The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3770-1 advisory.

    Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain files. An attacker could possibly     use this issue to cause a denial of service. (CVE-2016-10165)

    Quang Nguyen discovered that Little CMS incorrectly handled certain files. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2018-16435)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP15.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security Vulnerabilities page listed in the References section.
(CVE-2016-10165, CVE-2017-10281, CVE-2017-10285, CVE-2017-10295, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348, CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357, CVE-2017-10388)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. (CVE-2016-5582)

* It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application. (CVE-2016-5573)

* It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification.
This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2016-5542)

Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms.

* A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554)

* A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication.
(CVE-2016-5597)

Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively.

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 9 Update 1, 8 Update 151, 7 Update 161, or 6 Update 171. It is, therefore, affected by multiple vulnerabilities related to the following components :

  - 2D (Little CMS 2)
  - Deployment
  - Hotspot
  - JAX-WS
  - JAXP
  - Javadoc
  - Libraries
  - Networking
  - RMI
  - Security
  - Serialization
  - Smart Card IO
  - Util (zlib)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3453 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM     Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP5.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in the IBM Java Runtime     Environment and the IBM Java Software Development Kit. Further information     about these flaws can be found on the IBM Java Security Vulnerabilities     page listed in the References section. (CVE-2016-9840, CVE-2016-9841,     CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-1289, CVE-2017-3509,     CVE-2017-3511, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544, CVE-2017-10053,     CVE-2017-10067, CVE-2017-10078, CVE-2017-10087, CVE-2017-10089,     CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102,     CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109,     CVE-2017-10110, CVE-2017-10115, CVE-2017-10116, CVE-2017-10243,     CVE-2017-10281, CVE-2017-10285, CVE-2017-10295, CVE-2017-10309,     CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348,     CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356,     CVE-2017-10357, CVE-2017-10388)

    For details on how to apply this update, which includes the changes     described in this advisory, refer to:

    https://access.redhat.com/articles/11258

    For this update to take effect, Red Hat Satellite must be restarted     (/usr/sbin/rhn-satellite restart). All running instances of IBM Java must     be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues: Security issues fixed :

  - Security update to version 8.0.5.5 (bsc#1070162)

  - CVE-2017-10346 CVE-2017-10285 CVE-2017-10388     CVE-2017-10309 CVE-2017-10356 CVE-2017-10293     CVE-2016-9841 CVE-2016-10165 CVE-2017-10355     CVE-2017-10357 CVE-2017-10348 CVE-2017-10349     CVE-2017-10347 CVE-2017-10350 CVE-2017-10281     CVE-2017-10295 CVE-2017-10345

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
117631	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Little CMS vulnerabilities (USN-3770-1)	Nessus	Ubuntu Local Security Checks	2018/9/21	2024/8/27	high
104840	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2017:3268)	Nessus	Red Hat Local Security Checks	2017/11/29	2025/11/13	critical
94140	CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2016:2079)	Nessus	CentOS Local Security Checks	2016/10/20	2021/1/4	critical
94150	RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2016:2079)	Nessus	Red Hat Local Security Checks	2016/10/20	2026/1/21	critical
103964	Oracle Java SE Multiple Vulnerabilities (October 2017 CPU) (Unix)	Nessus	Misc.	2017/10/19	2024/6/20	critical
105267	RHEL 6 : java-1.8.0-ibm (RHSA-2017:3453)	Nessus	Red Hat Local Security Checks	2017/12/15	2025/4/15	critical
105462	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:3411-1)	Nessus	SuSE Local Security Checks	2017/12/26	2025/11/10	critical

检测

插件搜索

high

critical

critical

critical

critical

critical

critical