The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0809 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime     Environment and the OpenJDK 8 Java Software Development Kit.

    An off-by-one flaw, leading to a buffer overflow, was found in the font     parsing code in the 2D component in OpenJDK. A specially crafted font file     could possibly cause the Java Virtual Machine to execute arbitrary code,     allowing an untrusted Java application or applet to bypass Java sandbox     restrictions. (CVE-2015-0469)

    A flaw was found in the way the Hotspot component in OpenJDK handled     phantom references. An untrusted Java application or applet could use this     flaw to corrupt the Java Virtual Machine memory and, possibly, execute     arbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0460)

    A flaw was found in the way the JSSE component in OpenJDK parsed X.509     certificate options. A specially crafted certificate could cause JSSE to     raise an exception, possibly causing an application using JSSE to exit     unexpectedly. (CVE-2015-0488)

    Multiple flaws were discovered in the Beans and Hotspot components in     OpenJDK. An untrusted Java application or applet could use these flaws to     bypass certain Java sandbox restrictions. (CVE-2015-0477, CVE-2015-0470)

    A directory traversal flaw was found in the way the jar tool extracted JAR     archive files. A specially crafted JAR archive could cause jar to overwrite     arbitrary files writable by the user running jar when the archive was     extracted. (CVE-2005-1080, CVE-2015-0480)

    It was found that the RSA implementation in the JCE component in OpenJDK     did not follow recommended practices for implementing RSA signatures.
    (CVE-2015-0478)

    The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat     Product Security.

    All users of java-1.8.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

The remote host is affected by the vulnerability described in GLSA-201603-11 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK.  Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, and cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

Updated java-1.6.0-sun packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2005-1080, CVE-2015-0458, CVE-2015-0459, CVE-2015-0460, CVE-2015-0469, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0488, CVE-2015-0491)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 95 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

OpenJDK was updated to 2.5.5 - OpenJdk 7u79 to fix security issues and bugs :

The following vulnerabilities were fixed :

  - CVE-2015-0458: Deployment: unauthenticated remote     attackers could execute arbitrary code via multiple     protocols.

  - CVE-2015-0459: 2D: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0460: Hotspot: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0469: 2D: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0477: Beans: unauthenticated remote attackers     could update, insert or delete some JAVA accessible data     via multiple protocols

  - CVE-2015-0478: JCE: unauthenticated remote attackers     could read some JAVA accessible data via multiple     protocols

  - CVE-2015-0480: Tools: unauthenticated remote attackers     could update, insert or delete some JAVA accessible data     via multiple protocols and cause a partial denial of     service (partial DOS)

  - CVE-2015-0484: JavaFX: unauthenticated remote attackers     could read, update, insert or delete access some Java     accessible data via multiple protocols and cause a     partial denial of service (partial DOS).

  - CVE-2015-0488: JSSE: unauthenticated remote attackers     could cause a partial denial of service (partial DOS).

  - CVE-2015-0491: 2D: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

  - CVE-2015-0492: JavaFX: unauthenticated remote attackers     could execute arbitrary code via multiple protocols.

ID	名稱	產品	系列	已發布	已更新	嚴重性
82811	RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2015:0809)	Nessus	Red Hat Local Security Checks	2015/4/16	2025/9/10	medium
85031	Debian DSA-3316-1 : openjdk-7 - security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	2015/7/28	2022/12/5	low
89904	GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	2016/3/14	2022/12/5	low
82910	RHEL 5 / 6 / 7 : java-1.6.0-sun (RHSA-2015:0858)	Nessus	Red Hat Local Security Checks	2015/4/21	2019/10/24	critical
83106	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2015-331)	Nessus	SuSE Local Security Checks	2015/4/28	2021/1/19	critical

偵測

搜尋 Plugin

medium

low

low

critical

critical