The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3136 advisory.

    [1:1.8.0.232.b09-0]
    - Update to aarch64-shenandoah-jdk8u232-b09.
    - Switch to GA mode for final release.
    - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
    - Resolves: rhbz#1753423

    [1:1.8.0.232.b08-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u232-b08.
    - Resolves: rhbz#1753423

    [1:1.8.0.232.b05-0.1.ea]
    - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
    - Update version logic to handle -shenandoah* tag suffix.
    - Resolves: rhbz#1753423

    [1:1.8.0.232.b05-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u232-b05.
    - Resolves: rhbz#1753423

    [1:1.8.0.232.b01-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u232-b01.
    - Switch to EA mode.
    - Resolves: rhbz#1753423

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3135 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Out of bounds access in optimized String indexof implementation (Hotspot, 8224062)     (CVE-2019-2977)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3136 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues :

Security issues fixed (October 2019 CPU bsc#1154212):&#9; 

  - CVE-2019-2933: Windows file handling redux

  - CVE-2019-2945: Better socket support

  - CVE-2019-2949: Better Kerberos ccache handling

  - CVE-2019-2958: Build Better Processes

  - CVE-2019-2964: Better support for patterns

  - CVE-2019-2962: Better Glyph Images

  - CVE-2019-2973: Better pattern compilation

  - CVE-2019-2975: Unexpected exception in jjs

  - CVE-2019-2978: Improved handling of jar files

  - CVE-2019-2977: Improve String index handling

  - CVE-2019-2981: Better Path supports

  - CVE-2019-2983: Better serial attributes

  - CVE-2019-2987: Better rendering of native glyphs

  - CVE-2019-2988: Better Graphics2D drawing

  - CVE-2019-2989: Improve TLS connection support

  - CVE-2019-2992: Enhance font glyph mapping

  - CVE-2019-2999: Commentary on Javadoc comments

  - CVE-2019-2894: Enhance ECDSA operations (bsc#1152856).

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version MAIN 4.06, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Concurrency). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability can only     be exploited by supplying data to APIs in the specified     Component without using Untrusted Java Web Start     applications or Untrusted Java applets, such as through     a web service. CVSS 3.0 Base Score 3.7 (Availability     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2964)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u221, 11.0.4     and 13; Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data and unauthorized ability to cause a     partial denial of service (partial DOS) of Java SE, Java     SE Embedded. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in     Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).
    (CVE-2019-2975)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JAXP). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13; Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability applies     to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability can     also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs. CVSS 3.0 Base Score 3.7 (Availability     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2973, CVE-2019-2981)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Javadoc). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE. Successful     attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java     SE, attacks may significantly impact additional     products. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply     to Java deployments, typically in servers, that load and     run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 4.7 (Confidentiality     and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
    (CVE-2019-2999)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13; Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability applies     to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability does     not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code     installed by an administrator). CVSS 3.0 Base Score 3.7     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2988, CVE-2019-2992)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability applies     to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability can     also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs. CVSS 3.0 Base Score 3.7 (Availability     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2978)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: 2D). Supported versions that are affected     are Java SE: 11.0.4 and 13. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE. Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 3.7     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2987)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability applies     to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability can     also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs. CVSS 3.0 Base Score 3.7 (Availability     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2983)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 7u231, 8u221, 11.0.4 and     13; Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java     SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded. Note: This vulnerability applies     to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted code     (e.g., code that comes from the internet) and rely on     the Java sandbox for security. This vulnerability can     also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies     data to the APIs. CVSS 3.0 Base Score 3.7 (Availability     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2019-2962)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Networking). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require     human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8),     that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 3.1 (Availability     impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
    (CVE-2019-2945)

  - Vulnerability in the Oracle GraalVM Enterprise Edition     product of Oracle GraalVM (component: Java). The     supported version that is affected is 19.2.0. Difficult     to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise     Oracle GraalVM Enterprise Edition. While the     vulnerability is in Oracle GraalVM Enterprise Edition,     attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all Oracle GraalVM Enterprise     Edition accessible data. CVSS 3.0 Base Score 6.8     (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).
    (CVE-2019-2989)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Kerberos). Supported     versions that are affected are Java SE: 7u231, 8u221,     11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Java SE,     Java SE Embedded. While the vulnerability is in Java SE,     Java SE Embedded, attacks may significantly impact     additional products. Successful attacks of this     vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java SE     Embedded accessible data. Note: This vulnerability     applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which     supplies data to the APIs. CVSS 3.0 Base Score 6.8     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
    (CVE-2019-2949)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4115 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6.

    Security Fix(es):

    * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting,     8223518) (CVE-2019-2975)

    * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

    * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

    * Oracle JDK: unspecified vulnerability fixed in 8u221 (Deployment) (CVE-2019-2996)

    * IBM JDK: Unrestricted access to diagnostic operations (CVE-2019-17631)

    * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

    * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

    * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

    * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

    * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

    * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

    * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

    * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

    * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is prior to 7 <= 7u231 / 8 <= 8u222 / 11.0.0 <= 11.0.4 / 13.0.0 <= 13.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019-10-15 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java     SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). (CVE-2019-2949)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java     SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. CVSS v3.0 Base Score 6.8 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N). (CVE-2019-2989)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2019-2958)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). (CVE-2019-2975)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are     affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability     can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to     cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8     (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).
    (CVE-2019-2977)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks require human interaction from a person other than the attacker and while the vulnerability is in     Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.7     (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
    (CVE-2019-2999)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2973, CVE-2019-2981)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2983)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2988, CVE-2019-2992)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2978)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component     without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web     service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2964)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2962)

  - Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are     affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2987)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7     (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2019-2894)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE     8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2933)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). (CVE-2019-2945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 11 < 11.0.5.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2019-Oct-15 advisory.

  - security-libs/javax.net.ssl (CVE-2019-2894, CVE-2019-2949)

  - core-libs (CVE-2019-2933)

  - core-libs/java.net (CVE-2019-2945, CVE-2019-2978, CVE-2019-2989)

  - core-libs/java.lang (CVE-2019-2958)

  - client-libs/2d (CVE-2019-2962, CVE-2019-2983, CVE-2019-2987, CVE-2019-2988, CVE-2019-2992)

  - core-libs/java.util.regex (CVE-2019-2964)

  - xml/jaxp (CVE-2019-2973, CVE-2019-2981)

  - core-libs/javax.script (CVE-2019-2975)

  - hotspot/compiler (CVE-2019-2977)

  - tools/javadoc (CVE-2019-2999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Java installed on the remote host is prior to 7.0 < 7.0.10.55 / 7.1 < 7.1.4.55 / 8.0 < 8.0.6.10. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle October 15 2019 CPU advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE     8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. (CVE-2019-2933)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2019-2945)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java     SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2949)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2019-2958)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2962)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component     without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web     service. (CVE-2019-2964)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2973, CVE-2019-2981)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2975)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2978)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2983)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to     Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2019-2988, CVE-2019-2992)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE     Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java     SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. (CVE-2019-2989)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment). The     supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE     8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). (CVE-2019-2996)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are     affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks require human interaction from a person other than the attacker and while the vulnerability is in     Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers,     that load and run only trusted code (e.g., code installed by an administrator). (CVE-2019-2999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.7 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
130040	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-3136)	Nessus	Oracle Linux Local Security Checks	2019/10/18	2024/10/22	medium
130042	RHEL 8 : java-11-openjdk (RHSA-2019:3135)	Nessus	Red Hat Local Security Checks	2019/10/18	2024/11/6	medium
130043	RHEL 6 : java-1.8.0-openjdk (RHSA-2019:3136)	Nessus	Red Hat Local Security Checks	2019/10/18	2024/11/6	medium
131282	openSUSE Security Update : java-11-openjdk (openSUSE-2019-2557)	Nessus	SuSE Local Security Checks	2019/11/25	2024/4/9	medium
131774	NewStart CGSL MAIN 4.06 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0213)	Nessus	NewStart CGSL Local Security Checks	2019/12/6	2022/5/18	medium
131921	RHEL 7 : java-1.8.0-ibm (RHSA-2019:4115)	Nessus	Red Hat Local Security Checks	2019/12/10	2024/11/8	critical
133912	EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2020-1111)	Nessus	Huawei Local Security Checks	2020/2/24	2024/3/26	high
151213	OpenJDK 7 <= 7u231 / 8 <= 8u222 / 11.0.0 <= 11.0.4 / 13.0.0 <= 13.0.0 Multiple Vulnerabilities (2019-10-15)	Nessus	Misc.	2021/7/6	2022/5/9	medium
159435	Amazon Corretto Java 11.x < 11.0.5.10.1 Multiple Vulnerabilities	Nessus	Misc.	2022/4/1	2022/5/6	medium
160355	IBM Java 7.0 < 7.0.10.55 / 7.1 < 7.1.4.55 / 8.0 < 8.0.6.10 Multiple Vulnerabilities	Nessus	Misc.	2022/4/29	2022/5/6	medium
233563	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.7)	Nessus	Misc.	2025/3/31	2025/3/31	critical

检测

插件搜索

medium

medium

medium

medium

medium

critical

high

medium

medium

medium

critical