OpenJDK was updated to 2.6.1 - OpenJDK 8u51 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2597: Easily exploitable vulnerability in the     Install component requiring logon to Operating System.
    Successful attack of this vulnerability could have     resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2627: Very difficult to exploit vulnerability     in the Install component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized read access to a subset of Java     accessible data.

  - CVE-2015-2628: Easily exploitable vulnerability in the     CORBA component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2659: Easily exploitable vulnerability in the     Security component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data. 

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4736: Difficult to exploit vulnerability in the     Deployment component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2596: Difficult to exploit vulnerability in the     Hotspot component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized update, insert or delete access to some     Java accessible data.

  - CVE-2015-2597: Easily exploitable vulnerability in the     Install component requiring logon to Operating System.
    Successful attack of this vulnerability could have     resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2627: Very difficult to exploit vulnerability     in the Install component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized read access to a subset of Java     accessible data.

  - CVE-2015-2628: Easily exploitable vulnerability in the     CORBA component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data.

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4736: Difficult to exploit vulnerability in the     Deployment component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2015-2590, CVE-2015-2628, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4760, CVE-2015-4748)

Several vulnerabilities were discovered in the cryptographic components of the OpenJDK JRE. An attacker could exploit these to expose sensitive data over the network. (CVE-2015-2601, CVE-2015-2808, CVE-2015-4000, CVE-2015-2625, CVE-2015-2613)

As a security improvement, this update modifies OpenJDK behavior to disable RC4 TLS/SSL cipher suites by default.

As a security improvement, this update modifies OpenJDK behavior to reject DH key sizes below 768 bits by default, preventing a possible downgrade attack.

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2015-2621, CVE-2015-2632)

A vulnerability was discovered with how the JNDI component of the OpenJDK JRE handles DNS resolutions. A remote attacker could exploit this to cause a denial of service. (CVE-2015-4749).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Satellite 5.6 and 5.7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2621, CVE-2015-2625, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760)

Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change.

Users of Red Hat Satellite 5.6 and 5.7 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR16-FP7 release.
For this update to take effect, Red Hat Satellite must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

openssh was updated to fix several security issues and bugs.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function in     channels.c in ssh in OpenSSH when ForwardX11Trusted mode     is not used, lacked a check of the refusal deadline for     X connections, which made it easier for remote attackers     to bypass intended access restrictions via a connection     outside of the permitted time window (bsc#936695).

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd in OpenSSH did not properly     restrict the processing of keyboard-interactive devices     within a single connection, which made it easier for     remote attackers to conduct brute-force attacks or cause     a denial of service (CPU consumption) via a long and     duplicative list in the ssh -oKbdInteractiveDevices     option, as demonstrated by a modified client that     provides a different password for each pam element on     this list (bsc#938746).

  - CVE-2015-4000: Removed and disabled weak DH groups to     address LOGJAM (bsc#932483).

  - Hardening patch to fix sftp RCE (bsc#903649).

  - CVE-2015-6563: The monitor component in sshd in OpenSSH     accepted extraneous username data in     MONITOR_REQ_PAM_INIT_CTX requests, which allowed local     users to conduct impersonation attacks by leveraging any     SSH login access in conjunction with control of the sshd     uid to send a crafted MONITOR_REQ_PWNAM request, related     to monitor.c and monitor_wrap.c.

  - CVE-2015-6564: Use-after-free vulnerability in the     mm_answer_pam_free_ctx function in monitor.c in sshd in     OpenSSH might have allowed local users to gain     privileges by leveraging control of the sshd uid to send     an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OpenSSH was updated to fix several security issues and bugs.

Please note that due to a bug in the previous shipped openssh version, sshd might not correctly restart. Please verify that the ssh daemon is running after installing this update.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function, when     ForwardX11Trusted mode is not used, lacked a check of     the refusal deadline for X connections, which made it     easier for remote attackers to bypass intended access     restrictions via a connection outside of the permitted     time window. (bsc#936695)

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd did not properly restrict the     processing of keyboard-interactive devices within a     single connection, which made it easier for remote     attackers to conduct brute-force attacks or cause a     denial of service (CPU consumption) via a long and     duplicative list in the ssh

    -oKbdInteractiveDevices option, as demonstrated by a     modified client that provides a different password for     each pam element on this list. (bsc#938746)

  - CVE-2015-4000: Removed and disabled weak DH groups to     address LOGJAM. (bsc#932483)

  - Hardening patch to fix sftp RCE. (bsc#903649)

  - CVE-2015-6563: The monitor component in sshd accepted     extraneous username data in MONITOR_REQ_PAM_INIT_CTX     requests, which allowed local users to conduct     impersonation attacks by leveraging any SSH login access     in conjunction with control of the sshd uid to send a     crafted MONITOR_REQ_PWNAM request, related to monitor.c     and monitor_wrap.c.

  - CVE-2015-6564: Use-after-free vulnerability in the     mm_answer_pam_free_ctx function in monitor.c in sshd     might have allowed local users to gain privileges by     leveraging control of the sshd uid to send an     unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

Additional a bug was fixed that could lead to openssh not working in chroot (bsc#947458).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
85002	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2015-512) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	2015/7/27	2022/12/5	low
85153	SUSE SLED11 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1320-1) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	2015/7/31	2022/12/5	low
85265	Ubuntu 12.04 LTS : openjdk-6 vulnerabilities (USN-2706-1) (Bar Mitzvah) (Logjam)	Nessus	Ubuntu Local Security Checks	2015/8/7	2022/12/5	low
85373	RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:1604) (Logjam)	Nessus	Red Hat Local Security Checks	2015/8/13	2023/4/25	medium
85929	SUSE SLES11 Security Update : openssh (SUSE-SU-2015:1547-1) (Logjam)	Nessus	SuSE Local Security Checks	2015/9/14	2022/12/5	low
86339	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2015:1695-1) (Logjam)	Nessus	SuSE Local Security Checks	2015/10/12	2022/12/5	low

偵測

搜尋 Plugin

low

low

low

medium

low

low