The version of IBM Java installed on the remote host is prior to 6.0 < 6.0.16.60 / 6.1 < 6.1.8.60 / 7.0 < 7.0.10.20 / 7.1 < 7.1.4.20 / 8.0 < 8.0.5.10. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 16 2018 CPU advisory.

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE     Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE     Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2018-2579)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).
    Supported versions that are affected are Java SE: 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2018-2582)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: LDAP).
    Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Easily exploitable vulnerability allows low privileged attacker with network access via     multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit     accessible data. Note: This vulnerability applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2018-2588)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE     Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial     DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2018-2599)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n). Supported     versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult     to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE,     Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2018-2602)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE     Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks     of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial     DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2018-2603)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE).
    Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java     SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2018-2618)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE     Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability     applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed     Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs     in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets,     such as through a web service. (CVE-2018-2633)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported     versions that are affected are Java SE: 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2018-2634)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX).
    Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or     complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can     only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web     Start applications or Untrusted Java applets, such as through a web service. (CVE-2018-2637)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions     that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks     may significantly impact additional products. Successful attacks of this vulnerability can result in     takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2018-2638, CVE-2018-2639)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported     versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult     to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2018-2641)

  - Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported     versions that are affected are Java SE: 6u171 and 7u161; JRockit: R28.3.16. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability can only be     exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start     applications or Untrusted Java applets, such as through a web service. (CVE-2018-2657)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent:
    Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE     Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE     Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such as through a web service. (CVE-2018-2663)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported     versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). (CVE-2018-2677)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can     be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be     exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start     applications or sandboxed Java applets, such as through a web service. (CVE-2018-2678)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u171,     7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to client and     server deployment of Java. This vulnerability can be     exploited through sandboxed Java Web Start applications     and sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2018-2678)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: AWT). Supported     versions that are affected are Java SE: 6u171, 7u161,     8u152 and 9.0.1; Java SE Embedded: 8u151. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS     3.0 Base Score 4.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2018-2677)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 6u171,     7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to client and     server deployment of Java. This vulnerability can be     exploited through sandboxed Java Web Start applications     and sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2018-2663)

  - It was discovered that multiple encryption key classes     in the Libraries component of OpenJDK did not properly     synchronize access to their internal data. This could     possibly cause a multi-threaded Java application to     apply weak encryption to data because of the use of a     key that was zeroed out. (CVE-2018-2579)

  - It was discovered that the LDAP component of OpenJDK     failed to properly encode special characters in user     names when adding them to an LDAP search query. A remote     attacker could possibly use this flaw to manipulate LDAP     queries performed by the LdapLoginModule class.
    (CVE-2018-2588)

  - It was discovered that the I18n component of OpenJDK     could use an untrusted search path when loading resource     bundle classes. A local attacker could possibly use this     flaw to execute arbitrary code as another local user by     making their Java application load an attacker     controlled class file. (CVE-2018-2602)

  - It was discovered that the DNS client implementation in     the JNDI component of OpenJDK did not use random source     ports when sending out DNS queries. This could make it     easier for a remote attacker to spoof responses to those     queries. (CVE-2018-2599)

  - It was discovered that the Libraries component of     OpenJDK failed to sufficiently limit the amount of     memory allocated when reading DER encoded input. A     remote attacker could possibly use this flaw to make a     Java application use an excessive amount of memory if it     parsed attacker supplied DER encoded input.
    (CVE-2018-2603)

  - It was discovered that the JGSS component of OpenJDK     failed to properly handle GSS context in the native GSS     library wrapper in certain cases. A remote attacker     could possibly make a Java application using JGSS to use     a previously freed context. (CVE-2018-2629)

  - It was discovered that the key agreement implementations     in the JCE component of OpenJDK did not guarantee     sufficient strength of used keys to adequately protect     generated shared secret. This could make it easier to     break data encryption by attacking key agreement rather     than the encryption using the negotiated secret.
    (CVE-2018-2618)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: AWT). Supported     versions that are affected are Java SE: 6u171, 7u161,     8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or     modification access to critical data or all Java SE,     Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability does     not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code     installed by an administrator). CVSS 3.0 Base Score 6.1     (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N).
    (CVE-2018-2641)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Hotspot). Supported     versions that are affected are Java SE: 8u152 and 9.0.1;
    Java SE Embedded: 8u151. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks require human     interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all Java SE, Java SE Embedded     accessible data. Note: This vulnerability applies to     client and server deployment of Java. This vulnerability     can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be     exploited by supplying data to APIs in the specified     Component without using sandboxed Java Web Start     applications or sandboxed Java applets, such as through     a web service. CVSS 3.0 Base Score 6.5 (Integrity     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
    (CVE-2018-2582)

  - The JGSS component of OpenJDK ignores the value of the     javax.security.auth.useSubjectCredsOnly property when     using HTTP/SPNEGO authentication and always uses global     credentials. It was discovered that this could cause     global credentials to be unexpectedly used by an     untrusted Java application. (CVE-2018-2634)

  - It was discovered that the JMX component of OpenJDK     failed to properly set the deserialization filter for     the SingleEntryRegistry in certain cases. A remote     attacker could possibly use this flaw to bypass intended     deserialization restrictions. (CVE-2018-2637)

  - It was discovered that the LDAPCertStore class in the     JNDI component of OpenJDK failed to securely handle LDAP     referrals. An attacker could possibly use this flaw to     make it fetch attacker controlled certificate data.
    (CVE-2018-2633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2516:01 advisory.

    * Multiple flaws were found in the Hotspot and AWT components of OpenJDK. An untrusted Java application or     applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2018-2582, CVE-2018-2641)
      * It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely     handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled     certificate data. (CVE-2018-2633)
      * The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly     property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that     this could cause global credentials to be unexpectedly used by an untrusted Java application.
    (CVE-2018-2634)
      * It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter     for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass     intended deserialization restrictions. (CVE-2018-2637)
      * It was discovered that the LDAP component of OpenJDK failed to properly encode special characters in     user names when adding them to an LDAP search query. A remote attacker could possibly use this flaw to     manipulate LDAP queries performed by the LdapLoginModule class. (CVE-2018-2588)
      * It was discovered that the DNS client implementation in the JNDI component of OpenJDK did not use     random source ports when sending out DNS queries. This could make it easier for a remote attacker to spoof     responses to those queries. (CVE-2018-2599)
      * It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading     resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as     another local user by making their Java application load an attacker controlled class file.
    (CVE-2018-2602)
      * It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of     memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a     Java application use an excessive amount of memory if it parsed attacker supplied DER encoded input.
    (CVE-2018-2603)
      * It was discovered that the key agreement implementations in the JCE component of OpenJDK did not     guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make     it easier to break data encryption by attacking key agreement rather than the encryption using the     negotiated secret. (CVE-2018-2618)
      * It was discovered that the JGSS component of OpenJDK failed to properly handle GSS context in the     native GSS library wrapper in certain cases. A remote attacker could possibly make a Java application     using JGSS to use a previously freed context. (CVE-2018-2629)
      * It was discovered that multiple classes in the Libraries, AWT, and JNDI components of OpenJDK did not     sufficiently validate input when creating object instances from the serialized form. A specially-crafted     input could cause a Java application to create objects with an inconsistent state or use an excessive     amount of memory when deserialized. (CVE-2018-2663, CVE-2018-2677, CVE-2018-2678)
      * It was discovered that multiple encryption key classes in the Libraries component of OpenJDK did not     properly synchronize access to their internal data. This could possibly cause a multi-threaded Java     application to apply weak encryption to data because of the use of a key that was zeroed out.
    (CVE-2018-2579)     Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via     Java applets could have been exploited without user interaction if a user visited a malicious website.
    CVE-2018-2579
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2582
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2588
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2599
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2602
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2603
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2618
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2629
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2633
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2634
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2637
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2641
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2663
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2677
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2018-2678
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0349 advisory.

    [1:1.7.0.171-2.6.13.0.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.171-2.6.13.0]
    - Bump to 2.6.13 and u171b01.
    - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080
    - Update RC4 patch (8076221/PR2809) to apply after 8148108 (DH lower limit increase)
    - Fix file path in rh1022017.patch.
    - Resolves: rhbz#1528233

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0351 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP10.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software     Development Kit. Further information about these flaws can be found on the IBM Java Security     Vulnerabilities page listed in the References section. (CVE-2018-2579, CVE-2018-2582, CVE-2018-2588,     CVE-2018-2599, CVE-2018-2602, CVE-2018-2603, CVE-2018-2618, CVE-2018-2633, CVE-2018-2634, CVE-2018-2637,     CVE-2018-2638, CVE-2018-2639, CVE-2018-2641, CVE-2018-2663, CVE-2018-2677, CVE-2018-2678)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0352 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP10.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software     Development Kit. Further information about these flaws can be found on the IBM Java Security     Vulnerabilities page listed in the References section. (CVE-2018-2579, CVE-2018-2582, CVE-2018-2588,     CVE-2018-2599, CVE-2018-2602, CVE-2018-2603, CVE-2018-2618, CVE-2018-2633, CVE-2018-2634, CVE-2018-2637,     CVE-2018-2638, CVE-2018-2639, CVE-2018-2641, CVE-2018-2663, CVE-2018-2677, CVE-2018-2678)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk fixes the following issues :

Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366) :

  - CVE-2018-2579: Improve key keying case

  - CVE-2018-2588: Improve LDAP logins

  - CVE-2018-2599: Improve reliability of DNS lookups

  - CVE-2018-2602: Improve usage messages

  - CVE-2018-2603: Improve PKCS usage

  - CVE-2018-2618: Stricter key generation

  - CVE-2018-2629: Improve GSS handling

  - CVE-2018-2633: Improve LDAP lookup robustness

  - CVE-2018-2634: Improve property negotiations

  - CVE-2018-2637: Improve JMX supportive features

  - CVE-2018-2641: Improve GTK initialization

  - CVE-2018-2663: More refactoring for deserialization     cases

  - CVE-2018-2677: More refactoring for client     deserialization cases

  - CVE-2018-2678: More refactoring for naming

This update was imported from the SUSE:SLE-12:Update update project.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, execution of arbitrary code, incorrect LDAP/GSS authentication, insecure use of cryptography or bypass of deserialisation restrictions.

The remote host is affected by the vulnerability described in GLSA-201803-06 (Oracle JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s Java SE.
      Please review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, gain access to information, or cause a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the AWT component of OpenJDK. An     untrusted Java application or applet could use this     flaw to bypass certain Java sandbox restrictions.
    (CVE-2018-2641)

  - It was discovered that the LDAPCertStore class in the     JNDI component of OpenJDK failed to securely handle     LDAP referrals. An attacker could possibly use this     flaw to make it fetch attacker controlled certificate     data. (CVE-2018-2633)

  - The JGSS component of OpenJDK ignores the value of the     javax.security.auth.useSubjectCredsOnly property when     using HTTP/SPNEGO authentication and always uses global     credentials. It was discovered that this could cause     global credentials to be unexpectedly used by an     untrusted Java application. (CVE-2018-2634)

  - It was discovered that the JMX component of OpenJDK     failed to properly set the deserialization filter for     the SingleEntryRegistry in certain cases. A remote     attacker could possibly use this flaw to bypass     intended deserialization restrictions. (CVE-2018-2637)

  - It was discovered that the LDAP component of OpenJDK     failed to properly encode special characters in user     names when adding them to an LDAP search query. A     remote attacker could possibly use this flaw to     manipulate LDAP queries performed by the     LdapLoginModule class. (CVE-2018-2588)

  - It was discovered that the DNS client implementation in     the JNDI component of OpenJDK did not use random source     ports when sending out DNS queries. This could make it     easier for a remote attacker to spoof responses to     those queries. (CVE-2018-2599)

  - It was discovered that the I18n component of OpenJDK     could use an untrusted search path when loading     resource bundle classes. A local attacker could     possibly use this flaw to execute arbitrary code as     another local user by making their Java application     load an attacker controlled class file. (CVE-2018-2602)

  - It was discovered that the Libraries component of     OpenJDK failed to sufficiently limit the amount of     memory allocated when reading DER encoded input. A     remote attacker could possibly use this flaw to make a     Java application use an excessive amount of memory if     it parsed attacker supplied DER encoded input.
    (CVE-2018-2603)

  - It was discovered that the key agreement     implementations in the JCE component of OpenJDK did not     guarantee sufficient strength of used keys to     adequately protect generated shared secret. This could     make it easier to break data encryption by attacking     key agreement rather than the encryption using the     negotiated secret. (CVE-2018-2618)

  - It was discovered that the JGSS component of OpenJDK     failed to properly handle GSS context in the native GSS     library wrapper in certain cases. A remote attacker     could possibly make a Java application using JGSS to     use a previously freed context. (CVE-2018-2629)

  - It was discovered that multiple classes in the     Libraries, AWT, and JNDI components of OpenJDK did not     sufficiently validate input when creating object     instances from the serialized form. A specially-crafted     input could cause a Java application to create objects     with an inconsistent state or use an excessive amount     of memory when deserialized. (CVE-2018-2663,     CVE-2018-2677, CVE-2018-2678)

  - It was discovered that multiple encryption key classes     in the Libraries component of OpenJDK did not properly     synchronize access to their internal data. This could     possibly cause a multi-threaded Java application to     apply weak encryption to data because of the use of a     key that was zeroed out. (CVE-2018-2579)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3613-1 advisory.

    It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker     could possibly use this to expose sensitive information. (CVE-2018-2579)

    It was discovered that the Hotspot component of OpenJDK did not properly validate uses of the     invokeinterface JVM instruction. An attacker could possibly use this to access unauthorized resources.
    (CVE-2018-2582)

    It was discovered that the LDAP implementation in OpenJDK did not properly encode login names. A remote     attacker could possibly use this to expose sensitive information. (CVE-2018-2588)

    It was discovered that the DNS client implementation in OpenJDK did not properly randomize source ports. A     remote attacker could use this to spoof responses to DNS queries made by Java applications.
    (CVE-2018-2599)

    It was discovered that the Internationalization component of OpenJDK did not restrict search paths when     loading resource bundle classes. A local attacker could use this to trick a user into running malicious     code. (CVE-2018-2602)

    It was discovered that OpenJDK did not properly restrict memory allocations when parsing DER input. A     remote attacker could possibly use this to cause a denial of service. (CVE-2018-2603)

    It was discovered that the Java Cryptography Extension (JCE) implementation in OpenJDK in some situations     did not guarantee sufficient strength of keys during key agreement. An attacker could use this to expose     sensitive information. (CVE-2018-2618)

    It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly handle     GSS contexts in the native GSS library. An attacker could possibly use this to access unauthorized     resources. (CVE-2018-2629)

    It was discovered that the LDAP implementation in OpenJDK did not properly handle LDAP referrals in some     situations. An attacker could possibly use this to expose sensitive information or gain unauthorized     privileges. (CVE-2018-2633)

    It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly apply     subject credentials. An attacker could possibly use this to expose sensitive information or gain access to     unauthorized resources. (CVE-2018-2634)

    It was discovered that the Java Management Extensions (JMX) component of OpenJDK did not properly apply     deserialization filters in some situations. An attacker could use this to bypass deserialization     restrictions. (CVE-2018-2637)

    It was discovered that a use-after-free vulnerability existed in the AWT component of OpenJDK when loading     the GTK library. An attacker could possibly use this to execute arbitrary code and escape Java sandbox     restrictions. (CVE-2018-2641)

    It was discovered that in some situations OpenJDK did not properly validate objects when performing     deserialization. An attacker could use this to cause a denial of service (application crash or excessive     memory consumption). (CVE-2018-2663)

    It was discovered that the AWT component of OpenJDK did not properly restrict the amount of memory     allocated when deserializing some objects. An attacker could use this to cause a denial of service     (excessive memory consumption). (CVE-2018-2677)

    It was discovered that the JNDI component of OpenJDK did not properly restrict the amount of memory     allocated when deserializing objects in some situations. An attacker could use this to cause a denial of     service (excessive memory consumption). (CVE-2018-2678)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0099 advisory.

    Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software     Development Kit.

    This update upgrades Oracle Java SE 8 to version 8 Update 161.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java     Software Development Kit. Further information about these flaws can be found on the Oracle Java SE     Critical Patch Update Advisory page listed in the References section. (CVE-2018-2579, CVE-2018-2581,     CVE-2018-2582, CVE-2018-2588, CVE-2018-2599, CVE-2018-2602, CVE-2018-2603, CVE-2018-2618, CVE-2018-2627,     CVE-2018-2629, CVE-2018-2633, CVE-2018-2634, CVE-2018-2637, CVE-2018-2638, CVE-2018-2639, CVE-2018-2641,     CVE-2018-2663, CVE-2018-2677, CVE-2018-2678)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: JNDI).
    Supported versions that are affected are Java SE: 6u171,     7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to client and     server deployment of Java. This vulnerability can be     exploited through sandboxed Java Web Start applications     and sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2018-2678)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: AWT). Supported     versions that are affected are Java SE: 6u171, 7u161,     8u152 and 9.0.1; Java SE Embedded: 8u151. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial     of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS     3.0 Base Score 4.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2018-2677)

  - Vulnerability in the Java SE, Java SE Embedded, JRockit     component of Oracle Java SE (subcomponent: Libraries).
    Supported versions that are affected are Java SE: 6u171,     7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151;
    JRockit: R28.3.16. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded, JRockit. Successful attacks require human     interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded,     JRockit. Note: This vulnerability applies to client and     server deployment of Java. This vulnerability can be     exploited through sandboxed Java Web Start applications     and sandboxed Java applets. It can also be exploited by     supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or     sandboxed Java applets, such as through a web service.
    CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2018-2663)

  - It was discovered that multiple encryption key classes     in the Libraries component of OpenJDK did not properly     synchronize access to their internal data. This could     possibly cause a multi-threaded Java application to     apply weak encryption to data because of the use of a     key that was zeroed out. (CVE-2018-2579)

  - It was discovered that the LDAP component of OpenJDK     failed to properly encode special characters in user     names when adding them to an LDAP search query. A remote     attacker could possibly use this flaw to manipulate LDAP     queries performed by the LdapLoginModule class.
    (CVE-2018-2588)

  - It was discovered that the I18n component of OpenJDK     could use an untrusted search path when loading resource     bundle classes. A local attacker could possibly use this     flaw to execute arbitrary code as another local user by     making their Java application load an attacker     controlled class file. (CVE-2018-2602)

  - It was discovered that the DNS client implementation in     the JNDI component of OpenJDK did not use random source     ports when sending out DNS queries. This could make it     easier for a remote attacker to spoof responses to those     queries. (CVE-2018-2599)

  - It was discovered that the Libraries component of     OpenJDK failed to sufficiently limit the amount of     memory allocated when reading DER encoded input. A     remote attacker could possibly use this flaw to make a     Java application use an excessive amount of memory if it     parsed attacker supplied DER encoded input.
    (CVE-2018-2603)

  - It was discovered that the JGSS component of OpenJDK     failed to properly handle GSS context in the native GSS     library wrapper in certain cases. A remote attacker     could possibly make a Java application using JGSS to use     a previously freed context. (CVE-2018-2629)

  - It was discovered that the key agreement implementations     in the JCE component of OpenJDK did not guarantee     sufficient strength of used keys to adequately protect     generated shared secret. This could make it easier to     break data encryption by attacking key agreement rather     than the encryption using the negotiated secret.
    (CVE-2018-2618)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: AWT). Supported     versions that are affected are Java SE: 6u171, 7u161,     8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or     modification access to critical data or all Java SE,     Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability does     not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code     installed by an administrator). CVSS 3.0 Base Score 6.1     (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N).
    (CVE-2018-2641)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Hotspot). Supported     versions that are affected are Java SE: 8u152 and 9.0.1;
    Java SE Embedded: 8u151. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks require human     interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all Java SE, Java SE Embedded     accessible data. Note: This vulnerability applies to     client and server deployment of Java. This vulnerability     can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be     exploited by supplying data to APIs in the specified     Component without using sandboxed Java Web Start     applications or sandboxed Java applets, such as through     a web service. CVSS 3.0 Base Score 6.5 (Integrity     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
    (CVE-2018-2582)

  - The JGSS component of OpenJDK ignores the value of the     javax.security.auth.useSubjectCredsOnly property when     using HTTP/SPNEGO authentication and always uses global     credentials. It was discovered that this could cause     global credentials to be unexpectedly used by an     untrusted Java application. (CVE-2018-2634)

  - It was discovered that the JMX component of OpenJDK     failed to properly set the deserialization filter for     the SingleEntryRegistry in certain cases. A remote     attacker could possibly use this flaw to bypass intended     deserialization restrictions. (CVE-2018-2637)

  - It was discovered that the LDAPCertStore class in the     JNDI component of OpenJDK failed to securely handle LDAP     referrals. An attacker could possibly use this flaw to     make it fetch attacker controlled certificate data.
    (CVE-2018-2633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the openjdk package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported     versions that are affected are Java SE: 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2018-2634)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
160344	IBM Java 6.0 < 6.0.16.60 / 6.1 < 6.1.8.60 / 7.0 < 7.0.10.20 / 7.1 < 7.1.4.20 / 8.0 < 8.0.5.10 Multiple Vulnerabilities	Nessus	Misc.	2022/4/29	2022/4/29	high
127375	NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0126)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
289510	MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.161-0.b14.el7 (AXSA:2018-2516:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
107014	Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2018-0349)	Nessus	Oracle Linux Local Security Checks	2018/2/27	2025/10/27	high
107018	RHEL 7 : java-1.8.0-ibm (RHSA-2018:0351)	Nessus	Red Hat Local Security Checks	2018/2/27	2025/10/27	high
107019	RHEL 6 : java-1.8.0-ibm (RHSA-2018:0352)	Nessus	Red Hat Local Security Checks	2018/2/27	2025/10/27	high
108357	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2018-256)	Nessus	SuSE Local Security Checks	2018/3/15	2025/1/30	high
108421	Debian DSA-4144-1 : openjdk-8 - security update	Nessus	Debian Local Security Checks	2018/3/19	2025/1/29	high
108432	GLSA-201803-06 : Oracle JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/3/19	2025/1/29	high
108463	EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2018-1059)	Nessus	Huawei Local Security Checks	2018/3/20	2025/1/28	high
108793	Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3613-1)	Nessus	Ubuntu Local Security Checks	2018/4/3	2024/8/27	high
106182	RHEL 7 : java-1.8.0-oracle (RHSA-2018:0099)	Nessus	Red Hat Local Security Checks	2018/1/19	2025/3/21	high
127170	NewStart CGSL MAIN 5.04 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0016)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
121802	Photon OS 1.0: Openjdk PHSA-2018-1.0-0101	Nessus	PhotonOS Local Security Checks	2019/2/7	2019/2/7	high
252129	Linux Distros Unpatched Vulnerability : CVE-2018-2634	Nessus	Misc.	2025/8/19	2026/8/3	medium

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium