An insufficient bytecode verification flaw was discovered in the Hotspot component in OpenJDK. An untrusted Java application or applet could use this flaw to completely bypass Java sandbox restrictions.
(CVE-2016-3606)

Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500 , CVE-2016-3508)

Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458 , CVE-2016-3550)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions.
(CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610)

* Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508)

* Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1458 advisory.

    [1:1.8.0.101-3.b13]
    - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
    - Resolves: rhbz#1350034

    [1:1.8.0.101-2.b13]
    - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
    - Resolves: rhbz#1350034

    [1:1.8.0.101-1.b13]
    - Add workaround for a typo in the CORBA security fix, 8079718
    - Resolves: rhbz#1350034

    [1:1.8.0.101-0.b13]
    - Update to u101b13.
    - Backport REPOS option in generate_source_tarball.sh
    - Drop a leading zero from the priority as the update version is now three digits
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Add additional fixes (S6260348, S8159244) for u92 update.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Update ppc64le fix with upstream version, S8158260.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Add fix for ppc64le crash due to illegal instruction.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Add backport for S8148752.
    - Resolves: rhbz#1350034

    [1:1.8.0.92-0.b14]
    - Update to u92b14.
    - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
    - Add 8132051 Zero fix upstreamed as 8154210 in 8u112.
    - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
    - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
    - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
    - Resolves: rhbz#1350034

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 12 September 2016] This advisory has been updated to push packages into the Oracle Java for Red Hat Enterprise Linux 6 Compute Node channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.

This update upgrades Oracle Java SE 8 to version 8 Update 101.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.
Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2016-3458, CVE-2016-3498, CVE-2016-3500, CVE-2016-3503, CVE-2016-3508, CVE-2016-3511, CVE-2016-3550, CVE-2016-3552, CVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions.
(CVE-2016-3606, CVE-2016-3598, CVE-2016-3610)

* Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508)

* Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in breakouts of the Java sandbox or denial of service.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-644:03 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2016-3458     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;
    and Java SE Embedded 8u91 allows remote attackers to affect integrity     via vectors related to CORBA.
    CVE-2016-3500     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;
    Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to     affect availability via vectors related to JAXP, a different     vulnerability than CVE-2016-3508.
    CVE-2016-3508     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;
    Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to     affect availability via vectors related to JAXP, a different     vulnerability than CVE-2016-3500.
    CVE-2016-3550     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and     Java SE Embedded 8u91 allows remote attackers to affect     confidentiality via vectors related to Hotspot.
    CVE-2016-3606     Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE     Embedded 8u91 allows remote attackers to affect confidentiality,     integrity, and availability via vectors related to Hotspot.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-582:05 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2016-3458     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;
    and Java SE Embedded 8u91 allows remote attackers to affect integrity     via vectors related to CORBA.
    CVE-2016-3500     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;
    Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to     affect availability via vectors related to JAXP, a different     vulnerability than CVE-2016-3508.
    CVE-2016-3508     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;
    Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to     affect availability via vectors related to JAXP, a different     vulnerability than CVE-2016-3500.
    CVE-2016-3550     Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and     Java SE Embedded 8u91 allows remote attackers to affect     confidentiality via vectors related to Hotspot.
    CVE-2016-3598     Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded     8u91 allows remote attackers to affect confidentiality, integrity, and     availability via vectors related to Libraries, a different     vulnerability than CVE-2016-3610.
    CVE-2016-3606     Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE     Embedded 8u91 allows remote attackers to affect confidentiality,     integrity, and availability via vectors related to Hotspot.
    CVE-2016-3610     Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded     8u91 allows remote attackers to affect confidentiality, integrity, and     availability via vectors related to Libraries, a different     vulnerability than CVE-2016-3598.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Multiple flaws were discovered in the Hotspot and     Libraries components in OpenJDK. An untrusted Java     application or applet could use these flaws to     completely bypass Java sandbox restrictions.
    (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598,     CVE-2016-3610)

  - Multiple denial of service flaws were found in the JAXP     component in OpenJDK. A specially crafted XML file could     cause a Java application using JAXP to consume an     excessive amount of CPU and memory when parsed.
    (CVE-2016-3500, CVE-2016-3508)

  - Multiple flaws were found in the CORBA and Hotsport     components in OpenJDK. An untrusted Java application or     applet could use these flaws to bypass certain Java     sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)

Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 101, 7 Update 111, or 6 Update 121. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the CORBA subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-3458)

  - An unspecified flaw exists in the Networking     subcomponent that allows a local attacker to impact     integrity. (CVE-2016-3485)

  - An unspecified flaw exists in the JavaFX subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2016-3498)

  - An unspecified flaw exists in the JAXP subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3500)

  - An unspecified flaw exists in the Install subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3503)

  - An unspecified flaw exists in the JAXP subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3508)

  - An unspecified flaw exists in the Deployment     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-3511)

  - An unspecified flaw exists in the Hotspot subcomponent     that allows an unauthenticated, remote attacker to     disclose potentially sensitive information.
    (CVE-2016-3550)

  - An unspecified flaw exists in the Install subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3552)

  - A flaw exists in the Hotspot subcomponent due to     improper access to the MethodHandle::invokeBasic()     function. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2016-3587)

  - A flaw exists in the Libraries subcomponent within the     MethodHandles::dropArguments() function that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-3598)

  - A flaw exists in the Hotspot subcomponent within the     ClassVerifier::ends_in_athrow() function when handling     bytecode verification. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-3606)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2016-3610)

An update for java-1.6.0-openjdk is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit.

Security Fix(es) :

* An insufficient bytecode verification flaw was discovered in the Hotspot component in OpenJDK. An untrusted Java application or applet could use this flaw to completely bypass Java sandbox restrictions.
(CVE-2016-3606)

* Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508)

* Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)

The remote host is affected by the vulnerability described in GLSA-201701-43 (IcedTea: Multiple vulnerabilities)

    Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,       Libraries, and JAXP, exist which allows remote attackers to affect the       confidentiality, integrity, and availability of vulnerable systems. Many       of the vulnerabilities can only be exploited through sandboxed Java Web       Start applications and java applets. Please review the CVE identifiers       referenced below for details.
  Impact :

    Remote attackers may execute arbitrary code, compromise information, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93540	Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2016-748)	Nessus	Amazon Linux Local Security Checks	2016/9/16	2026/1/23	critical
92473	CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2016:1458)	Nessus	CentOS Local Security Checks	2016/7/21	2026/1/30	critical
92489	Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2016-1458)	Nessus	Oracle Linux Local Security Checks	2016/7/21	2024/10/22	critical
92508	RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:1475)	Nessus	Red Hat Local Security Checks	2016/7/22	2026/1/30	critical
92586	CentOS 5 / 6 / 7 : java-1.7.0-openjdk (CESA-2016:1504)	Nessus	CentOS Local Security Checks	2016/7/28	2026/1/30	critical
92604	RHEL 5 / 6 / 7 : java-1.7.0-openjdk (RHSA-2016:1504)	Nessus	Red Hat Local Security Checks	2016/7/28	2026/1/30	critical
92954	Debian DSA-3641-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	2016/8/15	2026/1/28	critical
289578	MiracleLinux 7 : java-1.6.0-openjdk-1.6.0.40-1.13.12.5.0.1.el7.AXS7 (AXSA:2016-644:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
289694	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.111-2.6.7.2.AXS4 (AXSA:2016-582:05)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
92490	RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2016:1458)	Nessus	Red Hat Local Security Checks	2016/7/21	2026/1/30	critical
92491	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x, SL7.x i386/x86_64 (20160720)	Nessus	Scientific Linux Local Security Checks	2016/7/21	2026/1/30	critical
92517	Oracle Java SE Multiple Vulnerabilities (July 2016 CPU) (Unix)	Nessus	Misc.	2016/7/22	2024/6/20	critical
92979	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-978)	Nessus	SuSE Local Security Checks	2016/8/16	2026/1/28	critical
93129	CentOS 5 / 6 / 7 : java-1.6.0-openjdk (CESA-2016:1776)	Nessus	CentOS Local Security Checks	2016/8/29	2021/1/4	critical
96640	GLSA-201701-43 : IcedTea: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/20	2026/1/5	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical