An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3409 advisory.

    [1:1.7.0.201-2.6.16.0.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.201-2.6.16.0]
    - Bump to 2.6.16 and u201b00.
    - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
    - Resolves: rhbz#1633817

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3409 advisory.

    The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

    * OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)     (CVE-2018-3136)

    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)

    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.4 (Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N).(CVE-2018-3136)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181;
JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2018-3214)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded:
8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).(CVE-2018-3149)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Scripting). Supported versions that are affected are Java SE: 8u182 and 11; Java SE Embedded: 8u181; JRockit:
R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).(CVE-2018-3183)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded:
8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts).
CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).(CVE-2018-3139)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.
Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).(CVE-2018-3169)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded:
8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).(CVE-2018-3180)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3350 advisory.

    [1:1.7.0.201-2.6.16.1.0.1]
    - Update DISTRO_NAME in specfile

    [1:1.7.0.201-2.6.16.1]
    - Bump to 2.6.16 and u201b00.
    - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
    - Resolves: rhbz#1633817

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3521 advisory.

    [1:11.0.1.13-3.0.1]
    - link atomic for ix86 build

    [1:11.0.1.13-3]
    - Bump release for rebuild.

    [1:11.0.1.13-2]
    - Use LTS designator in version output for RHEL.

    [1:11.0.1.13-1]
    - Update to October 2018 CPU release, 11.0.1+13.

    [1:11.0.0.28-2]
    - Use --with-vendor-version-string=18.9 so as to show original       GA date for the JDK.

    [1:11.0.0.28-1]
    - Identify as GA version and no longer as early access (EA).
    - JDK 11 has been released for GA on 2018-09-25.

    [1:11.0.ea.28-9]
    - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes       RHBZ-1624122.
    - Add patch, JDK-8210416-RHBZ-1632174-fdlibm-opt-fix.patch, so as to       optimize compilation of fdlibm library.
    - Add patch, JDK-8210425-RHBZ-1632174-sharedRuntimeTrig-opt-fix.patch, so       as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
    - Add patch, JDK-8210647-RHBZ-1632174-libsaproc-opt-fix.patch, so as to       optimize compilation of libsaproc (extra c flags won't override       optimization).
    - Add patch, JDK-8210761-RHBZ-1632174-libjsig-opt-fix.patch, so as to       optimize compilation of libjsig.
    - Add patch, JDK-8210703-RHBZ-1632174-vmStructs-opt-fix.patch, so as to       optimize compilation of vmStructs.cpp (part of libjvm.so).
    - Reinstate filtering of opt flags coming from redhat-rpm-config.

    [1:11.0.ea.28-8]
    - removed version less provides
    - javadocdir moved to arched dir as it is no longer noarch
    - Resolves: rhbz#1570856

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)

* OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)

* OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)

* OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)

* OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)

* OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

CVE-2018-2938: Support Derby connections (bsc#1101644)

CVE-2018-2940: Better stack walking (bsc#1101645)

CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

CVE-2018-2973: Improve LDAP support (bsc#1101656)

CVE-2018-3639 cpu speculative store bypass mitigation

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3360:04 advisory.

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)
    * OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)
    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)
    * OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534)     (CVE-2018-3136)
    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)
    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)
    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3372:06 advisory.

    * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)
    * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)
    * OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)     (CVE-2018-3136)
    * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)
    * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)     (CVE-2018-3180)
    * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118311	CentOS 7 : java-1.8.0-openjdk (CESA-2018:2942)	Nessus	CentOS Local Security Checks	2018/10/23	2022/2/3	critical
118312	CentOS 6 : java-1.8.0-openjdk (CESA-2018:2943)	Nessus	CentOS Local Security Checks	2018/10/23	2022/2/3	critical
118512	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2018-3409)	Nessus	Oracle Linux Local Security Checks	2018/10/31	2024/10/22	high
118556	RHEL 6 : java-1.7.0-openjdk (RHSA-2018:3409)	Nessus	Red Hat Local Security Checks	2018/10/31	2024/11/5	high
118802	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2018-1097)	Nessus	Amazon Linux Local Security Checks	2018/11/8	2024/7/25	critical
118811	Oracle Linux 7 : java-1.7.0-openjdk (ELSA-2018-3350)	Nessus	Oracle Linux Local Security Checks	2018/11/8	2024/10/22	high
118849	Oracle Linux 7 : java-11-openjdk (ELSA-2018-3521)	Nessus	Oracle Linux Local Security Checks	2018/11/9	2024/10/22	critical
119047	CentOS 6 : java-1.7.0-openjdk (CESA-2018:3409)	Nessus	CentOS Local Security Checks	2018/11/21	2022/5/26	high
119091	Virtuozzo 6 : java-1.7.0-openjdk / java-1.7.0-openjdk-demo / etc (VZLSA-2018-3409)	Nessus	Virtuozzo Local Security Checks	2018/11/21	2022/5/26	high
121059	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/10	2026/1/9	critical
289916	MiracleLinux 4 : java-1.8.0-openjdk-1.8.0.191.b12-0.AXS4 (AXSA:2018-3360:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
289976	MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.201-2.6.16.0.AXS4 (AXSA:2018-3372:06)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

检测

插件搜索

critical

critical

high

high

critical

high

critical

high

high

critical

critical

high