The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2574-1 advisory.

    Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data     integrity and availability. An attacker could exploit these to cause a denial of service or expose     sensitive data over the network. (CVE-2015-0460, CVE-2015-0469)

    Alexander Cherepanov discovered that OpenJDK JRE was vulnerable to directory traversal issues with respect     to handling jar files. An attacker could use this to expose sensitive data. (CVE-2015-0480)

    Florian Weimer discovered that the RSA implementation in the JCE component in OpenJDK JRE did not follow     recommended practices for implementing RSA signatures. An attacker could use this to expose sensitive     data. (CVE-2015-0478)

    A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit     this expose sensitive data over the network. (CVE-2015-0477)

    A vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could exploit these     to cause a denial of service. (CVE-2015-0488)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0809 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime     Environment and the OpenJDK 8 Java Software Development Kit.

    An off-by-one flaw, leading to a buffer overflow, was found in the font     parsing code in the 2D component in OpenJDK. A specially crafted font file     could possibly cause the Java Virtual Machine to execute arbitrary code,     allowing an untrusted Java application or applet to bypass Java sandbox     restrictions. (CVE-2015-0469)

    A flaw was found in the way the Hotspot component in OpenJDK handled     phantom references. An untrusted Java application or applet could use this     flaw to corrupt the Java Virtual Machine memory and, possibly, execute     arbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0460)

    A flaw was found in the way the JSSE component in OpenJDK parsed X.509     certificate options. A specially crafted certificate could cause JSSE to     raise an exception, possibly causing an application using JSSE to exit     unexpectedly. (CVE-2015-0488)

    Multiple flaws were discovered in the Beans and Hotspot components in     OpenJDK. An untrusted Java application or applet could use these flaws to     bypass certain Java sandbox restrictions. (CVE-2015-0477, CVE-2015-0470)

    A directory traversal flaw was found in the way the jar tool extracted JAR     archive files. A specially crafted JAR archive could cause jar to overwrite     arbitrary files writable by the user running jar when the archive was     extracted. (CVE-2005-1080, CVE-2015-0480)

    It was found that the RSA implementation in the JCE component in OpenJDK     did not follow recommended practices for implementing RSA signatures.
    (CVE-2015-0478)

    The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat     Product Security.

    All users of java-1.8.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

The remote host is affected by the vulnerability described in GLSA-201603-11 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK.  Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, and cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
82992	Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-2574-1)	Nessus	Ubuntu Local Security Checks	2015/4/22	2024/8/27	medium
83063	Debian DSA-3235-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	2015/4/27	2021/1/11	critical
82811	RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2015:0809)	Nessus	Red Hat Local Security Checks	2015/4/16	2025/9/10	medium
85031	Debian DSA-3316-1 : openjdk-7 - security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	2015/7/28	2022/12/5	low
89904	GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	2016/3/14	2022/12/5	low

偵測

搜尋 Plugin

medium

critical

medium

low

low