An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2422)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0416 advisory.

    - Re-generate patches (mostly due to upstream build changes)
      - JDK-8073139/PR1758/RH1191652
      - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
      - JDK-8199936/PR3533
      - JDK-8199936/PR3591
      - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
      - PR3593 (due to JDK-8081202)
      - RH1566890/CVE-2018-3639 (due to JDK-8189170)
      - RH1649664 (due to JDK-8196516)
      - RH1649731

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-3841:02 advisory.

    [Security Fix]
    - Oracle Java SE  (Libraries)     Java SE

    (CVE-2019-2422)     CVEJVNhttp://jvndb.jvn.jp/

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has java-1.7.0-openjdk packages installed that are affected by a vulnerability:

  - Vulnerability in the Java SE component of Oracle Java SE     (subcomponent: Libraries). Supported versions that are     affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE     Embedded: 8u191. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise Java SE. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS     3.0 Base Score 3.1 (Confidentiality impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
    (CVE-2019-2422)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0436 advisory.

    [1:11.0.2.7-0.0.1]
    - link atomic for ix86 build

    [1:11.0.2.7-0]
    - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
    - Make tagsuffix optional and comment it out while unused.
    - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
    - Drop JDK-8209639/RH1640127 applied upstream.
    - Re-generate JDK-8210416/RH1632174 following JDK-8209786
    - Resolves: rhbz#1661577

    [1:11.0.1.13-4]
    - Update to shenandoah-jdk-11.0.1+13-20190101
    - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
    - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
    - Fix remove-intree-libraries.sh to not exit early and skip SunEC handling.
    - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
    - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
    - Resolves: rhbz#1661577

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0416 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for java-1_7_1-ibm to version 7.1.4.40 fixes the following issues :

Security issues fixed :

CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).

CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).

More information:
https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IB M_Sec urity_Update_February_2019

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openjdk11 package has been released.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0640 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR5-FP30.

    Security Fix(es):

    * IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)

    * IBM JDK: missing null check when accelerating Unsafe calls (CVE-2018-12549)

    * OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

    * libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

    * Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment) (CVE-2019-2449)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues :

Security issues fixed :

CVE-2019-2422: Better FileChannel transfer performance (bsc#1122293)

CVE-2019-2426: Improve web server connections

CVE-2018-11212: Improve JPEG processing (bsc#1122299)

Better route routing

Better interface enumeration

Better interface lists

Improve BigDecimal support

Improve robot support

Better icon support

Choose printer defaults

Proper allocation handling

Initial class initialization

More reliable p11 transactions

Improve NIO stability

Better loading of classloader classes

Strengthen Windows Access Bridge Support

Improved data set handling

Improved LSA authentication

Libsunmscapi improved interactions

Non-security issues fix: Do not resolve by default the added JavaEE modules (bsc#1120431)

~2.5% regression on compression benchmark starting with 12-b11

java.net.http.HttpClient hangs on 204 reply without Content-length 0

Add additional TeliaSonera root certificate

Add more ld preloading related info to hs_error file on Linux

Add test to exercise server-side client hello processing

AES encrypt performance regression in jdk11b11

AIX: ProcessBuilder: Piping between created processes does not work.

AIX: Some class library files are missing the Classpath exception

AppCDS crashes for some uses with JRuby

Automate vtable/itable stub size calculation

BarrierSetC1::generate_referent_check() confuses register allocator

Better HTTP Redirection

Catastrophic size_t underflow in BitMap::*_large methods

Clip.isRunning() may return true after Clip.stop() was called

Compiler thread creation should be bounded by available space in memory and Code Cache

com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code

Default mask register for avx512 instructions

Delayed starting of debugging via jcmd

Disable all DES cipher suites

Disable anon and NULL cipher suites

Disable unsupported GCs for Zero

Epsilon alignment adjustments can overflow max TLAB size

Epsilon elastic TLAB sizing may cause misalignment

HotSpot update for vm_version.cpp to recognise updated VS2017

HttpClient does not retrieve files with large sizes over HTTP/1.1

IIOException 'tEXt chunk length is not proper' on opening png file

Improve TLS connection stability again

InitialDirContext ctor sometimes throws NPE if the server has sent a disconnection

Inspect stack during error reporting

Instead of circle rendered in appl window, but ellipse is produced JEditor Pane

Introduce diagnostic flag to abort VM on failed JIT compilation

Invalid assert(HeapBaseMinAddress > 0) in ReservedHeapSpace::initialize_compressed_heap

jar has issues with UNC-path arguments for the jar -C parameter [windows]

java.net.http HTTP client should allow specifying Origin and Referer headers

java.nio.file.Files.writeString writes garbled UTF-16 instead of UTF-8

JDK 11.0.1 l10n resource file update

JDWP Transport Listener: dt_socket thread crash

JVMTI ResourceExhausted should not be posted in CompilerThread

LDAPS communication failure with jdk 1.8.0_181

linux: Poor StrictMath performance due to non-optimized compilation

Missing synchronization when reading counters for live threads and peak thread count

NPE in SupportedGroupsExtension

OpenDataException thrown when constructing CompositeData for StackTraceElement

Parent class loader may not have a referred ClassLoaderData instance when obtained in Klass::class_in_module_of_loader

Populate handlers while holding streamHandlerLock

ppc64: Enable POWER9 CPU detection

print_location is not reliable enough (printing register info)

Reconsider default option for ClassPathURLCheck change done in JDK-8195874

Register to register spill may use AVX 512 move instruction on unsupported platform.

s390: Use of shift operators not covered by cpp standard

serviceability/sa/TestUniverse.java#id0 intermittently fails with assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded

SIGBUS in CodeHeapState::print_names()

SIGSEGV in MethodArityHistogram() with -XX:+CountCompiledCalls

Soft reference reclamation race in com.sun.xml.internal.stream.util.ThreadLocalBufferAllocator

Swing apps are slow if displaying from a remote source to many local displays

switch jtreg to 4.2b13

Test library OSInfo.getSolarisVersion cannot determine Solaris version

TestOptionsWithRanges.java is very slow

TestOptionsWithRanges.java of '-XX:TLABSize=2147483648' fails intermittently

The Japanese message of FileNotFoundException garbled

The 'supported_groups' extension in ServerHellos

ThreadInfoCompositeData.toCompositeData fails to map ThreadInfo to CompositeData

TimeZone.getDisplayName given Locale.US doesn't always honor the Locale.

TLS 1.2 Support algorithm in SunPKCS11 provider

TLS 1.3 handshake server name indication is missing on a session resume

TLS 1.3 server fails if ClientHello doesn't have pre_shared_key and psk_key_exchange_modes

TLS 1.3 interop problems with OpenSSL 1.1.1 when used on the client side with mutual auth

tz: Upgrade time-zone data to tzdata2018g

Undefined behaviour in ADLC

Update avx512 implementation

URLStreamHandler initialization race

UseCompressedOops requirement check fails fails on 32-bit system

windows: Update OS detection code to recognize Windows Server 2019

x86: assert on unbound assembler Labels used as branch targets

x86: jck tests for ldc2_w bytecode fail

x86: sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization

'-XX:OnOutOfMemoryError' uses fork instead of vfork

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues :

Security issues fixed :

CVE-2019-2602: Better String parsing (bsc#1132728).

CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).

CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).

CVE-2019-2422: Better FileChannel (bsc#1122293).

CVE-2018-11212: Improve JPEG (bsc#1122299).

Non-Security issue fixed: Disable LTO (bsc#1133135).

Added Japanese new era name.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk fixes the following issues :

Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU)

Security issues fixed :

CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component:
Libraries) (bsc#1132728).

CVE-2019-2684: Fixed flaw inside the RMI registry implementation (bsc#1132732).

CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).

CVE-2019-2422: Fixed memory disclosure in FileChannelImpl (bsc#1122293).

CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray function in jmemmgr.c (bsc#1122299).

CVE-2019-2426: Improve web server connections (bsc#1134297).

Bug fixes: Please check the package Changelog for detailed information.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122761	CentOS 6 : java-1.7.0-openjdk (CESA-2019:0462)	Nessus	CentOS Local Security Checks	2019/3/12	2023/3/23	low
123085	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2019-1177)	Nessus	Amazon Linux Local Security Checks	2019/3/26	2022/10/10	low
122461	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0416)	Nessus	Oracle Linux Local Security Checks	2019/2/27	2024/10/22	low
288917	MiracleLinux 7 : java-1.7.0-openjdk-1.7.0.211-2.6.17.1.0.1.el7.AXS7 (AXSA:2019-3841:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	low
127419	NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Vulnerability (NS-SA-2019-0148)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2023/3/23	low
122575	Oracle Linux 7 : java-11-openjdk (ELSA-2019-0436)	Nessus	Oracle Linux Local Security Checks	2019/3/4	2024/10/23	low
122464	RHEL 6 : java-1.8.0-openjdk (RHSA-2019:0416)	Nessus	Red Hat Local Security Checks	2019/2/27	2024/11/7	low
122867	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2019:13978-1)	Nessus	SuSE Local Security Checks	2019/3/15	2024/6/13	low
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	2020/4/29	2025/8/22	critical
123146	RHEL 6 : java-1.8.0-ibm (RHSA-2019:0640)	Nessus	Red Hat Local Security Checks	2019/3/27	2024/11/7	critical
121568	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:0221-1)	Nessus	SuSE Local Security Checks	2019/2/4	2024/6/24	low
125023	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1219-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/5/14	2026/1/9	high
125676	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:1392-1)	Nessus	SuSE Local Security Checks	2019/6/3	2024/5/17	high

检测

插件搜索

low

low

low

low

low

low

low

low

critical

critical

low

high

high