An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2019-2978)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13 Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2019-2988)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. While the     vulnerability is in Java SE, Java SE Embedded, attacks     may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all Java SE, Java SE Embedded     accessible data.(CVE-2019-2989)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13 Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2019-2992)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Javadoc). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE. Successful     attacks require human interaction from a person other     than the attacker and while the vulnerability is in     Java SE, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE     accessible data.(CVE-2019-2999)

  - Vulnerability in the Java SE component of Oracle Java     SE (subcomponent: JCE). The supported version that is     affected is Java SE: 8u212. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java     SE.(CVE-2019-2842)

  - Vulnerability in the Java SE, Java SE Embedded     component of Oracle Java SE (subcomponent: Security).
    Supported versions that are affected are Java SE:
    8u212, 11.0.3 and 12.0.1 Java SE Embedded: 8u211.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks require human interaction     from a person other than the attacker and while the     vulnerability is in Java SE, Java SE Embedded, attacks     may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java     SE Embedded accessible data.(CVE-2019-2786)

  - Vulnerability in the Java SE, Java SE Embedded     component of Oracle Java SE (subcomponent: Utilities).
    Supported versions that are affected are Java SE:
    7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:
    8u211. Easily exploitable vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2019-2762)

  - Vulnerability in the Java SE, Java SE Embedded     component of Oracle Java SE (subcomponent: Utilities).
    Supported versions that are affected are Java SE:
    7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:
    8u211. Easily exploitable vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2019-2769)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13 Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2019-2962)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Concurrency). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2019-2964)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JAXP). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13 Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2019-2973)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JAXP). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13 Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2019-2981)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all Java SE, Java SE Embedded     accessible data.(CVE-2019-2958)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2019-2945)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13 Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2019-2983)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - OpenJDK: Side-channel attack risks in Elliptic Curve     (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in     deserialization (Utilities, 8212328) (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during     deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Missing URL format validation (Networking,     8221518) (CVE-2019-2816)

  - OpenJDK: Missing array bounds check in crypto providers     (JCE, 8223511) (CVE-2019-2842)

  - OpenJDK: Insufficient restriction of privileges in     AccessController (Security, 8216381) (CVE-2019-2786)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1840 advisory.

    [1:1.7.0.231-2.6.19.1.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.231-2.6.19.1]
    - Add missing hyphen in tapset filename.
    - Resolves: rhbz#1724452

    [1:1.7.0.231-2.6.19.0]
    - Update tapset name in patch.
    - Resolves: rhbz#1724452

    [1:1.7.0.231-2.6.19.0]
    - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
    - Fix fsg.sh to fail if patching fails.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4080-1 advisory.

    Keegan Ryan discovered that the ECC implementation in OpenJDK was not sufficiently resilient to side-     channel attacks. An attacker could possibly use this to expose sensitive information. (CVE-2019-2745)

    It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing     suppressed exceptions in some situations. An attacker could use this to specially craft an object that,     when deserialized, would cause a denial of service. (CVE-2019-2762)

    It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated     during object deserialization. An attacker could use this to specially craft an object that, when     deserialized, would cause a denial of service (excessive memory consumption). (CVE-2019-2769)

    It was discovered that OpenJDK did not properly restrict privileges in certain situations. An attacker     could use this to specially construct an untrusted Java application or applet that could escape sandbox     restrictions. (CVE-2019-2786)

    Jonathan Birch discovered that the Networking component of OpenJDK did not properly validate URLs in some     situations. An attacker could use this to bypass restrictions on characters in URLs. (CVE-2019-2816)

    Nati Nimni discovered that the Java Cryptography Extension component in OpenJDK did not properly perform     array bounds checking in some situations. An attacker could use this to cause a denial of service.
    (CVE-2019-2842)

    It was discovered that OpenJDK incorrectly handled certain memory operations. If a user or automated     system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to     cause OpenJDK to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-7317)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note:
This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2019-2769)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2019-2816)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts).
CVSS Vector:
(CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2019-2745)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2019-2842)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).(CVE-2019-2786)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note:
This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2019-2762)

The remote NewStart CGSL host, running version MAIN 4.06, has java-1.7.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: JCE). The supported version that is     affected is Java SE: 8u212. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE. Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.7     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2842)

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: Security). Supported versions that are     affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult     to exploit vulnerability allows unauthenticated attacker     with logon to the infrastructure where Java SE executes     to compromise Java SE. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts).
    CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2019-2745)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Utilities). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a partial denial of service (partial DOS) of     Java SE, Java SE Embedded. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 5.3     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Networking). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. CVSS 3.0     Base Score 4.8 (Confidentiality and Integrity impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2019-2816)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Security). Supported     versions that are affected are Java SE: 8u212, 11.0.3     and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.4     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
    (CVE-2019-2786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: JCE). The supported version that is     affected is Java SE: 8u212. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE. Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.7     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2842)

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: Security). Supported versions that are     affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult     to exploit vulnerability allows unauthenticated attacker     with logon to the infrastructure where Java SE executes     to compromise Java SE. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts).
    CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2019-2745)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Utilities). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a partial denial of service (partial DOS) of     Java SE, Java SE Embedded. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 5.3     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Networking). Supported     versions that are affected are Java SE: 7u221, 8u212,     11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. CVSS 3.0     Base Score 4.8 (Confidentiality and Integrity impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2019-2816)

  - Vulnerability in the Java SE, Java SE Embedded component     of Oracle Java SE (subcomponent: Security). Supported     versions that are affected are Java SE: 8u212, 11.0.3     and 12.0.1; Java SE Embedded: 8u211. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.4     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
    (CVE-2019-2786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3938:03 advisory.

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)
      * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)
      * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)
      * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
      * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)
      * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)     (CVE-2019-2786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3939:04 advisory.

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)
      * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)
      * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)
      * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
      * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)
      * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)     (CVE-2019-2786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3940:03 advisory.

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)
      * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)
      * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)
      * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
      * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)
      * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)     (CVE-2019-2786)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
144227	Virtuozzo 7 : java-1.7.0-openjdk / etc (VZLSA-2019-1839)	Nessus	Virtuozzo Local Security Checks	2020/12/15	2022/5/11	medium
149149	EulerOS 2.0 SP3 : java-1.7.0-openjdk (EulerOS-SA-2021-1805)	Nessus	Huawei Local Security Checks	2021/4/30	2021/5/4	medium
126945	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20190722)	Nessus	Scientific Linux Local Security Checks	2019/7/23	2024/5/8	medium
126990	CentOS 6 : java-1.8.0-openjdk (CESA-2019:1811)	Nessus	CentOS Local Security Checks	2019/7/25	2022/5/19	medium
127031	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2019-1840)	Nessus	Oracle Linux Local Security Checks	2019/7/25	2024/10/22	medium
127797	Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-4080-1)	Nessus	Ubuntu Local Security Checks	2019/8/12	2024/8/27	medium
127809	Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2019-1811)	Nessus	Virtuozzo Local Security Checks	2019/8/12	2022/5/19	medium
128292	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2019-1269)	Nessus	Amazon Linux Local Security Checks	2019/8/28	2024/5/1	medium
128692	NewStart CGSL MAIN 4.06 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0175)	Nessus	NewStart CGSL Local Security Checks	2019/9/11	2022/5/19	medium
128697	NewStart CGSL MAIN 4.06 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0178)	Nessus	NewStart CGSL Local Security Checks	2019/9/11	2022/5/19	medium
288899	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.222.b10-0.AXS4 (AXSA:2019-3938:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
289012	MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.222.b10-0.el7 (AXSA:2019-3939:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
289415	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.231-2.6.19.1.AXS4 (AXSA:2019-3940:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium