The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 141, 7 Update 151, or 6 Update 161. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the 2D component that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-10053)

  - Multiple unspecified flaws exist in the Security     component that allow an unauthenticated, remote attacker     to execute arbitrary code. (CVE-2017-10067,     CVE-2017-10116)

  - An unspecified flaw exists in the Hotspot component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10074)

  - An unspecified flaw exists in the Scripting component     that allows an authenticated, remote attacker to impact     confidentiality and integrity. (CVE-2017-10078)

  - An unspecified flaw exists in the Hotspot component that     allows an unauthenticated, remote attacker to impact     integrity. (CVE-2017-10081)

  - Multiple unspecified flaws exist in the JavaFX component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10086, CVE-2017-10114)

  - Multiple unspecified flaws exist in the Libraries     component that allow an unauthenticated, remote attacker     to execute arbitrary code. (CVE-2017-10087,     CVE-2017-10090, CVE-2017-10111)

  - An unspecified flaw exists in the ImageIO component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10089)

  - Multiple unspecified flaws exist in the JAXP component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10096, CVE-2017-10101)

  - Multiple unspecified flaws exist in the RMI component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10102, CVE-2017-10107)

  - Multiple unspecified flaws exist in the Server component     of the Java Advanced Management Console that allow an     authenticated, remote attacker to impact     confidentiality, integrity, and availability.
    (CVE-2017-10104, CVE-2017-10145)

  - An unspecified flaw exists in the Deployment component     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2017-10105)

  - Multiple unspecified flaws exist in the Serialization     component that allow an unauthenticated, remote attacker     to exhaust available memory, resulting in a denial of     service condition. (CVE-2017-10108, CVE-2017-10109)

  - An unspecified flaw exists in the AWT component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10110)

  - Multiple unspecified flaws exist in the JCE component     that allow an unauthenticated, remote attacker to     disclose sensitive information. (CVE-2017-10115,     CVE-2017-10118, CVE-2017-10135)

  - An unspecified flaw exists in the Server component of     the Java Advanced Management Console that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-10117)

  - An unspecified flaw exists in the Server component of     the Java Advanced Management Console that allows an     unauthenticated, remote attacker to impact     confidentiality and integrity. (CVE-2017-10121)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to impact confidentiality,     integrity, and availability. (CVE-2017-10125)

  - Multiple unspecified flaws exist in the Security     component that allow an unauthenticated, remote attacker     to disclose sensitive information. (CVE-2017-10176,     CVE-2017-10193, CVE-2017-10198)

  - An unspecified flaw exists in the JAX-WS component that     allows an unauthenticated, remote attacker to impact     confidentiality and availability. (CVE-2017-10243)

An update for java-1.7.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 7 to version 7 Update 151.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2017-10053, CVE-2017-10067, CVE-2017-10074, CVE-2017-10081, CVE-2017-10086, CVE-2017-10087, CVE-2017-10089, CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102, CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109, CVE-2017-10110, CVE-2017-10114, CVE-2017-10115, CVE-2017-10116, CVE-2017-10118, CVE-2017-10135, CVE-2017-10176, CVE-2017-10193, CVE-2017-10198, CVE-2017-10243)

This update for java-1_7_1-ibm fixes the following issues :

  - Version update to 7.1-4.10 [bsc#1053431]

  - CVE-2017-10111 CVE-2017-10110 CVE-2017-10107     CVE-2017-10101 CVE-2017-10096 CVE-2017-10090     CVE-2017-10089 CVE-2017-10087 CVE-2017-10102     CVE-2017-10116 CVE-2017-10074 CVE-2017-10115     CVE-2017-10067 CVE-2017-10125 CVE-2017-10243     CVE-2017-10109 CVE-2017-10108 CVE-2017-10053     CVE-2017-10105 CVE-2017-10081: Multiple unspecified     vulnerabilities in multiple Java components could lead     to code execution or sandbox escape More information can     be found here:
    https://developer.ibm.com/javasdk/support/security-vulne     rabilities/#Oracle_ July_18_2017_CPU

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - A flaw exists in the J9 VM class verifier component that     allows an unauthenticated, remote attacker to cause an     escalation of privileges. (CVE-2017-1376)

  - A flaw exists in the installp and updatep packages that     prevents security updates from being correctly applied.
    (CVE-2017-1541)

  - An unspecified flaw exists in the 2D component that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-10053)

  - Multiple unspecified flaws exist in the Security     component that allow an unauthenticated, remote attacker     to execute arbitrary code. (CVE-2017-10067,     CVE-2017-10116)

  - An unspecified flaw exists in the Scripting component     that allows an authenticated, remote attacker to impact     confidentiality and integrity. (CVE-2017-10078)

  - Multiple unspecified flaws exist in the Libraries     component that allow an unauthenticated, remote attacker     to execute arbitrary code. (CVE-2017-10087,     CVE-2017-10090)

  - An unspecified flaw exists in the ImageIO component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10089)

  - Multiple unspecified flaws exist in the JAXP component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10096, CVE-2017-10101)

  - Multiple unspecified flaws exist in the RMI component     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-10102, CVE-2017-10107)

  - An unspecified flaw exists in the Deployment component     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2017-10105)

  - Multiple unspecified flaws exist in the Serialization     component that allow an unauthenticated, remote attacker     to exhaust available memory, resulting in a denial of     service condition. (CVE-2017-10108, CVE-2017-10109)

  - An unspecified flaw exists in the AWT component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10110)

  - Multiple unspecified flaws exist in the JCE component     that allow an unauthenticated, remote attacker to     disclose sensitive information. (CVE-2017-10115)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to impact confidentiality,     integrity, and availability. (CVE-2017-10125)

  - An unspecified flaw exists in the JAX-WS component that     allows an unauthenticated, remote attacker to impact     confidentiality and availability. (CVE-2017-10243)

An update of the openjdk package has been released.

遠端主機上安裝的 Oracle (前身為 Sun) Java SE 或 Java for Business 版本比 8 Update 141、7 Update 151 或 6 Update 161 舊。因此，會受到多個弱點影響：- 2D 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者造成拒絕服務情形。(CVE-2017-10053) - Security 元件存在多個不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10067、CVE-2017-10116) - Hotspot 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10074) - Scripting 元件中存在不明缺陷，其允許經驗證的遠端攻擊者影響機密性和完整性。(CVE-2017-10078) - Hotspot 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者影響完整性。(CVE-2017-10081) - JavaFX 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10086、CVE-2017-10114) - Libraries 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10087、CVE-2017-10090、CVE-2017-10111) - ImageIO 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10089) - JAXP 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10096、CVE-2017-10101) - RMI 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10102、CVE-2017-10107) - Java Advanced Management Console 的 Server 元件中存在多個不明缺陷，其允許經驗證的遠端攻擊者影響機密性、完整性與可用性。(CVE-2017-10104、CVE-2017-10145) - Deployment 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者影響完整性。(CVE-2017-10105) - Serialization 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者耗盡可用記憶體，從而造成拒絕服務情形。(CVE-2017-10108、CVE-2017-10109) - AWT 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者執行任意程式碼。(CVE-2017-10110) - JCE 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者洩漏敏感資訊。(CVE-2017-10115、CVE-2017-10118、CVE-2017-10135) - Java Advanced Management Console 的 Server 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者洩漏敏感資訊。(CVE-2017-10117) - Java Advanced Management Console 的 Server 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者影響機密性與完整性。(CVE-2017-10121) - Deployment 元件中存在不明缺陷，其允許本機攻擊者影響機密性、完整性和可用性。(CVE-2017-10125) - Security 元件中存在多個不明缺陷，其允許未經驗證的遠端攻擊者洩漏敏感資訊。(CVE-2017-10176, CVE-2017-10193, CVE-2017-10198) - JAX-WS 元件中存在不明缺陷，其允許未經驗證的遠端攻擊者影響機密性和可用性。(CVE-2017-10243)

遠端主機上安裝的 Oracle (前身為 Sun) Java SE 或 Java for Business 版本比 8 Update 141、7 Update 151 或 6 Update 161 舊。因此，會受到多個弱點影響：- 2D 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-10053) - Security 元件存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10067、CVE-2017-10116) - Hotspot 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10074) - Scripting 元件中存在不明缺陷，經驗證的遠端攻擊者可藉以影響機密性和完整性。(CVE-2017-10078) - Hotspot 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以影響完整性。(CVE-2017-10081) - JavaFX 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10086、CVE-2017-10114) - Libraries 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10087、CVE-2017-10090、CVE-2017-10111) - ImageIO 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10089) - JAXP 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10096、CVE-2017-10101) - RMI 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10102、CVE-2017-10107) - Java Advanced Management Console 的 Server 元件中存在多個不明缺陷，經驗證的遠端攻擊者可藉以影響機密性、完整性與可用性。(CVE-2017-10104、CVE-2017-10145) - Deployment 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以影響完整性。(CVE-2017-10105) - Serialization 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以耗盡可用記憶體，從而造成拒絕服務情形。(CVE-2017-10108、CVE-2017-10109) - AWT 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10110) - JCE 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以洩露敏感資訊。(CVE-2017-10115、CVE-2017-10118、CVE-2017-10135) - Java Advanced Management Console 的 Server 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以洩露敏感資訊。(CVE-2017-10117) - Java Advanced Management Console 的 Server 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以影響機密性與完整性。(CVE-2017-10121) - Deployment 元件中存在不明缺陷，本機攻擊者可藉以影響機密性、完整性和可用性。(CVE-2017-10125) - Security 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以洩露敏感資訊。(CVE-2017-10176、CVE-2017-10193、CVE-2017-10198) - JAX-WS 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以影響機密性和可用性。(CVE-2017-10243)

現已提供適用於 Oracle Java for Red Hat Enterprise Linux 6 和 Oracle Java for Red Hat Enterprise Linux 7 的 java-1.7.0-oracle 更新。Red Hat 產品安全性團隊已將此更新評等為具有重大安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Oracle Java SE 7 版包含 Oracle Java Runtime Environment 和 Oracle Java Software Development Kit。此更新會將 Oracle Java SE 7 升級至版本 7 Update 151。安全性修正：* 此更新可修正 Oracle Java Runtime Environment 和 Oracle Java Software Development Kit 中的多個弱點。如需這些缺陷的詳細資訊，請參閱 Oracle Java SE 重要修補程式更新公告頁面的＜參照＞一節內容。(CVE-2017-10053、CVE-2017-10067、CVE-2017-10074、CVE-2017-10081、CVE-2017-10086、CVE-2017-10087、CVE-2017-10089、CVE-2017-10090、CVE-2017-10096、CVE-2017-10101、CVE-2017-10102、CVE-2017-10105、CVE-2017-10107、CVE-2017-10108、CVE-2017-10109、CVE-2017-10110、CVE-2017-10114、CVE-2017-10115、CVE-2017-10116、CVE-2017-10118、CVE-2017-10135、CVE-2017-10176、CVE-2017-10193、CVE-2017-10198、CVE-2017-10243)

遠端 AIX 主機上安裝的 Java SDK 版本受到下列子元件中的多個弱點影響：- J9 VM class verifier 元件中存在一個缺陷，未經驗證的遠端攻擊者可藉以造成權限提升。(CVE-2017-1376) - installp 和 updatep 封包中存在一個缺陷，造成無法正確套用安全性更新。(CVE-2017-1541) - 2D 元件中存在一個不明缺陷，未經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-10053) - Security 元件存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10067、CVE-2017-10116) - Scripting 元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以影響機密性和完整性。(CVE-2017-10078) - Libraries 元件存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10087、CVE-2017-10090) - ImageIO 元件中存在一個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10089) - JAXP 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10096、CVE-2017-10101) - RMI 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10102, CVE-2017-10107) - Deployment 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以影響完整性。(CVE-2017-10105) - Serialization 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以耗盡可用記憶體，從而造成拒絕服務情形。(CVE-2017-10108、CVE-2017-10109) - AWT 元件中存在不明缺陷，未經驗證的遠端攻擊者可藉以執行任意程式碼。(CVE-2017-10110) - JCE 元件中存在多個不明缺陷，未經驗證的遠端攻擊者可藉以洩漏敏感資訊。(CVE-2017-10115) - Deployment 元件中存在一個不明缺陷，本機攻擊者可藉以影響機密性、完整性和可用性。(CVE-2017-10125) - JAX-WS 元件中存在一個不明缺陷，未經驗證的遠端攻擊者可藉以影響機密性和可用性。(CVE-2017-10243)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1792 advisory.

    Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software     Development Kit.

    This update upgrades Oracle Java SE 6 to version 6 Update 161.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java     Software Development Kit. Further information about these flaws can be found on the Oracle Java SE     Critical Patch Update Advisory page, listed in the References section. (CVE-2017-10053, CVE-2017-10067,     CVE-2017-10074, CVE-2017-10081, CVE-2017-10087, CVE-2017-10089, CVE-2017-10096, CVE-2017-10101,     CVE-2017-10102, CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109, CVE-2017-10110,     CVE-2017-10115, CVE-2017-10116, CVE-2017-10135, CVE-2017-10193, CVE-2017-10198, CVE-2017-10243)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This java-1_8_0-openjdk update to version jdk8u141 (icedtea 3.5.0) fixes the following issues: Security issues fixed :

  - CVE-2017-10053: Improved image post-processing steps     (bsc#1049305)

  - CVE-2017-10067: Additional jar validation steps     (bsc#1049306)

  - CVE-2017-10074: Image conversion improvements     (bsc#1049307)

  - CVE-2017-10078: Better script accessibility for     JavaScript (bsc#1049308)

  - CVE-2017-10081: Right parenthesis issue (bsc#1049309)

  - CVE-2017-10086: Unspecified vulnerability in     subcomponent JavaFX (bsc#1049310)

  - CVE-2017-10087: Better Thread Pool execution     (bsc#1049311)

  - CVE-2017-10089: Service Registration Lifecycle     (bsc#1049312)

  - CVE-2017-10090: Better handling of channel groups     (bsc#1049313)

  - CVE-2017-10096: Transform Transformer Exceptions     (bsc#1049314)

  - CVE-2017-10101: Better reading of text catalogs     (bsc#1049315)

  - CVE-2017-10102: Improved garbage collection     (bsc#1049316)

  - CVE-2017-10105: Unspecified vulnerability in     subcomponent deployment (bsc#1049317)

  - CVE-2017-10107: Less Active Activations (bsc#1049318)

  - CVE-2017-10108: Better naming attribution (bsc#1049319)

  - CVE-2017-10109: Better sourcing of code (bsc#1049320)

  - CVE-2017-10110: Better image fetching (bsc#1049321)

  - CVE-2017-10111: Rearrange MethodHandle arrangements     (bsc#1049322)

  - CVE-2017-10114: Unspecified vulnerability in     subcomponent JavaFX (bsc#1049323)

  - CVE-2017-10115: Higher quality DSA operations     (bsc#1049324)

  - CVE-2017-10116: Proper directory lookup processing     (bsc#1049325)

  - CVE-2017-10118: Higher quality ECDSA operations     (bsc#1049326)

  - CVE-2017-10125: Unspecified vulnerability in     subcomponent deployment (bsc#1049327)

  - CVE-2017-10135: Better handling of PKCS8 material     (bsc#1049328)

  - CVE-2017-10176: Additional elliptic curve support     (bsc#1049329)

  - CVE-2017-10193: Improve algorithm constraints     implementation (bsc#1049330)

  - CVE-2017-10198: Clear certificate chain connections     (bsc#1049331)

  - CVE-2017-10243: Unspecified vulnerability in     subcomponent JAX-WS (bsc#1049332) Bug fixes :

  - Check registry registration location

  - Improved certificate processing

  - JMX diagnostic improvements

  - Update to libpng 1.6.28

  - Import of OpenJDK 8 u141 build 15 (bsc#1049302) New     features :

  - Support using RSAandMGF1 with the SHA hash algorithms in     the PKCS11 provider

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of [openjdk,openjre,pycrypto,python3-pycrypto] packages for PhotonOS has been released.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3453 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP5.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Further information     about these flaws can be found on the IBM Java Security Vulnerabilities     page listed in the References section. (CVE-2016-9840, CVE-2016-9841,     CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-1289, CVE-2017-3509,     CVE-2017-3511, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544, CVE-2017-10053,     CVE-2017-10067, CVE-2017-10078, CVE-2017-10087, CVE-2017-10089,     CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102,     CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109,     CVE-2017-10110, CVE-2017-10115, CVE-2017-10116, CVE-2017-10243,     CVE-2017-10281, CVE-2017-10285, CVE-2017-10295, CVE-2017-10309,     CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348,     CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356,     CVE-2017-10357, CVE-2017-10388)

    For details on how to apply this update, which includes the changes     described in this advisory, refer to:

    https://access.redhat.com/articles/11258

    For this update to take effect, Red Hat Satellite must be restarted     (/usr/sbin/rhn-satellite restart). All running instances of IBM Java must     be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk fixes the following issues:
Security issues fixed :

  - CVE-2017-10356: Fix issue inside subcomponent Security     (bsc#1064084).

  - CVE-2017-10274: Fix issue inside subcomponent Smart Card     IO (bsc#1064071).

  - CVE-2017-10281: Fix issue inside subcomponent     Serialization (bsc#1064072).

  - CVE-2017-10285: Fix issue inside subcomponent RMI     (bsc#1064073).

  - CVE-2017-10295: Fix issue inside subcomponent Networking     (bsc#1064075).

  - CVE-2017-10388: Fix issue inside subcomponent Libraries     (bsc#1064086).

  - CVE-2017-10346: Fix issue inside subcomponent Hotspot     (bsc#1064078).

  - CVE-2017-10350: Fix issue inside subcomponent JAX-WS     (bsc#1064082).

  - CVE-2017-10347: Fix issue inside subcomponent     Serialization (bsc#1064079).

  - CVE-2017-10349: Fix issue inside subcomponent JAXP     (bsc#1064081).

  - CVE-2017-10345: Fix issue inside subcomponent     Serialization (bsc#1064077).

  - CVE-2017-10348: Fix issue inside subcomponent Libraries     (bsc#1064080).

  - CVE-2017-10357: Fix issue inside subcomponent     Serialization (bsc#1064085).

  - CVE-2017-10355: Fix issue inside subcomponent Networking     (bsc#1064083).

  - CVE-2017-10102: Fix incorrect handling of references in     DGC (bsc#1049316).

  - CVE-2017-10053: Fix reading of unprocessed image data in     JPEGImageReader (bsc#1049305).

  - CVE-2017-10067: Fix JAR verifier incorrect handling of     missing digest (bsc#1049306).

  - CVE-2017-10081: Fix incorrect bracket processing in     function signature handling (bsc#1049309).

  - CVE-2017-10087: Fix insufficient access control checks     in ThreadPoolExecutor (bsc#1049311).

  - CVE-2017-10089: Fix insufficient access control checks     in ServiceRegistry (bsc#1049312).

  - CVE-2017-10090: Fix insufficient access control checks     in AsynchronousChannelGroupImpl (bsc#1049313).

  - CVE-2017-10096: Fix insufficient access control checks     in XML transformations (bsc#1049314).

  - CVE-2017-10101: Fix unrestricted access to     com.sun.org.apache.xml.internal.resolver (bsc#1049315).

  - CVE-2017-10107: Fix insufficient access control checks     in ActivationID (bsc#1049318).

  - CVE-2017-10074: Fix integer overflows in range check     loop predicates (bsc#1049307).

  - CVE-2017-10110: Fix insufficient access control checks     in ImageWatched (bsc#1049321).

  - CVE-2017-10108: Fix unbounded memory allocation in     BasicAttribute deserialization (bsc#1049319).

  - CVE-2017-10109: Fix unbounded memory allocation in     CodeSource deserialization (bsc#1049320).

  - CVE-2017-10115: Fix unspecified vulnerability in     subcomponent JCE (bsc#1049324).

  - CVE-2017-10118: Fix ECDSA implementation timing attack     (bsc#1049326).

  - CVE-2017-10116: Fix LDAPCertStore following referrals to     non-LDAP URL (bsc#1049325).

  - CVE-2017-10135: Fix PKCS#8 implementation timing attack     (bsc#1049328).

  - CVE-2017-10176: Fix incorrect handling of certain EC     points (bsc#1049329).

  - CVE-2017-10074: Fix integer overflows in range check     loop predicates (bsc#1049307).

  - CVE-2017-10074: Fix integer overflows in range check     loop predicates (bsc#1049307).

  - CVE-2017-10111: Fix checks in LambdaFormEditor     (bsc#1049322).

  - CVE-2017-10243: Fix unspecified vulnerability in     subcomponent JAX-WS (bsc#1049332).

  - CVE-2017-10125: Fix unspecified vulnerability in     subcomponent deployment (bsc#1049327).

  - CVE-2017-10114: Fix unspecified vulnerability in     subcomponent JavaFX (bsc#1049323).

  - CVE-2017-10105: Fix unspecified vulnerability in     subcomponent deployment (bsc#1049317).

  - CVE-2017-10086: Fix unspecified in subcomponent JavaFX     (bsc#1049310).

  - CVE-2017-10198: Fix incorrect enforcement of certificate     path restrictions (bsc#1049331).

  - CVE-2017-10193: Fix incorrect key size constraint check     (bsc#1049330). Bug fixes :

  - Drop Exec Shield workaround to fix crashes on recent     kernels, where Exec Shield is gone (bsc#1052318).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openjdk8 package has been released.

The version of Oracle Java SE installed on the remote host is prior to 6 Update 161, 7 Update 151, or 8 Update 141, and is therefore affected by a flaw that is triggered during object deserialization. This may allow a remote attacker to exhaust available memory and potentially cause a crash. (CVE-2017-10108, CVE-2017-10109)

These versions of Java SE are also affected by multiple vulerabilities in the following components :

 2D (CVE-2017-10053), AWT (CVE-2017-10110), Deployment (CVE-2017-10105), Deployment (CVE-2017-10125), Hotspot (CVE-2017-10074, CVE-2017-10081), ImageIO (CVE-2017-10089), JAX-WS (CVE-2017-10243), JAXP (CVE-2017-10096, CVE-2017-10101), JCE (CVE-2017-10115, CVE-2017-10118, CVE-2017-10135), JavaFX (CVE-2017-10086, CVE-2017-10114), Libraries (CVE-2017-10087, CVE-2017-10090, CVE-2017-10111), RMI (CVE-2017-10102, CVE-2017-10107), Scripting (CVE-2017-10067, CVE-2017-10078), Security (CVE-2017-10116, CVE-2017-10176, CVE-2017-10193, CVE-2017-10198)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101843	Oracle Java SE Multiple Vulnerabilities (July 2017 CPU)	Nessus	Windows	2017/7/20	2024/12/20	critical
101844	Oracle Java SE Multiple Vulnerabilities (July 2017 CPU) (Unix)	Nessus	Misc.	2017/7/20	2024/6/20	critical
101881	RHEL 6 / 7 : java-1.7.0-oracle (RHSA-2017:1791)	Nessus	Red Hat Local Security Checks	2017/7/21	2021/3/11	critical
102837	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:2281-1)	Nessus	SuSE Local Security Checks	2017/8/30	2021/1/19	critical
103191	AIX Java Advisory : java_july2017_advisory.asc (July 2017 CPU)	Nessus	AIX Local Security Checks	2017/9/13	2023/4/21	critical
121718	Photon OS 1.0: Openjdk PHSA-2017-0026	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	critical
101843	Oracle Java SE 多個弱點 (2017 年 7 月 CPU)	Nessus	Windows	2017/7/20	2024/12/20	critical
101844	Oracle Java SE Multiple Vulnerabilities (July 2017 CPU) (Unix)	Nessus	Misc.	2017/7/20	2024/6/20	critical
101881	RHEL 6 / 7：java-1.7.0-oracle (RHSA-2017:1791)	Nessus	Red Hat Local Security Checks	2017/7/21	2021/3/11	critical
103191	AIX Java 公告：java_july2017_advisory.asc (2017 年 7 月 CPU)	Nessus	AIX Local Security Checks	2017/9/13	2023/4/21	critical
101882	RHEL 7 : java-1.6.0-sun (RHSA-2017:1792)	Nessus	Red Hat Local Security Checks	2017/7/21	2025/3/20	critical
102541	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)	Nessus	SuSE Local Security Checks	2017/8/17	2021/1/6	critical
111875	Photon OS 1.0: Openjdk / Openjre / Pycrypto / Python3 PHSA-2017-0026 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	critical
105267	RHEL 6 : java-1.8.0-ibm (RHSA-2017:3453)	Nessus	Red Hat Local Security Checks	2017/12/15	2025/4/15	critical
105538	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2018:0005-1)	Nessus	SuSE Local Security Checks	2018/1/4	2019/9/10	critical
203588	Photon OS 4.0: Openjdk8 PHSA-2023-4.0-0413	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	critical
700165	Oracle Java SE 6 < Update 161 / 7 < Update 151 / 8 < Update 141 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/7/26	2019/3/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical