現已提供適用於 Red Hat Enterprise Linux 7 的 java-11-openjdk 更新。Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Java-11-openjdk 套件提供 OpenJDK 11 Java Runtime Environment 和 OpenJDK 11 Java Software Development Kit。安全性修正：* OpenJDK：橢圓曲線 (EC) 密碼編譯中的旁路攻擊風險 (安全性，8208698) (CVE-2019-2745) * OpenJDK：在還原序列化中，對抑制例外的檢查不充份 (公用程式，8212328) (CVE-2019-2762) * OpenJDK：在 Collections 中進行還原序列化時，發生無限制記憶體配置 (公用程式，8213432) (CVE-2019-2769) * OpenJDK：缺少 URL 格式驗證 (網路，8221518) (CVE-2019-2816) * OpenJDK：TLS 交握時，認證狀態的處理不正確 (JSSE，8222678) (CVE-2019-2821) * OpenJDK：AccessController 中的權限限制不充份 (安全性，8216381) (CVE-2019-2786) * OpenJDK：ChaCha20Cipher 中的非常數時間比較 (安全性，8221344) (CVE-2019-2818) 如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678) (CVE-2019-2821)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

* OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (CVE-2019-2818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues :

Security issues fixed :

  - CVE-2019-2745: Improved ECC Implementation     (bsc#1141784).

  - CVE-2019-2762: Exceptional throw cases (bsc#1141782).

  - CVE-2019-2766: Improve file protocol handling     (bsc#1141789).

  - CVE-2019-2769: Better copies of CopiesList     (bsc#1141783).

  - CVE-2019-2786: More limited privilege usage     (bsc#1141787).

  - CVE-2019-7317: Improve PNG support options     (bsc#1141780).

  - CVE-2019-2818: Better Poly1305 support (bsc#1141788).

  - CVE-2019-2816: Normalize normalization (bsc#1141785).

  - CVE-2019-2821: Improve TLS negotiation (bsc#1141781).

  - Certificate validation improvements

Non-security issues fixed :

  - Do not fail installation when the manpages are not     present (bsc#1115375)

  - Backport upstream fix for JDK-8208602: Cannot read PEM     X.509 cert if there is whitespace after the header or     footer (bsc#1140461)

This update was imported from the SUSE:SLE-15:Update update project.

An update of the openjdk11 package has been released.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 231, 8 Update 221, 11 Update 4, or 12 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Unspecified vulnerabilities in the utilities and JCE     subcomponents of Oracle Java SE, which could allow an     unauthenticated remote attacker to cause a partial denial     of service. (CVE-2019-2762, CVE-2019-2769, CVE-2019-2842)

  - An unspecified vulnerability in the security subcomponent     of Oracle Java SE, which could allow an unauthenticated     local attacker to gain unauthorized access to critical Java     SE data. (CVE-2019-2745)

  - Unspecified vulnerabilities in the networking and security     subcomponents of Oracle Java SE, which could allow an     unauthenticated remote attacker to gain unauthorized     access to Java SE data. Exploitation of this vulnerability     requires user interaction.     (CVE-2019-2766, CVE-2019-2786, CVE-2019-2818)

  - An unspecified vulnerability in the networking subcomponent     of Oracle Java SE, which could allow an unauthenticated     remote attacker unauthorized read, update, insert or     delete access to Java SE data. (CVE-2019-2816)

  - An unspecified vulnerability in the JSSE subcomponent of     Oracle Java SE, which could allow an unauthenticated,     remote attacker to gain unauthorized access to critical     Java SE data. Exploitation of this vulnerability requires     user interaction. (CVE-2019-2821)

  - A use after free vulnerability exists in the libpng     subcomponent of Oracle Java SE. An unauthenticated,     remote attacker can exploit this to cause a complete     denial of service condition in Java SE. Exploitation     of this vulnerability requires user interaction.
    (CVE-2019-7317)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程主机上安装的 OpenJDK 版本为 7u221 或其之前的 7/8u212 或其之前的 8/11.0.3 或其之前的 11.0.0/12.0.1 或其之前的 12.0.0。因此，该应用程序受到 2019 年 7 月 16 日公告中提及的多个漏洞的影响。

请注意：Java CVE 并不总是包含 OpenJDK 版本，但会由 Tenable 使用 OpenJDK 安全公告中提及的修补程序版本进行单独确认。

  - 在 1.6.37 之前的 libpng 1.6.x 中，在 png.c 的 png_image_free 中存在释放后使用，这是在 png_safe_execute 中调用 png_image_free_function 所致。(CVE-2019-7317)

  - Oracle Java SE 的 Java SE 组件中存在漏洞（子组件：JSSE）。支持的版本中受影响的是 Java SE：11.0.3 和 12.0.1。难以利用的漏洞允许未经身份验证的攻击者通过 TLS 进行网络访问，从而破坏 Java SE。除攻击者以外的他人进行交互是实现成功攻击的必要条件。成功攻击此漏洞可导致在未经授权的情况下访问重要数据，或完整访问所有可供访问的 Java SE 数据。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞不适用于 Java 部署，通常在仅加载并运行可信代码（如管理员安装的代码）的服务器上。CVSS 3.0 基本分数 5.3（机密性影响）。CVSS 向量：
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)。(CVE-2019-2821)

  - Oracle Java SE 的 Java SE、Java SE Embedded 组件中存在漏洞（子组件：实用工具）。
    支持的版本中受影响的是 Java SE：7u221、8u212、11.0.3 和 12.0.1；Java SE Embedded：
    8u211。可轻松利用的漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Java SE、Java SE Embedded。成功利用此漏洞进行攻击可导致在未经授权的情况下造成 Java SE、Java SE Embedded 部分拒绝服务（部分 DOS）。
    注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞也可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。CVSS 3.0 基本分数 5.3（可用性影响）。CVSS 向量：
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)。（CVE-2019-2762、CVE-2019-2769）

  - Oracle Java SE 的 Java SE 组件中存在漏洞（子组件：Security）。支持的版本中受影响的是 Java SE：7u221、8u212 和 11.0.3。难以利用的漏洞允许未经身份验证的攻击者登录 Java SE 执行的基础结构，从而破坏 Java SE。
    成功攻击此漏洞可导致在未经授权的情况下访问重要数据，或完整访问所有可供访问的 Java SE 数据。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞也可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。CVSS 3.0 基本分数 5.1（机密性影响）。CVSS 向量：(CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)。(CVE-2019-2745)

  - Oracle Java SE 的 Java SE、Java SE Embedded 组件中存在漏洞（子组件：Networking）。
    支持的版本中受影响的是 Java SE：7u221、8u212、11.0.3 和 12.0.1；Java SE Embedded：
    8u211。难以利用的漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Java SE、Java SE Embedded。成功利用此漏洞进行攻击可导致在未经授权的情况下更新、插入或删除某些 Java SE、Java SE Embedded 可访问数据的访问权限，以及对 Java SE、Java SE Embedded 可访问数据子集进行未经授权的读取访问。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞也可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。CVSS 3.0 基本分数 4.8（机密性和完整性影响）。CVSS 向量：
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)。(CVE-2019-2816)

  - Oracle Java SE 的 Java SE 组件中存在漏洞（子组件：JCE）。支持的版本中受影响的是 Java SE：8u212。难以利用的漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Java SE。成功利用此漏洞进行攻击可导致在未经授权的情况下造成 Java SE 部分拒绝服务（部分 DOS）。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞也可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。CVSS 3.0 基本分数 3.7（可用性影响）。CVSS 向量：
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)。(CVE-2019-2842)

  - Oracle Java SE 的 Java SE、Java SE Embedded 组件中存在漏洞（子组件：Security）。
    支持的版本中受影响的是 Java SE：8u212、11.0.3 和 12.0.1；Java SE Embedded：8u211。
    难以利用的漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Java SE、Java SE Embedded。除攻击者以外的他人进行交互是实现成功攻击的必要条件，尽管漏洞存在于 Java SE、Java SE Embedded 中，但攻击也可能会严重影响其他产品。成功攻击此漏洞可导致对 Java SE、Java SE Embedded 可访问数据子集进行未经授权的读取访问。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞也可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。CVSS 3.0 基本分数 3.4（机密性影响）。CVSS 向量：
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)。(CVE-2019-2786)

  - Oracle Java SE 的 Java SE 组件中存在漏洞（子组件：Security）。支持的版本中受影响的是 Java SE：11.0.3 和 12.0.1。难以利用的漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Java SE。除攻击者以外的他人进行交互是实现成功攻击的必要条件。成功利用此漏洞进行攻击可导致对 Java SE 可访问数据子集进行未经授权的读取访问。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞不适用于 Java 部署，通常在仅加载并运行可信代码（如管理员安装的代码）的服务器上。CVSS 3.0 基本分数 3.1（机密性影响）。CVSS 向量：
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)。(CVE-2019-2818)

  - Oracle Java SE 的 Java SE、Java SE Embedded 组件中存在漏洞（子组件：Networking）。
    支持的版本中受影响的是 Java SE：7u221、8u212、11.0.3 和 12.0.1；Java SE Embedded：
    8u211。难以利用的漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Java SE、Java SE Embedded。除攻击者以外的他人进行交互是实现成功攻击的必要条件。成功攻击此漏洞可导致对 Java SE、Java SE Embedded 可访问数据子集进行未经授权的读取访问。注意：此漏洞适用于需加载并运行不可信代码（如来自互联网的代码）且安全性依赖于 Java 沙盒的 Java 部署，该部署通常在沙盒式 Java Web Start 应用程序或沙盒式 Java 小程序（在 Java SE 8 中）的客户端上。此漏洞也可通过使用指定组件中的 API 加以利用，如通过向 API 提供数据的 Web 服务。CVSS 3.0 基本分数 3.1（机密性影响）。CVSS 向量：(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)。(CVE-2019-2766)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

来自 Red Hat 安全公告 2019:1810： java-11-openjdk 的更新现在可用于 Red Hat Enterprise Linux 7。 Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 java-11-openjdk 程序包提供 OpenJDK 11 Java Runtime Environment 和 OpenJDK 11 Java 软件开发工具包。 安全补丁： * OpenJDK：椭圆曲线 (EC) 加密算法中存在边信道攻击风险 (Security, 8208698) (CVE-2019-2745) * OpenJDK：反序列化中阻止异常的检查不足 (Utilities, 8212328) (CVE-2019-2762) * OpenJDK：集合中反序列化期间的无限内存分配 (Utilities, 8213432) (CVE-2019-2769) * OpenJDK：缺少 URL 格式验证 (Networking, 8221518) (CVE-2019-2816) * OpenJDK：TLS 握手期间不正确的证书状态消息处理 (JSSE, 8222678) (CVE-2019-2821) * OpenJDK：AccessController 中的权限限制不足 (Security, 8216381) (CVE-2019-2786) * OpenJDK：在 ChaCha20Cipher 中，不固定的时间比较 (Security, 8221344) (CVE-2019-2818) 有关此安全问题的详细信息，包括其影响、CVSS 分数、致谢和其他相关信息，请参阅列于“参考”部分的 CVE 页面。

安全补丁：- OpenJDK: 椭圆曲线 (Elliptic Curve , EC) 加密中存在边信道攻击风险（安全, 8208698）(CVE-2019-2745) - OpenJDK: 对反序列化中的禁止异常检查不充分（实用工具，8212328）(CVE-2019-2762) - OpenJDK: 集合中的反序列化期间存在无限内存分配（实用工具，8213432）(CVE-2019-2769) - OpenJDK: 缺少 URL 格式验证（网络，8221518）(CVE-2019-2816) - OpenJDK: TLS 握手期间未正确处理证书状态消息 (JSSE, 8222678) (CVE-2019-2821) - OpenJDK: AccessController 权限限制不足（安全，8216381）(CVE-2019-2786) - OpenJDK: ChaCha20Cipher 非常量时间比较（安全，8221344）(CVE-2019-2818)

OpenJDK: AccessController 中权限限制不足（安全，8216381） (CVE-2019-2786) OpenJDK: 集合中的反序列化期间存在无限内存分配（实用工具，8213432） (CVE-2019-2769) libpng: 在 libpng 中，png.c 的 png_image_free 中存在释放后使用情形，这是因为在 png_safe_executee 下调用 png_image_free_function 所致。(CVE-2019-7317) OpenJDK: 对反序列化中的禁止异常检查不充分（实用工具，8212328）(CVE-2019-2762) OpenJDK: Windows 中的 file:// URL 权限检查不充分（网络，8213431）(CVE-2019-2766) OpenJDK: ChaCha20Cipher 非常量时间比较（安全，8221344）( CVE-2019-2818) OpenJDK: 缺少 URL 格式验证（网络，8221518） (CVE-2019-2816) OpenJDK: 椭圆曲线 (Elliptic Curve , EC) 加密中存在边信道攻击风险 （安全，8208698） (CVE-2019-2745) OpenJDK: TLS 握手期间未正确处理证书状态消息 (JSSE, 8222678) (CVE-2019-2821)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1810 advisory.

    [1:11.0.4.11-0.0.1]
    - link atomic for ix86 build

    [1:11.0.4.11-0]
    - Update to shenandoah-jdk-11.0.4+11 (GA)
    - Switch to GA mode for final release.
    - Resolves: rhbz#1724452

    [1:11.0.4.10-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+10 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.9-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+9 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.8-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+8 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.7-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+7 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Provide Javadoc debug subpackages for now, but populate them from the normal build.
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+6 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.5-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+5 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.4-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+4 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.3-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+3 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Use RHEL 7 format for jspawnhelper addition.
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+2 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.1.ea]
    - Package jspawnhelper (see JDK-8220360).
    - Resolves: rhbz#1724452

    [1:11.0.3.7-2]
    - Include 'ea' designator in Release when appropriate.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-2]
    - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-1]
    - Don't build the test images needlessly.
    - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
    - Don't perform a bootcycle build for the debug variant build.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - OpenJDK: Side-channel attack risks in Elliptic Curve     (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in     deserialization (Utilities, 8212328) (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during     deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Missing URL format validation (Networking,     8221518) (CVE-2019-2816)

  - OpenJDK: Incorrect handling of certificate status     messages during TLS handshake (JSSE, 8222678)     (CVE-2019-2821)

  - OpenJDK: Insufficient restriction of privileges in     AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Non-constant time comparison in ChaCha20Cipher     (Security, 8221344) (CVE-2019-2818)

OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

libpng: png_image_free in png.c in libpng has a use-after-free because png_image_free_function is called under png_safe_execute.
(CVE-2019-7317)

OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

OpenJDK: Insufficient permission checks for file:// URLs on Windows (Networking, 8213431) (CVE-2019-2766)

OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (

CVE-2019-2818)

OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678) (CVE-2019-2821)

An update of the openjdk8 package has been released.

The version of OpenJDK installed on the remote host is prior to 7 <= 7u221 / 8 <= 8u212 / 11.0.0 <= 11.0.3 / 12.0.0 <= 12.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019-07-16 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function     is called under png_safe_execute. (CVE-2019-7317)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JSSE). Supported versions that are     affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via TLS to compromise Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). (CVE-2019-2821)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that     are affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts). CVSS     Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2019-2745)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2019-2816)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that     is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2842)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security).
    Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). (CVE-2019-2786)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that     are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE. Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2818)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.1     (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2766)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
126989	CentOS 7：java-11-openjdk (CESA-2019:1810)	Nessus	CentOS Local Security Checks	2019/7/25	2025/2/25	medium
126989	CentOS 7 : java-11-openjdk (CESA-2019:1810)	Nessus	CentOS Local Security Checks	2019/7/25	2025/2/25	medium
128008	openSUSE Security Update : java-11-openjdk (openSUSE-2019-1916)	Nessus	SuSE Local Security Checks	2019/8/20	2025/2/24	medium
136109	Photon OS 1.0: Openjdk11 PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	2020/4/29	2024/3/14	critical
126820	Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU) (Unix)	Nessus	Misc.	2019/7/19	2025/2/25	medium
126821	Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Windows	2019/7/19	2025/2/25	medium
151215	OpenJDK 7 <= 7u221 / 8 <= 8u212 / 11.0.0 <= 11.0.3 / 12.0.0 <= 12.0.1 多个漏洞 (2019-07-16)	Nessus	Misc.	2021/7/7	2025/2/20	medium
126936	Oracle Linux 7 : java-11-openjdk (ELSA-2019-1810)	Nessus	Oracle Linux Local Security Checks	2019/7/23	2025/2/25	medium
126944	Scientific Linux 安全更新：SL7.x x86_64 中的 java-11-openjdk	Nessus	Scientific Linux Local Security Checks	2019/7/23	2025/2/25	medium
126958	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1246)	Nessus	Amazon Linux Local Security Checks	2019/7/24	2025/2/25	medium
126936	Oracle Linux 7 : java-11-openjdk (ELSA-2019-1810)	Nessus	Oracle Linux Local Security Checks	2019/7/23	2025/2/25	medium
126944	Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20190722)	Nessus	Scientific Linux Local Security Checks	2019/7/23	2025/2/25	medium
126958	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1246)	Nessus	Amazon Linux Local Security Checks	2019/7/24	2025/2/25	medium
128736	Photon OS 2.0: Openjdk8 PHSA-2019-2.0-0173	Nessus	PhotonOS Local Security Checks	2019/9/12	2025/2/24	medium
130102	Photon OS 3.0: Openjdk8 PHSA-2019-3.0-0035	Nessus	PhotonOS Local Security Checks	2019/10/22	2025/8/22	medium
151215	OpenJDK 7 <= 7u221 / 8 <= 8u212 / 11.0.0 <= 11.0.3 / 12.0.0 <= 12.0.1 Multiple Vulnerabilities (2019-07-16)	Nessus	Misc.	2021/7/7	2025/2/20	medium

偵測

搜尋 Plugin

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium