Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the bypass of Java sandbox restrictions, denial of service, arbitrary code execution, incorrect parsing of URLs/LDAP DNs or cryptographic timing side channel attacks.

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the bypass of Java sandbox restrictions, denial of service, arbitrary code execution, incorrect parsing or URLs/LDAP DNs or cryptoraphice timing side channel attacks.

For Debian 7 'Wheezy', these problems have been fixed in version 7u121-2.6.8-2~deb7u1.

We recommend that you upgrade your openjdk-7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0269 advisory.

    [1:1.7.0.131-2.6.9.0.0.1]
    - Add oracle-enterprise.patch
    - Fix DISTRO_NAME to 'Oracle Linux'

    [1:1.7.0.131-2.6.9.0]
    - Add blacklisted.certs to installation file list.
    - Resolves: rhbz#1410612

    [1:1.7.0.131-2.6.9.0]
    - Bump to 2.6.9 and u131b00.
    - Remove patch application debris in fsg.sh.
    - Re-generate RH1022017 against 2.6.9.
    - Resolves: rhbz#14106122

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - A vulnerability exists in the Libraries subcomponent,     known as SWEET32, in the 3DES and Blowfish algorithms     due to the use of weak 64-bit block ciphers by default.
    A man-in-the-middle attacker who has sufficient     resources can exploit this vulnerability, via a     'birthday' attack, to detect a collision that leaks the     XOR between the fixed secret and a known plaintext,     allowing the disclosure of the secret text, such as     secure HTTPS cookies, and possibly resulting in the     hijacking of an authenticated session. (CVE-2016-2183)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-5546)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2016-5547)

  - Multiple unspecified flaws exist in the Libraries     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5548, CVE-2016-5549)

  - An unspecified flaw exists in the Networking     subcomponent that allows an unauthenticated, remote     attacker to impact integrity. (CVE-2016-5552)

  - Multiple unspecified flaws exist in the Networking     subcomponent that allow an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3231, CVE-2017-3261)

  - An unspecified flaw exists in the RMI subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3241)

  - An unspecified flaw exists in the JAAS subcomponent that     allows an unauthenticated, remote attacker to impact     integrity. (CVE-2017-3252)

  - An unspecified flaw exists in the 2D subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3253)

  - An unspecified flaw exists in the Deployment     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-3259)

  - An unspecified flaw exists in the AWT subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-3260)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3272)

  - An unspecified flaw exists in the Hotspot subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-3289)

Note that CVE-2017-3241 can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.
Note that CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, and CVE-2017-3253 can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. They can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0) :

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvements

  - S8168724, CVE-2016-5549: ECDSA signing improvements

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3194-1 advisory.

    Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to     birthday attacks.

    A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions.
    This update moves those algorithms to the legacy algorithm set and causes them to be used only if no non-     legacy algorithms can be negotiated. (CVE-2016-2183)

    It was discovered that OpenJDK accepted ECSDA signatures using non-canonical DER encoding. An attacker     could use this to modify or expose sensitive data. (CVE-2016-5546)

    It was discovered that OpenJDK did not properly verify object identifier (OID) length when reading     Distinguished Encoding Rules (DER) records, as used in x.509 certificates and elsewhere. An attacker could     use this to cause a denial of service (memory consumption). (CVE-2016-5547)

    It was discovered that covert timing channel vulnerabilities existed in the DSA implementations in     OpenJDK. A remote attacker could use this to expose sensitive information. (CVE-2016-5548)

    It was discovered that the URLStreamHandler class in OpenJDK did not properly parse user information from     a URL. A remote attacker could use this to expose sensitive information. (CVE-2016-5552)

    It was discovered that the URLClassLoader class in OpenJDK did not properly check access control context     when downloading class files. A remote attacker could use this to expose sensitive information.
    (CVE-2017-3231)

    It was discovered that the Remote Method Invocation (RMI) implementation in OpenJDK performed     deserialization of untrusted inputs. A remote attacker could use this to execute arbitrary code.
    (CVE-2017-3241)

    It was discovered that the Java Authentication and Authorization Service (JAAS) component of OpenJDK did     not properly perform user search LDAP queries. An attacker could use a specially constructed LDAP entry to     expose or modify sensitive information. (CVE-2017-3252)

    It was discovered that the PNGImageReader class in OpenJDK did not properly handle iTXt and zTXt chunks.
    An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-3253)

    It was discovered that integer overflows existed in the SocketInputStream and SocketOutputStream classes     of OpenJDK. An attacker could use this to expose sensitive information. (CVE-2017-3261)

    It was discovered that the atomic field updaters in the java.util.concurrent.atomic package in OpenJDK did     not properly restrict access to protected field members. An attacker could use this to specially craft a     Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3272)

    It was discovered that a vulnerability existed in the class construction implementation in OpenJDK. An     attacker could use this to specially craft a Java application or applet that could bypass Java sandbox     restrictions. (CVE-2017-3289)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_7_0-openjdk fixes the following issues :

  - Oracle Critical Patch Update of January 2017 to OpenJDK     7u131 (bsc#1020905) :

  - Security Fixes

  - S8138725: Add options for Javadoc generation

  - S8140353: Improve signature checking

  - S8151934, CVE-2017-3231: Resolve class resolution

  - S8156804, CVE-2017-3241: Better constraint checking

  - S8158406: Limited Parameter Processing

  - S8158997: JNDI Protocols Switch

  - S8159507: RuntimeVisibleAnnotation validation

  - S8161218: Better bytecode loading

  - S8161743, CVE-2017-3252: Provide proper login context

  - S8162577: Standardize logging levels

  - S8162973: Better component components

  - S8164143, CVE-2017-3260: Improve components for menu     items

  - S8164147, CVE-2017-3261: Improve streaming socket output

  - S8165071, CVE-2016-2183: Expand TLS support

  - S8165344, CVE-2017-3272: Update concurrency support

  - S8166988, CVE-2017-3253: Improve image processing     performance

  - S8167104, CVE-2017-3289: Additional class construction     refinements

  - S8167223, CVE-2016-5552: URL handling improvements

  - S8168705, CVE-2016-5547: Better ObjectIdentifier     validation

  - S8168714, CVE-2016-5546: Tighten ECDSA validation

  - S8168728, CVE-2016-5548: DSA signing improvments

  - S8168724, CVE-2016-5549: ECDSA signing improvments

  - S6253144: Long narrowing conversion should describe the     algorithm used and implied 'risks'

  - S6328537: Improve javadocs for Socket class by adding     references to SocketOptions

  - S6978886: javadoc shows stacktrace after print error     resulting from disk full

  - S6995421: Eliminate the static dependency to     sun.security.ec.ECKeyFactory

  - S6996372: synchronizing handshaking hash

  - S7027045: (doc) java/awt/Window.java has several typos     in javadoc

  - S7054969: Null-check-in-finally pattern in java/security     documentation

  - S7072353: JNDI libraries do not build with javac
    -Xlint:all -Werror

  - S7075563: Broken link in 'javax.swing.SwingWorker'

  - S7077672: jdk8_tl nightly fail in step-2 build on     8/10/11

  - S7088502: Security libraries don't build with javac
    -Werror

  - S7092447: Clarify the default locale used in each locale     sensitive operation

  - S7093640: Enable client-side TLS 1.2 by default

  - S7103570: AtomicIntegerFieldUpdater does not work when     SecurityManager is installed

  - S7117360: Warnings in java.util.concurrent.atomic     package

  - S7117465: Warning cleanup for IMF classes

  - S7187144: JavaDoc for ScriptEngineFactory.getProgram()     contains an error

  - S8000418: javadoc should used a standard 'generated by     javadoc' string

  - S8000666: javadoc should write directly to Writer     instead of composing strings

  - S8000673: remove dead code from HtmlWriter and subtypes

  - S8000970: break out auxiliary classes that will prevent     multi-core compilation of the JDK

  - S8001669: javadoc internal DocletAbortException should     set cause when appropriate

  - S8008949: javadoc stopped copying doc-files

  - S8011402: Move blacklisting certificate logic from hard     code to data

  - S8011547: Update XML Signature implementation to Apache     Santuario 1.5.4

  - S8012288: XML DSig API allows wrong tag names and extra     elements in SignedInfo

  - S8016217: More javadoc warnings

  - S8017325: Cleanup of the javadoc <code> tag in     java.security.cert

  - S8017326: Cleanup of the javadoc <code> tag in     java.security.spec

  - S8019772: Fix doclint issues in javax.crypto and     javax.security subpackages

  - S8020557: javadoc cleanup in javax.security

  - S8020688: Broken links in documentation at     http://docs.oracle.com/javase/6/docs/api/index.

  - S8021108: Clean up doclint warnings and errors in     java.text package

  - S8021417: Fix doclint issues in java.util.concurrent

  - S8021833: javadoc cleanup in java.net

  - S8022120: JCK test     api/javax_xml/crypto/dsig/TransformService/index_ParamMe     thods fails

  - S8022175: Fix doclint warnings in javax.print

  - S8022406: Fix doclint issues in java.beans

  - S8022746: List of spelling errors in API doc

  - S8024779: [macosx] SwingNode crashes on exit

  - S8025085: [javadoc] some errors in javax/swing

  - S8025218: [javadoc] some errors in java/awt classes

  - S8025249: [javadoc] fix some javadoc errors in     javax/swing/

  - S8025409: Fix javadoc comments errors and warning     reported by doclint report

  - S8026021: more fix of javadoc errors and warnings     reported by doclint, see the description

  - S8037099: [macosx] Remove all references to GC from     native OBJ-C code

  - S8038184: XMLSignature throws     StringIndexOutOfBoundsException if ID attribute value is     empty String

  - S8038349: Signing XML with DSA throws Exception when key     is larger than 1024 bits

  - S8049244: XML Signature performance issue caused by     unbuffered signature data

  - S8049432: New tests for TLS property     jdk.tls.client.protocols

  - S8050893: (smartcardio) Invert reset argument in tests     in sun/security/smartcardio

  - S8059212: Modify regression tests so that they do not     just fail if no cardreader found

  - S8068279: (typo in the spec)     javax.script.ScriptEngineFactory.getLanguageName

  - S8068491: Update the protocol for references of     docs.oracle.com to HTTPS.

  - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java     needs to be updated for JDK-8061210

  - S8076369: Introduce the jdk.tls.client.protocols system     property for JDK 7u

  - S8139565: Restrict certificates with DSA keys less than     1024 bits

  - S8140422: Add mechanism to allow non default root CAs to     be not subject to algorithm restrictions

  - S8140587: Atomic*FieldUpdaters should use     Class.isInstance instead of direct class check

  - S8143959: Certificates requiring blacklisting

  - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks

  - S8148516: Improve the default strength of EC in JDK

  - S8149029: Secure validation of XML based digital     signature always enabled when checking wrapping attacks

  - S8151893: Add security property to configure XML     Signature secure validation mode

  - S8155760: Implement Serialization Filtering

  - S8156802: Better constraint checking

  - S8161228: URL objects with custom protocol handlers have     port changed after deserializing

  - S8161571: Verifying ECDSA signatures permits trailing     bytes

  - S8163304: jarsigner -verbose -verify should print the     algorithms used to sign the jar

  - S8164908: ReflectionFactory support for IIOP and custom     serialization

  - S8165230: RMIConnection addNotificationListeners failing     with specific inputs

  - S8166393: disabledAlgorithms property should not be     strictly parsed

  - S8166591: [macos 10.12] Trackpad scrolling of text on OS     X 10.12 Sierra is very fast (Trackpad, Retina only)

  - S8166739: Improve extensibility of ObjectInputFilter     information passed to the filter

  - S8166875: (tz) Support tzdata2016g

  - S8166878: Connection reset during TLS handshake

  - S8167356: Follow up fix for jdk8 backport of 8164143.
    Changes for CMenuComponent.m were missed

  - S8167459: Add debug output for indicating if a chosen     ciphersuite was legacy

  - S8167472: Chrome interop regression with JDK-8148516

  - S8167591: Add MD5 to signed JAR restrictions

  - S8168861: AnchorCertificates uses hard-coded password     for cacerts keystore

  - S8168993: JDK8u121 L10n resource file update

  - S8169191: (tz) Support tzdata2016i

  - S8169688: Backout (remove) MD5 from     jdk.jar.disabledAlgorithms for January CPU

  - S8169911: Enhanced tests for jarsigner -verbose -verify     after JDK-8163304

  - S8170131: Certificates not being blocked by     jdk.tls.disabledAlgorithms property

  - S8170268: 8u121 L10n resource file update - msgdrop 20

  - S8173622: Backport of 7180907 is incomplete

  - S8173849: Fix use of java.util.Base64 in test cases

  - S8173854: [TEST] Update DHEKeySizing test case following     8076328 & 8081760

  - CVE-2017-3259 Vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE.

  - Backports

  - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef     on __APPLE__and _LLP64 systems.

  - S8000351, PR3316, RH1390708: Tenuring threshold should     be unsigned

  - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never     deleted when processing invokeMethod command

  - S8170888, PR3316, RH1390708: [linux] support for cgroup     memory limits in container (ie Docker) environments

  - Bug fixes

  - PR3318: Replace 'infinality' with 'improved font     rendering' (--enable-improved-font-rendering)

  - PR3318: Fix compatibility with vanilla Fontconfig

  - PR3318: Fix glyph y advance

  - PR3318: Always round glyph advance in 26.6 space

  - PR3318: Simplify glyph advance handling

  - PR3324: Fix NSS_LIBDIR substitution in     make_generic_profile.sh broken by PR1989

  - AArch64 port

  - S8165673, PR3320: AArch64: Fix JNI floating point     argument handling</code></code>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.7.1-ibm is now available for Red Hat Satellite 5.7 and Red Hat Satellite 5.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP1.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231, CVE-2016-5547, CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3241, CVE-2017-3259, CVE-2016-5573, CVE-2016-5554, CVE-2016-5542, CVE-2016-5597, CVE-2016-5556, CVE-2016-3598, CVE-2016-3511, CVE-2016-0363, CVE-2016-0686, CVE-2016-0687, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449, CVE-2016-3422, CVE-2016-0376, CVE-2016-0264)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97067	Debian DSA-3782-1 : openjdk-7 - security update	Nessus	Debian Local Security Checks	2017/2/9	2026/1/1	critical
97105	Debian DLA-821-1 : openjdk-7 security update	Nessus	Debian Local Security Checks	2017/2/13	2026/1/1	critical
97139	Oracle Linux 5 / 6 / 7 : java-1.7.0-openjdk (ELSA-2017-0269)	Nessus	Oracle Linux Local Security Checks	2017/2/14	2024/10/22	critical
103190	AIX Java Advisory : java_jan2017_advisory.asc (January 2017 CPU) (SWEET32)	Nessus	AIX Local Security Checks	2017/9/13	2025/11/21	critical
96926	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:0346-1)	Nessus	SuSE Local Security Checks	2017/2/1	2026/1/2	critical
97084	Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-3194-1)	Nessus	Ubuntu Local Security Checks	2017/2/9	2024/8/27	critical
97296	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2017:0490-1)	Nessus	SuSE Local Security Checks	2017/2/21	2025/12/31	critical
100094	RHEL 6 : java-1.7.1-ibm (RHSA-2017:1216)	Nessus	Red Hat Local Security Checks	2017/5/10	2025/12/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical