Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

The remote host is affected by the vulnerability described in GLSA-201603-11 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK.  Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, and cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

Multiple flaws were discovered in the Beans and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-0477 , CVE-2015-0470)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080 , CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0809 advisory.

    [1:1.8.0.45-30.b13]
    - repacked sources
    - Resolves: RHBZ#1209076

    [1:1.8.0.45-7.b13]
    - Re-add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
    - Remove ppc64le test case now fix has been verified.
    - Resolves: rhbz#1194378

    [1:1.8.0.45-27.b13]
    - updated to security u45
    - minor sync with 7.2
     - generate_source_tarball.sh
     - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
     - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
     - family of 5XX patches renamed to 6XX
     - added upstreamed patch 501 and 505
     - included removeSunEcProvider-RH1154143.patch
    - returned java (jre only) provides
    - repacked policies (source20)
    - removed duplicated NVR provides
    - added automated test for priority (length7)
    - Resolves: RHBZ#1209076

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated java-1.8.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)

A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
(CVE-2015-0460)

A flaw was found in the way the JSSE component in OpenJDK parsed X.509 certificate options. A specially crafted certificate could cause JSSE to raise an exception, possibly causing an application using JSSE to exit unexpectedly. (CVE-2015-0488)

Multiple flaws were discovered in the Beans and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-0477, CVE-2015-0470)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. (CVE-2005-1080, CVE-2015-0480)

It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. (CVE-2015-0478)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.8.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

Updated java-1.8.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section.
(CVE-2005-1080, CVE-2015-0458, CVE-2015-0459, CVE-2015-0460, CVE-2015-0469, CVE-2015-0470, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0484, CVE-2015-0486, CVE-2015-0488, CVE-2015-0491, CVE-2015-0492)

The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.

All users of java-1.8.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 8 Update 45 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
83063	Debian DSA-3235-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	2015/4/27	2021/1/11	critical
85031	Debian DSA-3316-1 : openjdk-7 - security update (Bar Mitzvah) (Logjam)	Nessus	Debian Local Security Checks	2015/7/28	2022/12/5	low
89904	GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	2016/3/14	2022/12/5	low
83062	Debian DSA-3234-1 : openjdk-6 - security update	Nessus	Debian Local Security Checks	2015/4/27	2021/1/11	critical
83268	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2015-517)	Nessus	Amazon Linux Local Security Checks	2015/5/7	2018/4/18	critical
82789	Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2015-0809)	Nessus	Oracle Linux Local Security Checks	2015/4/15	2024/10/22	medium
82804	CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2015:0809)	Nessus	CentOS Local Security Checks	2015/4/16	2021/1/4	critical
82897	RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2015:0854)	Nessus	Red Hat Local Security Checks	2015/4/20	2019/10/24	critical

检测

插件搜索

critical

low

low

critical

critical

medium

critical

critical