The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-185:04 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-186:02 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2659
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-3149
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
289911	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.85-2.6.1.3.AXS4 (AXSA:2015-185:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	critical
291500	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.51-0.b16.AXS4 (AXSA:2015-186:02)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/2/5	critical

偵測

搜尋 Plugin

critical

critical