The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1458 advisory.

    [1:1.8.0.101-3.b13]
    - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
    - Resolves: rhbz#1350034

    [1:1.8.0.101-2.b13]
    - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
    - Resolves: rhbz#1350034

    [1:1.8.0.101-1.b13]
    - Add workaround for a typo in the CORBA security fix, 8079718
    - Resolves: rhbz#1350034

    [1:1.8.0.101-0.b13]
    - Update to u101b13.
    - Backport REPOS option in generate_source_tarball.sh
    - Drop a leading zero from the priority as the update version is now three digits
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Add additional fixes (S6260348, S8159244) for u92 update.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Update ppc64le fix with upstream version, S8158260.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Add fix for ppc64le crash due to illegal instruction.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Add backport for S8148752.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Update to u92b14.
    - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
    - Add 8132051 Zero fix upstreamed as 8154210 in 8u112.
    - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
    - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
    - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
    - Resolves: rhbz#1350034

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions.
(CVE-2016-3606, CVE-2016-3598, CVE-2016-3610)

* Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508)

* Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)

An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 12 September 2016] This advisory has been updated to push packages into the Oracle Java for Red Hat Enterprise Linux 6 Compute Node channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 8 to version 8 Update 101.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2016-3458, CVE-2016-3498, CVE-2016-3500, CVE-2016-3503, CVE-2016-3508, CVE-2016-3511, CVE-2016-3550, CVE-2016-3552, CVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)

An update for java-1.7.1-ibm is now available for Red Hat Satellite 5.7 and Red Hat Satellite 5.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP1.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3241, CVE-2017-3259, CVE-2016-5573, CVE-2016-5554, CVE-2016-5542, CVE-2016-5597, CVE-2016-5556, CVE-2016-3598, CVE-2016-3511, CVE-2016-0363, CVE-2016-0686, CVE-2016-0687, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449, CVE-2016-3422, CVE-2016-0376, CVE-2016-0264)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
92489	Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2016-1458)	Nessus	Oracle Linux Local Security Checks	2016/7/21	2024/10/22	critical
92604	RHEL 5 / 6 / 7 : java-1.7.0-openjdk (RHSA-2016:1504)	Nessus	Red Hat Local Security Checks	2016/7/28	2026/1/30	critical
92508	RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:1475)	Nessus	Red Hat Local Security Checks	2016/7/22	2026/1/30	critical
93281	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2016:2012-1)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	critical
100094	RHEL 6 : java-1.7.1-ibm (RHSA-2017:1216)	Nessus	Red Hat Local Security Checks	2017/5/10	2025/12/19	critical

检测

插件搜索

critical

critical

critical

critical

critical