The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1228 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime     Environment and the OpenJDK 8 Java Software Development Kit.

    Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI     components in OpenJDK. An untrusted Java application or applet could use     these flaws to bypass Java sandbox restrictions. (CVE-2015-4760,     CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

    A flaw was found in the way the Libraries component of OpenJDK verified     Online Certificate Status Protocol (OCSP) responses. An OCSP response with     no nextUpdate date specified was incorrectly handled as having unlimited     validity, possibly causing a revoked X.509 certificate to be interpreted as     valid. (CVE-2015-4748)

    It was discovered that the JCE component in OpenJDK failed to use constant     time comparisons in multiple cases. An attacker could possibly use these     flaws to disclose sensitive information by measuring the time used to     perform operations using these non-constant time comparisons.
    (CVE-2015-2601)

    It was discovered that the GCM (Galois Counter Mode) implementation in the     Security component of OpenJDK failed to properly perform a null check.
    This could cause the Java Virtual Machine to crash when an application     performed encryption using a block cipher in the GCM mode. (CVE-2015-2659)

    A flaw was found in the RC4 encryption algorithm. When using certain keys     for RC4 encryption, an attacker could obtain portions of the plain text     from the cipher text without the knowledge of the encryption key.
    (CVE-2015-2808)

    Note: With this update, OpenJDK now disables RC4 TLS/SSL cipher suites by     default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug     1207101, linked to in the References section, for additional details about     this change.

    A flaw was found in the way the TLS protocol composed the Diffie-Hellman     (DH) key exchange. A man-in-the-middle attacker could use this flaw to     force the use of weak 512 bit export-grade keys during the key exchange,     allowing them do decrypt all traffic. (CVE-2015-4000)

    Note: This update forces the TLS/SSL client implementation in OpenJDK to     reject DH key sizes below 768 bits, which prevents sessions to be     downgraded to export-grade keys. Refer to Red Hat Bugzilla bug 1223211,     linked to in the References section, for additional details about this     change.

    It was discovered that the JNDI component in OpenJDK did not handle DNS     resolutions correctly. An attacker able to trigger such DNS errors could     cause a Java application using JNDI to consume memory and CPU time, and     possibly block further DNS resolution. (CVE-2015-4749)

    Multiple information leak flaws were found in the JMX and 2D components in     OpenJDK. An untrusted Java application or applet could use this flaw to     bypass certain Java sandbox restrictions. (CVE-2015-2621, CVE-2015-2632)

    A flaw was found in the way the JSSE component in OpenJDK performed X.509     certificate identity verification when establishing a TLS/SSL connection to     a host identified by an IP address. In certain cases, the certificate was     accepted as valid if it was issued for a host name to which the IP address     resolves rather than for the IP address. (CVE-2015-2625)

    Multiple insecure temporary file use issues were found in the way the     Hotspot component in OpenJDK created performance statistics and error log     files. A local attacker could possibly make a victim using OpenJDK     overwrite arbitrary files using a symlink attack. Note: This issue was     originally fixed as CVE-2015-0383, but the fix was regressed in the     RHSA-2015:0809 advisory. (CVE-2015-3149)

    All users of java-1.8.0-openjdk are advised to upgrade to these updated     packages, which resolve these issues. All running instances of OpenJDK Java     must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-225:01 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2659
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-3149
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-186:02 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2659
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-3149
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

OpenJDK was updated to 2.6.1 - OpenJDK 8u51 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-2590: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2597: Easily exploitable vulnerability in the     Install component requiring logon to Operating System.
    Successful attack of this vulnerability could have     resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2601: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2613: Easily exploitable vulnerability in the     JCE component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java SE, Java SE Embedded     accessible data.

  - CVE-2015-2619: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2621: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2625: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized read     access to a subset of Java accessible data.

  - CVE-2015-2627: Very difficult to exploit vulnerability     in the Install component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized read access to a subset of Java     accessible data.

  - CVE-2015-2628: Easily exploitable vulnerability in the     CORBA component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-2632: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2637: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     read access to a subset of Java accessible data.

  - CVE-2015-2638: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-2659: Easily exploitable vulnerability in the     Security component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-2664: Difficult to exploit vulnerability in the     Deployment component requiring logon to Operating     System. Successful attack of this vulnerability could     have resulted in unauthorized Operating System takeover     including arbitrary code execution.

  - CVE-2015-2808: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java     accessible data.

  - CVE-2015-4000: Very difficult to exploit vulnerability     in the JSSE component allowed successful unauthenticated     network attacks via SSL/TLS. Successful attack of this     vulnerability could have resulted in unauthorized     update, insert or delete access to some Java accessible     data as well as read access to a subset of Java Embedded     accessible data. 

  - CVE-2015-4729: Very difficult to exploit vulnerability     in the Deployment component allowed successful     unauthenticated network attacks via multiple protocols.
    Successful attack of this vulnerability could have     resulted in unauthorized update, insert or delete access     to some Java SE accessible data as well as read access     to a subset of Java SE accessible data.

  - CVE-2015-4731: Easily exploitable vulnerability in the     JMX component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4732: Easily exploitable vulnerability in the     Libraries component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4733: Easily exploitable vulnerability in the     RMI component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

  - CVE-2015-4736: Difficult to exploit vulnerability in the     Deployment component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4748: Very difficult to exploit vulnerability     in the Security component allowed successful     unauthenticated network attacks via OCSP. Successful     attack of this vulnerability could have resulted in     unauthorized Operating System takeover including     arbitrary code execution.

  - CVE-2015-4749: Difficult to exploit vulnerability in the     JNDI component allowed successful unauthenticated     network attacks via multiple protocols. Successful     attack of this vulnerability could have resulted in     unauthorized ability to cause a partial denial of     service (partial DOS).

  - CVE-2015-4760: Easily exploitable vulnerability in the     2D component allowed successful unauthenticated network     attacks via multiple protocols. Successful attack of     this vulnerability could have resulted in unauthorized     Operating System takeover including arbitrary code     execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
84787	RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2015:1228)	Nessus	Red Hat Local Security Checks	2015/7/16	2025/4/15	critical
289889	MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.51-1.b16.el7 (AXSA:2015-225:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	critical
291500	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.51-0.b16.AXS4 (AXSA:2015-186:02)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/2/5	critical
85002	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2015-512) (Bar Mitzvah) (Logjam)	Nessus	SuSE Local Security Checks	2015/7/27	2022/12/5	low

检测

插件搜索

critical

critical

critical

low