The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0521 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP20.

    Security Fix(es):

    * OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962) (CVE-2018-2582)

    * OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606) (CVE-2018-2633)

    * OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600) (CVE-2018-2634)

    * OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998) (CVE-2018-2637)

    * OpenJDK: GTK library loading use-after-free (AWT, 8185325) (CVE-2018-2641)

    * OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449) (CVE-2018-2588)

    * OpenJDK: DnsClient missing source port randomization (JNDI, 8182125) (CVE-2018-2599)

    * OpenJDK: loading of classes from untrusted locations (I18n, 8182601) (CVE-2018-2602)

    * OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387) (CVE-2018-2603)

    * OpenJDK: insufficient strength of key agreement (JCE, 8185292) (CVE-2018-2618)

    * Oracle JDK: unspecified vulnerability fixed in 6u181 and 7u171 (Serialization) (CVE-2018-2657)

    * OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284)     (CVE-2018-2663)

    * OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289) (CVE-2018-2677)

    * OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142) (CVE-2018-2678)

    * OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525) (CVE-2018-2579)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0458 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP20.

    Security Fix(es):

    * OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962) (CVE-2018-2582)

    * OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606) (CVE-2018-2633)

    * OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600) (CVE-2018-2634)

    * OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998) (CVE-2018-2637)

    * OpenJDK: GTK library loading use-after-free (AWT, 8185325) (CVE-2018-2641)

    * OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449) (CVE-2018-2588)

    * OpenJDK: DnsClient missing source port randomization (JNDI, 8182125) (CVE-2018-2599)

    * OpenJDK: loading of classes from untrusted locations (I18n, 8182601) (CVE-2018-2602)

    * OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387) (CVE-2018-2603)

    * OpenJDK: insufficient strength of key agreement (JCE, 8185292) (CVE-2018-2618)

    * Oracle JDK: unspecified vulnerability fixed in 6u181 and 7u171 (Serialization) (CVE-2018-2657)

    * OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284)     (CVE-2018-2663)

    * OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289) (CVE-2018-2677)

    * OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142) (CVE-2018-2678)

    * OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525) (CVE-2018-2579)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_1-ibm fixes the following issues: The version was updated to 7.1.4.20 [bsc#1082810]

  - Security fixes :

  - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582     CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603     CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677     CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

  - Defect fixes :

  - IJ04281 Class Libraries: Startup time increase after     applying apar IV96905

  - IJ03822 Class Libraries: Update timezone information to     tzdata2017c

  - IJ03605 Java Virtual Machine: Legacy security for     com.ibm.jvm.dump, trace, log was not enabled by default

  - IJ03607 JIT Compiler: Result String contains a redundant     dot when converted from BigDecimal with 0 on all     platforms

  - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01

  - IJ04282 Security: Change in location and default of     jurisdiction policy files

  - IJ03853 Security: IBMCAC provider does not support     SHA224

  - IJ02679 Security: IBMPKCS11Impl -- Bad sessions are     being allocated internally

  - IJ02706 Security: IBMPKCS11Impl -- Bad sessions are     being allocated internally

  - IJ03552 Security: IBMPKCS11Impl -- Config file problem     with the slot specification attribute

  - IJ01901 Security: IBMPKCS11Impl --     SecureRandom.setSeed() exception

  - IJ03801 Security: Issue with same DN certs, iKeyman GUI     error with stash, JKS Chain issue and JVM argument parse     issue with iKeyman

  - IJ03256 Security: javax.security.auth.Subject.toString()     throws NPE

  - IJ02284 JIT Compiler: Division by zero in JIT compiler

  - SUSE fixes :

  - Make it possible to run Java jnlp files from Firefox.
    (bsc#1057460)

  - Fixed symlinks to policy files on update [bsc#1085018]

  - Fixed jpackage-java-1_7_1-ibm-webstart.desktop file to     allow Java jnlp files run from Firefox. [bsc#1057460,     bsc#1076390]

  - Fix javaws segfaults when java expiration timer has     elapsed. [bsc#929900]

  - Provide IBM Java updates for IBMs PMR 55931,671,760 and     for SUSEs SR 110991601735. [bsc#966304]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported     versions that are affected are Java SE: 6u171 and 7u161; JRockit: R28.3.16. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability can only be     exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start     applications or Untrusted Java applets, such as through a web service. (CVE-2018-2657)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
108362	RHEL 6 : java-1.7.1-ibm (RHSA-2018:0521)	Nessus	Red Hat Local Security Checks	2018/3/15	2025/3/24	high
107207	RHEL 7 : java-1.7.1-ibm (RHSA-2018:0458)	Nessus	Red Hat Local Security Checks	2018/3/8	2025/10/24	high
108400	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:0694-1)	Nessus	SuSE Local Security Checks	2018/3/16	2025/1/30	high
221819	Linux Distros Unpatched Vulnerability : CVE-2018-2657	Nessus	Misc.	2025/3/4	2026/8/3	medium

检测

插件搜索

high

high

high

medium