE-2015-1931)

  - OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401) (CVE-2015-2590)

  - OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865) (CVE-2015-2601)

  - OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853) (CVE-2015-2621)

  - ICU: integer overflow in LETableReference verifyLength() (OpenJDK 2D, 8077520) (CVE-2015-2632)

  - Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) (CVE-2015-2637, CVE-2015-2638)

  - Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Deployment) (CVE-2015-2664)

  - LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks     (CVE-2015-4000)

  - OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397) (CVE-2015-4731)

  - OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405) (CVE-2015-4732)

  - OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409) (CVE-2015-4733)

  - OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374) (CVE-2015-4748)

  - OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378) (CVE-2015-4749)

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715) (CVE-2015-4760)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 and 7 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2613, CVE-2015-2619, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4729, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR3-FP10 release. All running instances of IBM Java must be restarted for the update to take effect.

java-1_7_0-ibm was updated to fix 21 security issues.

These security issues were fixed :

  - CVE-2015-4729: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45 allowed remote attackers to affect     confidentiality and integrity via unknown vectors     related to Deployment (bsc#938895).

  - CVE-2015-4748: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and Embedded 8u33 allowed remote attackers     to affect confidentiality, integrity, and availability     via unknown vectors related to Security (bsc#938895).

  - CVE-2015-2664: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed local users to affect     confidentiality, integrity, and availability via unknown     vectors related to Deployment (bsc#938895).

  - CVE-2015-0192: Unspecified vulnerability in IBM Java 8     before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1     before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16     FP10 allowed remote attackers to gain privileges via     unknown vectors related to the Java Virtual Machine     (bsc#938895).

  - CVE-2015-2613: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33     allowed remote attackers to affect confidentiality via     vectors related to JCE (bsc#938895).

  - CVE-2015-4731: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java     SE Embedded 8u33 allowed remote attackers to affect     confidentiality, integrity, and availability via vectors     related to JMX (bsc#938895).

  - CVE-2015-2637: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-4733: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via vectors related to RMI     (bsc#938895).

  - CVE-2015-4732: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Libraries, a different vulnerability than     CVE-2015-2590 (bsc#938895).

  - CVE-2015-2621: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33, allowed remote attackers to affect confidentiality     via vectors related to JMX (bsc#938895).

  - CVE-2015-2619: Unspecified vulnerability in Oracle Java     SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded     7u75 and 8u33 allowed remote attackers to affect     confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-2590: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and     8u33 allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Libraries, a different vulnerability than     CVE-2015-4732 (bsc#938895).

  - CVE-2015-2638: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to 2D (bsc#938895).

  - CVE-2015-2625: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via vectors related to JSSE     (bsc#938895).

  - CVE-2015-2632: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed remote attackers to     affect confidentiality via unknown vectors related to 2D     (bsc#938895).

  - CVE-2015-1931: Unspecified vulnerability (bsc#938895).

  - CVE-2015-4760: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45 allowed remote attackers to     affect confidentiality, integrity, and availability via     unknown vectors related to 2D (bsc#938895).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#935540).

  - CVE-2015-2601: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect confidentiality via vectors related to JCE     (bsc#938895).

  - CVE-2015-2808: The RC4 algorithm, as used in the TLS     protocol and SSL protocol, did not properly combine     state data with key data during the initialization     phase, which made it easier for remote attackers to     conduct plaintext-recovery attacks against the initial     bytes of a stream by sniffing network traffic that     occasionally relies on keys affected by the Invariance     Weakness, and then using a brute-force approach     involving LSB values, aka the 'Bar Mitzvah' issue     (bsc#938895).

  - CVE-2015-4749: Unspecified vulnerability in Oracle Java     SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE     Embedded 7u75 and 8u33 allowed remote attackers to     affect availability via vectors related to JNDI     (bsc#938895).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IBM Java was updated to version 6 SR16 FP7 (6.0-16.7) to fix several security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-1931: IBM Java Security Components store plain     text data in memory dumps, which could allow a local     attacker to obtain information to aid in further attacks     against the system.

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data. (bnc#935540)

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - Java Security Components store plaintext data in memory     dumps, which allows a local attacker to gain access to     sensitive information. (CVE-2015-1931)

  - A flaw exists in the readSerialData() function in     class ObjectInputStream.java when handling OIS data,     which allows an attacker to execute arbitrary code.
    (CVE-2015-2590)

  - Multiple flaws exist in the JCE component due to     various cryptographic operations using non-constant     time comparisons. A remote attacker can exploit this     to conduct timing attacks to gain access to sensitive     information. (CVE-2015-2601)

  - A flaw exists in the ECDH_Derive() function in file     ec.c due to missing EC parameter validation when     performing ECDH key derivation. A remote attacker can     exploit this to access sensitive information.
    (CVE-2015-2613)

  - An unspecified vulnerability exists in the 2D component     that allows a remote attacker to access sensitive     information. (CVE-2015-2619, CVE-2015-2637)

  - A flaw exists in the RMIConnectionImpl constructor     in class RMIConnectionImpl.java due to improper     permission checks when creating repository class     loaders. An attacker can exploit this to bypass sandbox     restrictions and access sensitive information.
    (CVE-2015-2621)

  - An unspecified flaw exists in the JSSE component when     handling the SSL/TLS protocol. A remote attacker can     exploit this to gain access to sensitive information.
    (CVE-2015-2625)

  - An integer overflow condition exists in the     International Components for Unicode for C/C++ (ICU4C).
    An attacker, using a specially crafted font, can exploit     this to crash an application using this library or     access memory contents. (CVE-2015-2632)

  - A unspecified vulnerability exists in the 2D component     that allows a remote attacker to execute arbitrary     code. (CVE-2015-2638)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to gain elevated     privileges. (CVE-2015-2664)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

  - An unspecified vulnerability exists in the Deployment     component that impacts confidentiality and integrity.
    (CVE-2015-4729)

  - A flaw exists in class MBeanServerInvocationHandler.java     when handling MBean connection proxy classes. An     attacker can exploit this to bypass sandbox restrictions     and execute arbitrary code. (CVE-2015-4731)

  - Multiple flaws exist in classes ObjectInputStream.java     and SerialCallbackContext.java related to insufficient     context checking. An attacker can exploit these to     execute arbitrary code. (CVE-2015-4732)

  - A flaw exists in the invoke() method in the class     RemoteObjectInvocationHandler.java due to calls to the     finalize() method being permitted. An attacker can     exploit this to bypass sandbox protections and execute     arbitrary code. (CVE-2015-4733)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to execute arbitrary code.
    (CVE-2015-4736)

  - A flaw exists in the Security component when handling     Online Certificate Status Protocol (OCSP) responses with     no 'nextUpdate'. A remote attacker can exploit this to     cause an application to accept a revoked X.509     certificate. (CVE-2015-4748)

  - An flaw exists in the query() method in class     DnsClient.java due to a failure by the JNDI component's     exception handling to release request information. A     remote attacker can exploit this to cause a denial of     service. (CVE-2015-4749)

  - An integer overflow condition exists in the layout     engine in the International Components for Unicode for     C/C++ (ICU4C). An attacker, using a specially crafted     font, can exploit this to crash an application using     this library or execute arbitrary code. (CVE-2015-4760)

IBM Java was updated to 7.1-3.10 to fix several security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1931: IBM Java Security Components store plain     text data in memory dumps, which could allow a local     attacker to obtain information to aid in further attacks     against the system.

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data.

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IBM Java was updated to 6.0-16.7 to fix several security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1931: IBM Java Security Components store plain     text data in memory dumps, which could allow a local     attacker to obtain information to aid in further attacks     against the system.

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2613, CVE-2015-2619, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4729, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR9-FP10 release. All running instances of IBM Java must be restarted for the update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
85373	RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:1604) (Logjam)	Nessus	Red Hat Local Security Checks	8/13/2015	4/25/2023	medium
84956	RHEL 5 / 6 : java-1.6.0-ibm (RHSA-2015:1486) (Logjam)	Nessus	Red Hat Local Security Checks	7/23/2015	4/25/2023	medium
85238	RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:1544)	Nessus	Red Hat Local Security Checks	8/5/2015	4/27/2024	medium
84955	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2015:1485) (Logjam)	Nessus	Red Hat Local Security Checks	7/23/2015	4/25/2023	medium
85379	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2015:1375-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	8/13/2015	12/5/2022	low
85869	SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2015:1509-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	9/9/2015	12/5/2022	low
85447	AIX Java Advisory : java_july2015_advisory.asc (Logjam)	Nessus	AIX Local Security Checks	8/17/2015	4/21/2023	critical
85213	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2015:1329-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	8/4/2015	12/5/2022	low
119969	SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2015:1345-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	1/2/2019	7/17/2024	critical
85214	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2015:1331-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	8/4/2015	12/5/2022	low
84978	RHEL 5 : java-1.7.0-ibm (RHSA-2015:1488) (Logjam)	Nessus	Red Hat Local Security Checks	7/24/2015	4/25/2023	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

low

low

critical

low

critical

low

medium