This update for java-1_7_0-openjdk to version 7u231 fixes the following issues :

Security issues fixed :

CVE_2019-2426: Improve web server connections (bsc#1134297).

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2842: Extended AES support (bsc#1141786).

CVE-2019-7317: Improve PNG support (bsc#1141780).

CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE (bsc#1087082).

Certificate validation improvements

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_1-ibm fixes the following issues :

Update to Java 7.1 Service Refresh 4 Fix Pack 50.

Security issues fixed :

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).

CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).

CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).

CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).

CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed :

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).

CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).

CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).

CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).

CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).

CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the     APIs.(CVE-2019-2933)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all Java SE, Java SE Embedded     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted     code (e.g., code that comes from the internet) and rely     on the Java sandbox for security. This vulnerability     can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs.(CVE-2019-2958)

  - Vulnerability in the Java SE, Java SE Embedded     component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE:
    7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks require human interaction     from a person other than the attacker. Successful     attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java     SE Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs.(CVE-2019-2766)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 8u251, 11.0.7 and 14.0.1     Java SE Embedded: 8u251. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data.
    Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed     Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in     the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such     as through a web service.(CVE-2020-14581)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle     GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 7u291, 8u281, 11.0.10, 16 Java SE     Embedded: 8u281 Oracle GraalVM Enterprise Edition:
    19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or     modification access to critical data or all Java SE,     Java SE Embedded, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to     Java deployments that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. It can also be exploited     by supplying untrusted data to APIs in the specified     Component.(CVE-2021-2161)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openjdk11 package has been released.

ID	名稱	產品	系列	已發布	已更新	嚴重性
127758	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:2028-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/8/12	2022/12/6	medium
128628	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:2336-1)	Nessus	SuSE Local Security Checks	2019/9/10	2024/4/26	high
128872	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2019:2371-1)	Nessus	SuSE Local Security Checks	2019/9/16	2024/4/25	critical
153359	EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2021-2389)	Nessus	Huawei Local Security Checks	2021/9/14	2023/11/30	medium
136333	Photon OS 2.0: Openjdk11 PHSA-2020-2.0-0235	Nessus	PhotonOS Local Security Checks	2020/5/5	2024/7/23	high
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	2020/4/29	2024/7/24	critical

偵測

搜尋 Plugin

medium

high

critical

medium

high

critical