This update for java-1_7_0-ibm provides the following fixes: The version was updated to 7.0.10.20 [bsc#1082810] :

  - Following security issues were fixed :

  - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582     CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603     CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677     CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

  - Defect fixes :

  - IJ04281 Class Libraries: Startup time increase after     applying apar IV96905

  - IJ03822 Class Libraries: Update timezone information to     tzdata2017c

  - IJ03605 Java Virtual Machine: Legacy security for     com.ibm.jvm.dump, trace, log was not enabled by default

  - IJ03607 JIT Compiler: Result String contains a redundant     dot when converted from BigDecimal with 0 on all     platforms

  - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01

  - IJ04282 Security: Change in location and default of     jurisdiction policy files

  - IJ03853 Security: IBMCAC provider does not support     SHA224

  - IJ02679 Security: IBMPKCS11Impl     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; Bad sessions     are being allocated internally

  - IJ02706 Security: IBMPKCS11Impl     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; Bad sessions     are being allocated internally

  - IJ03552 Security: IBMPKCS11Impl - Config file problem     with the slot specification attribute

  - IJ01901 Security: IBMPKCS11Impl     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147;
    SecureRandom.setSeed() exception

  - IJ03801 Security: Issue with same DN certs, iKeyman GUI     error with stash, JKS Chain issue and JVM argument parse     issue with iKeyman

  - IJ02284 JIT Compiler: Division by zero in JIT compiler

  - Make it possible to run Java jnlp files from Firefox.
    (bsc#1057460)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, execution of arbitrary code, incorrect LDAP/GSS authentication, insecure use of cryptography or bypass of deserialisation restrictions.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 9 Update 4, 8 Update 161, 7 Update 171, or 6 Update 181. It is, therefore, affected by multiple vulnerabilities related to the following components :

 - AWT
 - Deployment
 - Hotspot
 - I18n
 - Installer
 - JCE
 - JGSS
 - JMX
 - JNDI
 - JavaFX
 - LDAP
 - Libraries
 - Serialization

ID	名稱	產品	系列	已發布	已更新	嚴重性
107288	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0645-1)	Nessus	SuSE Local Security Checks	2018/3/12	2021/1/19	high
108853	Debian DSA-4166-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	2018/4/6	2018/11/13	high
700656	Oracle Java SE 6 < Update 181 / 7 < Update 171 / 8 < Update 161 / 9 < Update 4 Multiple Vulnerabilities (January 2018 CPU)	Nessus Network Monitor	Web Clients	2019/5/2	2019/5/2	high

偵測

搜尋 Plugin

high

high

high