This update for java-1_7_1-ibm fixes the following issues :

Update to Java 7.1 Service Refresh 4 Fix Pack 50.

Security issues fixed :

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).

CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).

CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).

CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).

CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.06, has java-1.7.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: JCE). The supported version that is     affected is Java SE: 8u212. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE. Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.7     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2842)

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: Security). Supported versions that are     affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult     to exploit vulnerability allows unauthenticated attacker     with logon to the infrastructure where Java SE executes     to compromise Java SE. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts).
    CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2019-2745)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Utilities). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a partial denial of service (partial DOS) of     Java SE, Java SE Embedded. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 5.3     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Networking). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. CVSS 3.0     Base Score 4.8 (Confidentiality and Integrity impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2019-2816)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Security). Supported     versions that are affected are Java SE: 8u212, 11.0.3     and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.4     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
    (CVE-2019-2786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: JCE). The supported version that is     affected is Java SE: 8u212. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE. Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.7     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2842)

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: Security). Supported versions that are     affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult     to exploit vulnerability allows unauthenticated attacker     with logon to the infrastructure where Java SE executes     to compromise Java SE. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts).
    CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2019-2745)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Utilities). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a partial denial of service (partial DOS) of     Java SE, Java SE Embedded. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 5.3     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Networking). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. CVSS 3.0     Base Score 4.8 (Confidentiality and Integrity impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2019-2816)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Security). Supported     versions that are affected are Java SE: 8u212, 11.0.3     and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.4     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
    (CVE-2019-2786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed :

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)

CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).

CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).

CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).

CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).

CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).

CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3940:03 advisory.

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)
      * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)
      * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)
      * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
      * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)
      * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)     (CVE-2019-2786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3938:03 advisory.

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)
      * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)
      * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)
      * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
      * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)
      * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)     (CVE-2019-2786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3939:04 advisory.

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)
      * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)
      * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)
      * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
      * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)
      * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)     (CVE-2019-2786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
128628	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:2336-1)	Nessus	SuSE Local Security Checks	2019/9/10	2024/4/26	high
128692	NewStart CGSL MAIN 4.06 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0175)	Nessus	NewStart CGSL Local Security Checks	2019/9/11	2022/5/19	medium
128697	NewStart CGSL MAIN 4.06 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0178)	Nessus	NewStart CGSL Local Security Checks	2019/9/11	2022/5/19	medium
128872	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2019:2371-1)	Nessus	SuSE Local Security Checks	2019/9/16	2024/4/25	critical
289415	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.231-2.6.19.1.AXS4 (AXSA:2019-3940:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
288899	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.222.b10-0.AXS4 (AXSA:2019-3938:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
289012	MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.222.b10-0.el7 (AXSA:2019-3939:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium

偵測

搜尋 Plugin

high

medium

medium

critical

medium

medium

medium