Vulnerabilities > CVE-2017-3544

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE

Summary

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Vulnerable Configurations

Part Description Count
Application
Oracle
7
Application
Redhat
93
OS
Redhat
15
OS
Debian
1
OS
Google
8

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1386-1.NASL
    descriptionThis update for java-1_8_0-ibm fixes the following issues: Version update bsc#1038505 : - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-3544: OpenJDK: newline injection in the SMTP client - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100377
    published2017-05-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100377
    titleSUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:1386-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2017:1386-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100377);
      script_version("3.9");
      script_cvs_date("Date: 2019/09/11 11:22:15");
    
      script_cve_id("CVE-2016-9840", "CVE-2016-9841", "CVE-2016-9842", "CVE-2016-9843", "CVE-2017-1289", "CVE-2017-3509", "CVE-2017-3511", "CVE-2017-3533", "CVE-2017-3539", "CVE-2017-3544");
    
      script_name(english:"SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:1386-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for java-1_8_0-ibm fixes the following issues: Version
    update bsc#1038505 :
    
      - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in
        inftrees.c
    
      - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in
        inffast.c
    
      - CVE-2016-9842: zlib: Undefined left shift of negative
        number
    
      - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
    
      - CVE-2017-3544: OpenJDK: newline injection in the SMTP
        client
    
      - CVE-2017-3509: OpenJDK: improper re-use of NTLM
        authenticated connections
    
      - CVE-2017-3511: OpenJDK: untrusted extension directories
        search path in Launcher
    
      - CVE-2017-3533: OpenJDK: newline injection in the FTP
        client
    
      - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
    
      - CVE-2017-1289: IBM JDK: XML External Entity Injection
        (XXE) error when processing XML data
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1038505"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-9840/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-9841/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-9842/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-9843/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-1289/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-3509/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-3511/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-3533/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-3539/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-3544/"
      );
      # https://www.suse.com/support/update/announcement/2017/suse-su-20171386-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b1e96fe3"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t
    patch SUSE-SLE-SDK-12-SP2-2017-844=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP1:zypper in -t
    patch SUSE-SLE-SDK-12-SP1-2017-844=1
    
    SUSE Linux Enterprise Server 12-SP2:zypper in -t patch
    SUSE-SLE-SERVER-12-SP2-2017-844=1
    
    SUSE Linux Enterprise Server 12-SP1:zypper in -t patch
    SUSE-SLE-SERVER-12-SP1-2017-844=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(1|2)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP1/2", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"1", cpu:"x86_64", reference:"java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", cpu:"x86_64", reference:"java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"java-1_8_0-ibm-1.8.0_sr4.5-29.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"java-1_8_0-ibm-1.8.0_sr4.5-29.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"java-1_8_0-ibm-alsa-1.8.0_sr4.5-29.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"java-1_8_0-ibm-plugin-1.8.0_sr4.5-29.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "java-1_8_0-ibm");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1221.NASL
    descriptionAn update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 7 to version 7R1 SR4-FP5. Security Fix(es) : * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security Vulnerabilities page, listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2017-1289, CVE-2017-3509, CVE-2017-3511, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id100118
    published2017-05-11
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100118
    titleRHEL 6 / 7 : java-1.7.1-ibm (RHSA-2017:1221)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2017:1221. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100118);
      script_version("3.12");
      script_cvs_date("Date: 2019/10/24 15:35:43");
    
      script_cve_id("CVE-2016-9840", "CVE-2016-9841", "CVE-2016-9842", "CVE-2016-9843", "CVE-2017-1289", "CVE-2017-3509", "CVE-2017-3511", "CVE-2017-3533", "CVE-2017-3539", "CVE-2017-3544");
      script_xref(name:"RHSA", value:"2017:1221");
    
      script_name(english:"RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2017:1221)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for java-1.7.1-ibm is now available for Red Hat Enterprise
    Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    IBM Java SE version 7 Release 1 includes the IBM Java Runtime
    Environment and the IBM Java Software Development Kit.
    
    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP5.
    
    Security Fix(es) :
    
    * This update fixes multiple vulnerabilities in the IBM Java Runtime
    Environment and the IBM Java Software Development Kit. Further
    information about these flaws can be found on the IBM Java Security
    Vulnerabilities page, listed in the References section.
    (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843,
    CVE-2017-1289, CVE-2017-3509, CVE-2017-3511, CVE-2017-3533,
    CVE-2017-3539, CVE-2017-3544)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://developer.ibm.com/javasdk/support/security-vulnerabilities/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2017:1221"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-9840"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-9841"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-9842"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-9843"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-1289"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-3509"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-3511"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-3533"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-3539"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-3544"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-demo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-jdbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-plugin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-src");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/11");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x / 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2017:1221";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.7.1-ibm-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.7.1-ibm-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.7.1-ibm-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.7.1-ibm-demo-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.7.1-ibm-demo-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.7.1-ibm-demo-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.7.1-ibm-devel-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.7.1-ibm-devel-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.7.1-ibm-devel-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.7.1-ibm-jdbc-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.7.1-ibm-jdbc-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.7.1-ibm-jdbc-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.7.1-ibm-plugin-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.7.1-ibm-plugin-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.7.1-ibm-src-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.7.1-ibm-src-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.7.1-ibm-src-1.7.1.4.5-1jpp.2.el6_9")) flag++;
    
    
      if (rpm_check(release:"RHEL7", reference:"java-1.7.1-ibm-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"java-1.7.1-ibm-demo-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"java-1.7.1-ibm-demo-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"java-1.7.1-ibm-devel-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"java-1.7.1-ibm-jdbc-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"java-1.7.1-ibm-jdbc-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"java-1.7.1-ibm-plugin-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"java-1.7.1-ibm-src-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"java-1.7.1-ibm-src-1.7.1.4.5-1jpp.1.el7_3")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "java-1.7.1-ibm / java-1.7.1-ibm-demo / java-1.7.1-ibm-devel / etc");
      }
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1118.NASL
    descriptionAn update for java-1.7.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update upgrades Oracle Java SE 7 to version 7 Update 141. Security Fix(es) : * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2017-3509, CVE-2017-3511, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id99651
    published2017-04-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99651
    titleRHEL 6 / 7 : java-1.7.0-oracle (RHSA-2017:1118)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-954.NASL
    descriptionSeveral vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. For Debian 7
    last seen2020-03-17
    modified2017-05-30
    plugin id100474
    published2017-05-30
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100474
    titleDebian DLA-954-1 : openjdk-7 security update
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1119.NASL
    descriptionAn update for java-1.6.0-sun is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update upgrades Oracle Java SE 6 to version 6 Update 151. Security Fix(es) : * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2017-3509, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id99652
    published2017-04-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99652
    titleRHEL 6 / 7 : java-1.6.0-sun (RHSA-2017:1119)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1445-1.NASL
    descriptionThis update for java-1_8_0-openjdk fixes the following issues : - Upgrade to version jdk8u131 (icedtea 3.4.0) - bsc#1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514: Windows peering issue - S8168699: Validate special case invocations - S8169011, CVE-2017-3526: Resizing XML parse trees - S8170222, CVE-2017-3533: Better transfers of files - S8171121, CVE-2017-3539: Enhancing jar checking - S8171533, CVE-2017-3544: Better email transfer - S8172299: Improve class processing - New features - PR1969: Add AArch32 JIT port - PR3297: Allow Shenandoah to be used on AArch64 - PR3340: jstack.stp should support AArch64 - Import of OpenJDK 8 u131 build 11 - S6474807: (smartcardio) CardTerminal.connect() throws CardException instead of CardNotPresentException - S6515172, PR3346: Runtime.availableProcessors() ignores Linux taskset command - S7155957: closed/java/awt/MenuBar/MenuBarStress1/MenuBarStress1.ja va hangs on win 64 bit with jdk8 - S7167293: FtpURLConnection connection leak on FileNotFoundException - S8035568: [macosx] Cursor management unification - S8079595: Resizing dialog which is JWindow parent makes JVM crash - S8130769: The new menu can
    last seen2020-06-01
    modified2020-06-02
    plugin id100541
    published2017-05-31
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100541
    titleSUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:1445-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1400-1.NASL
    descriptionThis update for java-1_7_0-openjdk fixes the following issues : - Update to 2.6.10 - OpenJDK 7u141 (bsc#1034849) - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514: Windows peering issue - S8169011, CVE-2017-3526: Resizing XML parse trees - S8170222, CVE-2017-3533: Better transfers of files - S8171121, CVE-2017-3539: Enhancing jar checking - S8171533, CVE-2017-3544: Better email transfer - S8172299: Improve class processing - New features - PR3347: jstack.stp should support AArch64 - Import of OpenJDK 7 u141 build 0 - S4717864: setFont() does not update Fonts of Menus already on screen - S6474807: (smartcardio) CardTerminal.connect() throws CardException instead of CardNotPresentException - S6518907: cleanup IA64 specific code in Hotspot - S6869327: Add new C2 flag to keep safepoints in counted loops. - S7112912: Message
    last seen2020-06-01
    modified2020-06-02
    plugin id100409
    published2017-05-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100409
    titleSUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2017:1400-1)
  • NASL familyWindows
    NASL idORACLE_JAVA_CPU_APR_2017.NASL
    descriptionThe version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 6 Update 151, 7 Update 141, or 8 Update 131. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3509) - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges. This vulnerability does not affect Java SE version 6. (CVE-2017-3511) - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512) - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514) - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526) - Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544) - An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3539)
    last seen2020-06-01
    modified2020-06-02
    plugin id99588
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99588
    titleOracle Java SE Multiple Vulnerabilities (April 2017 CPU)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-1109.NASL
    descriptionFrom Red Hat Security Advisory 2017:1109 : An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id99567
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99567
    titleOracle Linux 6 : java-1.8.0-openjdk (ELSA-2017-1109)
  • NASL familyMisc.
    NASL idORACLE_JAVA_CPU_APR_2017_UNIX.NASL
    descriptionThe version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 6 Update 151, 7 Update 141, or 8 Update 131. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3509) - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges. This vulnerability does not affect Java SE version 6. (CVE-2017-3511) - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512) - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514) - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526) - Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544) - An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3539)
    last seen2020-06-01
    modified2020-06-02
    plugin id99589
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99589
    titleOracle Java SE Multiple Vulnerabilities (April 2017 CPU) (Unix)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1385-1.NASL
    descriptionThis update for java-1_7_1-ibm fixes the following issues : - Version update to 7.1-4.5 bsc#1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100376
    published2017-05-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100376
    titleSUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2017:1385-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170421_JAVA_1_8_0_OPENJDK_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-03-18
    modified2017-04-24
    plugin id99622
    published2017-04-24
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99622
    titleScientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20170421)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-827.NASL
    descriptionImproper re-use of NTLM authenticated connections (Networking, 8163520) : It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Newline injection in the SMTP client (Networking, 8171533) : A newline injection flaw was discovered in the SMTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate SMTP connections established by a Java application. (CVE-2017-3544) Newline injection in the FTP client (Networking, 8170222) A newline injection flaw was discovered in the FTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate FTP connections established by a Java application. (CVE-2017-3533) Missing algorithm restrictions for jar verification (Libraries, 8155973) : It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for JAR integrity verification. This flaw could allow an attacker to modify content of the JAR file that used weak signing key or hash algorithm. (CVE-2016-5542) Untrusted extension directories search path in Launcher (JCE, 8163528) An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) MD5 allowed for jar verification (Security, 8171121) It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) Incomplete XML parse tree size enforcement (JAXP, 8169011) It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526)
    last seen2020-06-01
    modified2020-06-02
    plugin id100105
    published2017-05-11
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100105
    titleAmazon Linux AMI : java-1.8.0-openjdk (ALAS-2017-827)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3275-2.NASL
    descriptionUSN-3275-1 fixed vulnerabilities in OpenJDK 8. This update provides the corresponding updates for OpenJDK 7. It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509) It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511) It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526) It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533) It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539) It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application
    last seen2020-06-01
    modified2020-06-02
    plugin id100216
    published2017-05-16
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100216
    titleUbuntu 14.04 LTS : openjdk-7 vulnerabilities (USN-3275-2)
  • NASL familyAIX Local Security Checks
    NASL idAIX_JAVA_APR2017_ADVISORY.NASL
    descriptionThe version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents : - Multiple vulnerabilities exist in the zlib subcomponent that allow an unauthenticated, remote attacker to trigger denial of service conditions. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843) - An unspecified flaw exists in the XML subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-1289) - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3509) - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges. This vulnerability does not affect Java SE version 6. (CVE-2017-3511) - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. This vulnerability does not affect Java SE version 6. (CVE-2017-3512) - An unspecified flaw exists in the AWT subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-3514) - Multiple unspecified flaws exist in the Networking subcomponent that allow an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3533, CVE-2017-3544) - An unspecified flaw exists in the Security subcomponent that allows an unauthenticated, remote attacker to gain update, insert, or delete access to unauthorized data. (CVE-2017-3539)
    last seen2020-06-01
    modified2020-06-02
    plugin id103189
    published2017-09-13
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/103189
    titleAIX Java Advisory : java_apr2017_advisory.asc (April 2017 CPU)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3275-1.NASL
    descriptionIt was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509) It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511) It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526) It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533) It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539) It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application
    last seen2020-06-01
    modified2020-06-02
    plugin id100154
    published2017-05-12
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100154
    titleUbuntu 16.04 LTS / 16.10 / 17.04 : openjdk-8 vulnerabilities (USN-3275-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170509_JAVA_1_7_0_OPENJDK_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-03-18
    modified2017-05-10
    plugin id100096
    published2017-05-10
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100096
    titleScientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/x86_64 (20170509)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201705-03.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201705-03 (Oracle JDK/JRE: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in in Oracle&rsquo;s JRE and JDK. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, gain access to information, or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id100017
    published2017-05-08
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100017
    titleGLSA-201705-03 : Oracle JDK/JRE: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-629.NASL
    descriptionThis update for java-1_7_0-openjdk fixes the following issues : - Update to 2.6.10 - OpenJDK 7u141 (bsc#1034849) - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514: Windows peering issue - S8169011, CVE-2017-3526: Resizing XML parse trees - S8170222, CVE-2017-3533: Better transfers of files - S8171121, CVE-2017-3539: Enhancing jar checking - S8171533, CVE-2017-3544: Better email transfer - S8172299: Improve class processing - New features - PR3347: jstack.stp should support AArch64 - Import of OpenJDK 7 u141 build 0 - S4717864: setFont() does not update Fonts of Menus already on screen - S6474807: (smartcardio) CardTerminal.connect() throws CardException instead of CardNotPresentException - S6518907: cleanup IA64 specific code in Hotspot - S6869327: Add new C2 flag to keep safepoints in counted loops. - S7112912: Message
    last seen2020-06-05
    modified2017-05-30
    plugin id100503
    published2017-05-30
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100503
    titleopenSUSE Security Update : java-1_7_0-openjdk (openSUSE-2017-629)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-835.NASL
    descriptionAn untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533 , CVE-2017-3544) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id100636
    published2017-06-07
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100636
    titleAmazon Linux AMI : java-1.7.0-openjdk (ALAS-2017-835)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-3453.NASL
    descriptionAn update for java-1.8.0-ibm is now available for Red Hat Satellite 5.8 and Red Hat Satellite 5.8 ELS. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR5-FP5. Security Fix(es) : * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security Vulnerabilities page listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2016-10165, CVE-2017-1289, CVE-2017-3509, CVE-2017-3511, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544, CVE-2017-10053, CVE-2017-10067, CVE-2017-10078, CVE-2017-10087, CVE-2017-10089, CVE-2017-10090, CVE-2017-10096, CVE-2017-10101, CVE-2017-10102, CVE-2017-10105, CVE-2017-10107, CVE-2017-10108, CVE-2017-10109, CVE-2017-10110, CVE-2017-10115, CVE-2017-10116, CVE-2017-10243, CVE-2017-10281, CVE-2017-10285, CVE-2017-10295, CVE-2017-10309, CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348, CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356, CVE-2017-10357, CVE-2017-10388) For details on how to apply this update, which includes the changes described in this advisory, refer to : https://access.redhat.com/articles/11258 For this update to take effect, Red Hat Satellite must be restarted (
    last seen2020-06-01
    modified2020-06-02
    plugin id105267
    published2017-12-15
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105267
    titleRHEL 6 : Satellite Server (RHSA-2017:3453)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-1204.NASL
    descriptionAn update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id100067
    published2017-05-10
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100067
    titleCentOS 6 / 7 : java-1.7.0-openjdk (CESA-2017:1204)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1117.NASL
    descriptionAn update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Oracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update upgrades Oracle Java SE 8 to version 8 Update 131. Security Fix(es) : * This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2017-3509, CVE-2017-3511, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id99650
    published2017-04-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99650
    titleRHEL 6 / 7 : java-1.8.0-oracle (RHSA-2017:1117)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1384-1.NASL
    descriptionThis update for java-1_7_0-ibm fixes the following issues: Version update to 7.0-10.5 bsc#1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100375
    published2017-05-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100375
    titleSUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2017:1384-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1109.NASL
    descriptionAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id99574
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99574
    titleRHEL 6 : java-1.8.0-openjdk (RHSA-2017:1109)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1220.NASL
    descriptionAn update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR4-FP5. Security Fix(es) : * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security Vulnerabilities page, listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2017-1289, CVE-2017-3509, CVE-2017-3511, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id100117
    published2017-05-11
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100117
    titleRHEL 6 / 7 : java-1.8.0-ibm (RHSA-2017:1220)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1444-1.NASL
    descriptionThis update for java-1_6_0-ibm fixes the following issues : - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client - Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100540
    published2017-05-31
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100540
    titleSUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2017:1444-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1387-1.NASL
    descriptionThis update for java-1_7_1-ibm fixes the following issues: Version update to 7.1-4.5 bsc#1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id100378
    published2017-05-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100378
    titleSUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:1387-1)
  • NASL familyWindows
    NASL idORACLE_JROCKIT_CPU_APR_2017.NASL
    descriptionThe version of Oracle JRockit installed on the remote Windows host is R28.3.13. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the JCE subcomponent that allows a local attacker to gain elevated privileges. (CVE-2017-3511) - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3526) - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to update, insert, or delete arbitrary data via FTP. (CVE-2017-3533) - An unspecified flaw exists in the Networking subcomponent that allows an unauthenticated, remote attacker to update, insert, or delete arbitrary data via SMTP. (CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id99521
    published2017-04-20
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99521
    titleOracle JRockit R28.3.13 Multiple Vulnerabilities (April 2017 CPU)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1222.NASL
    descriptionAn update for java-1.6.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 6 to version 6 SR16-FP45. Security Fix(es) : * This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security Vulnerabilities page, listed in the References section. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2017-1289, CVE-2017-3509, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544)
    last seen2020-06-01
    modified2020-06-02
    plugin id100119
    published2017-05-11
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100119
    titleRHEL 6 : java-1.6.0-ibm (RHSA-2017:1222)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1108.NASL
    descriptionAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id99573
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99573
    titleRHEL 7 : java-1.8.0-openjdk (RHSA-2017:1108)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-1109.NASL
    descriptionAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id101459
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101459
    titleVirtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2017-1109)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201707-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201707-01 (IcedTea: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers referenced below for details. Note: If the web browser plug-in provided by the dev-java/icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, gain access to information, or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id101248
    published2017-07-06
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101248
    titleGLSA-201707-01 : IcedTea: Multiple vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3858.NASL
    descriptionSeveral vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography.
    last seen2020-06-01
    modified2020-06-02
    plugin id100305
    published2017-05-22
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100305
    titleDebian DSA-3858-1 : openjdk-7 - security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-1109.NASL
    descriptionAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id99541
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99541
    titleCentOS 6 : java-1.8.0-openjdk (CESA-2017:1109)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170421_JAVA_1_8_0_OPENJDK_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-03-18
    modified2017-04-24
    plugin id99621
    published2017-04-24
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99621
    titleScientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20170421)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1204.NASL
    descriptionAn update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id100091
    published2017-05-10
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100091
    titleRHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2017:1204)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-1108.NASL
    descriptionAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id101458
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101458
    titleVirtuozzo 7 : java-1.8.0-openjdk / etc (VZLSA-2017-1108)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1074.NASL
    descriptionAccording to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) - It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) - Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533, CVE-2017-3544) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-03
    plugin id99940
    published2017-05-03
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99940
    titleEulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2017-1074)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3275-3.NASL
    descriptionUSN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem. We apologize for the inconvenience. It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509) It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511) It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526) It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533) It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539) It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application
    last seen2020-06-01
    modified2020-06-02
    plugin id100293
    published2017-05-19
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100293
    titleUbuntu 14.04 LTS : openjdk-7 regression (USN-3275-3)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1099.NASL
    descriptionAccording to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) - It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) - Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533, CVE-2017-3544) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-06-09
    plugin id100692
    published2017-06-09
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100692
    titleEulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2017-1099)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-1108.NASL
    descriptionAn update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id99540
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99540
    titleCentOS 7 : java-1.8.0-openjdk (CESA-2017:1108)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-662.NASL
    descriptionThis update for java-1_8_0-openjdk fixes the following issues : - Upgrade to version jdk8u131 (icedtea 3.4.0) - bsc#1034849 - Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514: Windows peering issue - S8168699: Validate special case invocations - S8169011, CVE-2017-3526: Resizing XML parse trees - S8170222, CVE-2017-3533: Better transfers of files - S8171121, CVE-2017-3539: Enhancing jar checking - S8171533, CVE-2017-3544: Better email transfer - S8172299: Improve class processing - New features - PR1969: Add AArch32 JIT port - PR3297: Allow Shenandoah to be used on AArch64 - PR3340: jstack.stp should support AArch64 - Import of OpenJDK 8 u131 build 11 - S6474807: (smartcardio) CardTerminal.connect() throws CardException instead of CardNotPresentException - S6515172, PR3346: Runtime.availableProcessors() ignores Linux taskset command - S7155957: closed/java/awt/MenuBar/MenuBarStress1/MenuBarStress1.ja va hangs on win 64 bit with jdk8 - S7167293: FtpURLConnection connection leak on FileNotFoundException - S8035568: [macosx] Cursor management unification - S8079595: Resizing dialog which is JWindow parent makes JVM crash - S8130769: The new menu can
    last seen2020-06-05
    modified2017-06-09
    plugin id100707
    published2017-06-09
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100707
    titleopenSUSE Security Update : java-1_8_0-openjdk (openSUSE-2017-662)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-1204.NASL
    descriptionAn update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id101462
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101462
    titleVirtuozzo 6 : java-1.7.0-openjdk / java-1.7.0-openjdk-demo / etc (VZLSA-2017-1204)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1098.NASL
    descriptionAccording to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) - It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) - Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533, CVE-2017-3544) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-06-09
    plugin id100691
    published2017-06-09
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100691
    titleEulerOS 2.0 SP1 : java-1.7.0-openjdk (EulerOS-SA-2017-1098)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0105_JAVA-1.7.0-OPENJDK.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has java-1.7.0-openjdk packages installed that are affected by multiple vulnerabilities: - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re- use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) - A newline injection flaw was discovered in the SMTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate SMTP connections established by a Java application. (CVE-2017-3544) - It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) - A newline injection flaw was discovered in the FTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate FTP connections established by a Java application. (CVE-2017-3533) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127336
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127336
    titleNewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0105)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-1204.NASL
    descriptionFrom Red Hat Security Advisory 2017:1204 : An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id100087
    published2017-05-10
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100087
    titleOracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2017-1204)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1073.NASL
    descriptionAccording to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) - It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) - Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533, CVE-2017-3544) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-03
    plugin id99939
    published2017-05-03
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99939
    titleEulerOS 2.0 SP1 : java-1.8.0-openjdk (EulerOS-SA-2017-1073)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0111_JAVA-1.8.0-OPENJDK.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities: - It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) - It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re- use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) - A newline injection flaw was discovered in the SMTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate SMTP connections established by a Java application. (CVE-2017-3544) - It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) - A newline injection flaw was discovered in the FTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate FTP connections established by a Java application. (CVE-2017-3533) - It was discovered that the Libraries component of OpenJDK accepted ECDSA signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools. (CVE-2016-5546) - It was discovered that the Libraries component of OpenJDK did not validate the length of the object identifier read from the DER input before allocating memory to store the OID. An attacker able to make a Java application decode a specially crafted DER input could cause the application to consume an excessive amount of memory. (CVE-2016-5547) - A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2016-5548) - It was discovered that the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause a Java application to incorrectly parse an attacker supplied URL and interpret it differently from other applications processing the same URL. (CVE-2016-5552) - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 4.3 (Confidentiality impacts). (CVE-2017-3231, CVE-2017-3261) - It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-3241) - It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN. (CVE-2017-3252) - It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory. (CVE-2017-3253) - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). (CVE-2017-3272) - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). (CVE-2017-3289) - It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for JAR integrity verification. This flaw could allow an attacker to modify content of the JAR file that used weak signing key or hash algorithm. (CVE-2016-5542) - A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554) - It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim
    last seen2020-06-01
    modified2020-06-02
    plugin id127348
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127348
    titleNewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0111)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-1389-1.NASL
    descriptionThis update for java-1_6_0-ibm fixes the following issues : - Version update to 6.0-16.45 bsc#1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client - Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-24
    modified2019-01-02
    plugin id119998
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119998
    titleSUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2017:1389-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-1108.NASL
    descriptionFrom Red Hat Security Advisory 2017:1108 : An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es) : * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id99566
    published2017-04-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99566
    titleOracle Linux 7 : java-1.8.0-openjdk (ELSA-2017-1108)

Redhat

advisories
  • bugzilla
    id1443252
    titleCVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentjava-1.8.0-openjdk-javadoc-zip-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108001
          • commentjava-1.8.0-openjdk-javadoc-zip-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20170180029
        • AND
          • commentjava-1.8.0-openjdk-javadoc-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108003
          • commentjava-1.8.0-openjdk-javadoc-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919008
        • AND
          • commentjava-1.8.0-openjdk-javadoc-zip is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108005
          • commentjava-1.8.0-openjdk-javadoc-zip is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20170180031
        • AND
          • commentjava-1.8.0-openjdk-javadoc is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108007
          • commentjava-1.8.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636006
        • AND
          • commentjava-1.8.0-openjdk-devel is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108009
          • commentjava-1.8.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636012
        • AND
          • commentjava-1.8.0-openjdk-demo-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108011
          • commentjava-1.8.0-openjdk-demo-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919014
        • AND
          • commentjava-1.8.0-openjdk-devel-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108013
          • commentjava-1.8.0-openjdk-devel-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919024
        • AND
          • commentjava-1.8.0-openjdk-accessibility-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108015
          • commentjava-1.8.0-openjdk-accessibility-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20160049002
        • AND
          • commentjava-1.8.0-openjdk-demo is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108017
          • commentjava-1.8.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636002
        • AND
          • commentjava-1.8.0-openjdk-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108019
          • commentjava-1.8.0-openjdk-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919022
        • AND
          • commentjava-1.8.0-openjdk-headless-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108021
          • commentjava-1.8.0-openjdk-headless-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919016
        • AND
          • commentjava-1.8.0-openjdk-accessibility is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108023
          • commentjava-1.8.0-openjdk-accessibility is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150809019
        • AND
          • commentjava-1.8.0-openjdk-src is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108025
          • commentjava-1.8.0-openjdk-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636004
        • AND
          • commentjava-1.8.0-openjdk-src-debug is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108027
          • commentjava-1.8.0-openjdk-src-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919020
        • AND
          • commentjava-1.8.0-openjdk-headless is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108029
          • commentjava-1.8.0-openjdk-headless is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636010
        • AND
          • commentjava-1.8.0-openjdk is earlier than 1:1.8.0.131-2.b11.el7_3
            ovaloval:com.redhat.rhsa:tst:20171108031
          • commentjava-1.8.0-openjdk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636008
    rhsa
    idRHSA-2017:1108
    released2017-04-21
    severityModerate
    titleRHSA-2017:1108: java-1.8.0-openjdk security and bug fix update (Moderate)
  • bugzilla
    id1443252
    titleCVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentjava-1.8.0-openjdk-devel is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109001
          • commentjava-1.8.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636012
        • AND
          • commentjava-1.8.0-openjdk is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109003
          • commentjava-1.8.0-openjdk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636008
        • AND
          • commentjava-1.8.0-openjdk-headless is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109005
          • commentjava-1.8.0-openjdk-headless is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636010
        • AND
          • commentjava-1.8.0-openjdk-javadoc is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109007
          • commentjava-1.8.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636006
        • AND
          • commentjava-1.8.0-openjdk-javadoc-debug is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109009
          • commentjava-1.8.0-openjdk-javadoc-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919008
        • AND
          • commentjava-1.8.0-openjdk-headless-debug is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109011
          • commentjava-1.8.0-openjdk-headless-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919016
        • AND
          • commentjava-1.8.0-openjdk-devel-debug is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109013
          • commentjava-1.8.0-openjdk-devel-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919024
        • AND
          • commentjava-1.8.0-openjdk-debug is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109015
          • commentjava-1.8.0-openjdk-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919022
        • AND
          • commentjava-1.8.0-openjdk-demo is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109017
          • commentjava-1.8.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636002
        • AND
          • commentjava-1.8.0-openjdk-src is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109019
          • commentjava-1.8.0-openjdk-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141636004
        • AND
          • commentjava-1.8.0-openjdk-src-debug is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109021
          • commentjava-1.8.0-openjdk-src-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919020
        • AND
          • commentjava-1.8.0-openjdk-demo-debug is earlier than 1:1.8.0.131-0.b11.el6_9
            ovaloval:com.redhat.rhsa:tst:20171109023
          • commentjava-1.8.0-openjdk-demo-debug is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20151919014
    rhsa
    idRHSA-2017:1109
    released2017-04-20
    severityModerate
    titleRHSA-2017:1109: java-1.8.0-openjdk security update (Moderate)
  • bugzilla
    id1443252
    titleCVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentjava-1.8.0-oracle-devel is earlier than 1:1.8.0.131-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171117001
          • commentjava-1.8.0-oracle-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080006
        • AND
          • commentjava-1.8.0-oracle-javafx is earlier than 1:1.8.0.131-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171117003
          • commentjava-1.8.0-oracle-javafx is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080002
        • AND
          • commentjava-1.8.0-oracle-jdbc is earlier than 1:1.8.0.131-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171117005
          • commentjava-1.8.0-oracle-jdbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080012
        • AND
          • commentjava-1.8.0-oracle is earlier than 1:1.8.0.131-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171117007
          • commentjava-1.8.0-oracle is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080004
        • AND
          • commentjava-1.8.0-oracle-src is earlier than 1:1.8.0.131-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171117009
          • commentjava-1.8.0-oracle-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080010
        • AND
          • commentjava-1.8.0-oracle-plugin is earlier than 1:1.8.0.131-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171117011
          • commentjava-1.8.0-oracle-plugin is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080008
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentjava-1.8.0-oracle-javafx is earlier than 1:1.8.0.131-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171117014
          • commentjava-1.8.0-oracle-javafx is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080002
        • AND
          • commentjava-1.8.0-oracle-jdbc is earlier than 1:1.8.0.131-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171117015
          • commentjava-1.8.0-oracle-jdbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080012
        • AND
          • commentjava-1.8.0-oracle-devel is earlier than 1:1.8.0.131-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171117016
          • commentjava-1.8.0-oracle-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080006
        • AND
          • commentjava-1.8.0-oracle-plugin is earlier than 1:1.8.0.131-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171117017
          • commentjava-1.8.0-oracle-plugin is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080008
        • AND
          • commentjava-1.8.0-oracle-src is earlier than 1:1.8.0.131-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171117018
          • commentjava-1.8.0-oracle-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080010
        • AND
          • commentjava-1.8.0-oracle is earlier than 1:1.8.0.131-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171117019
          • commentjava-1.8.0-oracle is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20150080004
    rhsa
    idRHSA-2017:1117
    released2017-04-24
    severityModerate
    titleRHSA-2017:1117: java-1.8.0-oracle security update (Moderate)
  • bugzilla
    id1443252
    titleCVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentjava-1.7.0-oracle-jdbc is earlier than 1:1.7.0.141-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171118001
          • commentjava-1.7.0-oracle-jdbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413023
        • AND
          • commentjava-1.7.0-oracle is earlier than 1:1.7.0.141-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171118003
          • commentjava-1.7.0-oracle is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413017
        • AND
          • commentjava-1.7.0-oracle-devel is earlier than 1:1.7.0.141-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171118005
          • commentjava-1.7.0-oracle-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413015
        • AND
          • commentjava-1.7.0-oracle-plugin is earlier than 1:1.7.0.141-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171118007
          • commentjava-1.7.0-oracle-plugin is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413025
        • AND
          • commentjava-1.7.0-oracle-javafx is earlier than 1:1.7.0.141-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171118009
          • commentjava-1.7.0-oracle-javafx is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413019
        • AND
          • commentjava-1.7.0-oracle-src is earlier than 1:1.7.0.141-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171118011
          • commentjava-1.7.0-oracle-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413021
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentjava-1.7.0-oracle-plugin is earlier than 1:1.7.0.141-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171118014
          • commentjava-1.7.0-oracle-plugin is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413025
        • AND
          • commentjava-1.7.0-oracle-jdbc is earlier than 1:1.7.0.141-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171118015
          • commentjava-1.7.0-oracle-jdbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413023
        • AND
          • commentjava-1.7.0-oracle-src is earlier than 1:1.7.0.141-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171118016
          • commentjava-1.7.0-oracle-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413021
        • AND
          • commentjava-1.7.0-oracle-devel is earlier than 1:1.7.0.141-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171118017
          • commentjava-1.7.0-oracle-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413015
        • AND
          • commentjava-1.7.0-oracle-javafx is earlier than 1:1.7.0.141-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171118018
          • commentjava-1.7.0-oracle-javafx is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413019
        • AND
          • commentjava-1.7.0-oracle is earlier than 1:1.7.0.141-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171118019
          • commentjava-1.7.0-oracle is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140413017
    rhsa
    idRHSA-2017:1118
    released2017-04-24
    severityModerate
    titleRHSA-2017:1118: java-1.7.0-oracle security update (Moderate)
  • bugzilla
    id1443252
    titleCVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentjava-1.6.0-sun-src is earlier than 1:1.6.0.151-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171119001
          • commentjava-1.6.0-sun-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414019
        • AND
          • commentjava-1.6.0-sun-demo is earlier than 1:1.6.0.151-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171119003
          • commentjava-1.6.0-sun-demo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414015
        • AND
          • commentjava-1.6.0-sun-jdbc is earlier than 1:1.6.0.151-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171119005
          • commentjava-1.6.0-sun-jdbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414025
        • AND
          • commentjava-1.6.0-sun-plugin is earlier than 1:1.6.0.151-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171119007
          • commentjava-1.6.0-sun-plugin is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414023
        • AND
          • commentjava-1.6.0-sun is earlier than 1:1.6.0.151-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171119009
          • commentjava-1.6.0-sun is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414021
        • AND
          • commentjava-1.6.0-sun-devel is earlier than 1:1.6.0.151-1jpp.1.el6
            ovaloval:com.redhat.rhsa:tst:20171119011
          • commentjava-1.6.0-sun-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414017
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentjava-1.6.0-sun-src is earlier than 1:1.6.0.151-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171119014
          • commentjava-1.6.0-sun-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414019
        • AND
          • commentjava-1.6.0-sun-demo is earlier than 1:1.6.0.151-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171119015
          • commentjava-1.6.0-sun-demo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414015
        • AND
          • commentjava-1.6.0-sun-jdbc is earlier than 1:1.6.0.151-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171119016
          • commentjava-1.6.0-sun-jdbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414025
        • AND
          • commentjava-1.6.0-sun-devel is earlier than 1:1.6.0.151-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171119017
          • commentjava-1.6.0-sun-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414017
        • AND
          • commentjava-1.6.0-sun is earlier than 1:1.6.0.151-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171119018
          • commentjava-1.6.0-sun is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414021
        • AND
          • commentjava-1.6.0-sun-plugin is earlier than 1:1.6.0.151-1jpp.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171119019
          • commentjava-1.6.0-sun-plugin is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140414023
    rhsa
    idRHSA-2017:1119
    released2017-04-24
    severityModerate
    titleRHSA-2017:1119: java-1.6.0-sun security update (Moderate)
  • bugzilla
    id1443252
    titleCVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentjava-1.7.0-openjdk-src is earlier than 1:1.7.0.141-2.6.10.1.el6_9
            ovaloval:com.redhat.rhsa:tst:20171204001
          • commentjava-1.7.0-openjdk-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009006
        • AND
          • commentjava-1.7.0-openjdk-demo is earlier than 1:1.7.0.141-2.6.10.1.el6_9
            ovaloval:com.redhat.rhsa:tst:20171204003
          • commentjava-1.7.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009008
        • AND
          • commentjava-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.141-2.6.10.1.el6_9
            ovaloval:com.redhat.rhsa:tst:20171204005
          • commentjava-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009002
        • AND
          • commentjava-1.7.0-openjdk is earlier than 1:1.7.0.141-2.6.10.1.el6_9
            ovaloval:com.redhat.rhsa:tst:20171204007
          • commentjava-1.7.0-openjdk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009010
        • AND
          • commentjava-1.7.0-openjdk-devel is earlier than 1:1.7.0.141-2.6.10.1.el6_9
            ovaloval:com.redhat.rhsa:tst:20171204009
          • commentjava-1.7.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009004
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentjava-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204012
          • commentjava-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009002
        • AND
          • commentjava-1.7.0-openjdk-src is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204013
          • commentjava-1.7.0-openjdk-src is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009006
        • AND
          • commentjava-1.7.0-openjdk-accessibility is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204014
          • commentjava-1.7.0-openjdk-accessibility is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140675010
        • AND
          • commentjava-1.7.0-openjdk-devel is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204016
          • commentjava-1.7.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009004
        • AND
          • commentjava-1.7.0-openjdk-demo is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204017
          • commentjava-1.7.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009008
        • AND
          • commentjava-1.7.0-openjdk-headless is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204018
          • commentjava-1.7.0-openjdk-headless is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20140675006
        • AND
          • commentjava-1.7.0-openjdk is earlier than 1:1.7.0.141-2.6.10.1.el7_3
            ovaloval:com.redhat.rhsa:tst:20171204020
          • commentjava-1.7.0-openjdk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20121009010
    rhsa
    idRHSA-2017:1204
    released2017-05-09
    severityModerate
    titleRHSA-2017:1204: java-1.7.0-openjdk security update (Moderate)
  • rhsa
    idRHSA-2017:1220
  • rhsa
    idRHSA-2017:1221
  • rhsa
    idRHSA-2017:1222
  • rhsa
    idRHSA-2017:3453
rpms
  • java-1.8.0-openjdk-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-accessibility-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-accessibility-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-debuginfo-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-demo-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-demo-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-devel-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-devel-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-headless-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-headless-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-javadoc-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-javadoc-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-javadoc-zip-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-javadoc-zip-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-src-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-src-debug-1:1.8.0.131-2.b11.el7_3
  • java-1.8.0-openjdk-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-debug-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-debuginfo-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-demo-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-demo-debug-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-devel-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-devel-debug-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-headless-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-headless-debug-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-javadoc-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-javadoc-debug-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-src-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-openjdk-src-debug-1:1.8.0.131-0.b11.el6_9
  • java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el6
  • java-1.8.0-oracle-1:1.8.0.131-1jpp.1.el7_3
  • java-1.8.0-oracle-devel-1:1.8.0.131-1jpp.1.el6
  • java-1.8.0-oracle-devel-1:1.8.0.131-1jpp.1.el7_3
  • java-1.8.0-oracle-javafx-1:1.8.0.131-1jpp.1.el6
  • java-1.8.0-oracle-javafx-1:1.8.0.131-1jpp.1.el7_3
  • java-1.8.0-oracle-jdbc-1:1.8.0.131-1jpp.1.el6
  • java-1.8.0-oracle-jdbc-1:1.8.0.131-1jpp.1.el7_3
  • java-1.8.0-oracle-plugin-1:1.8.0.131-1jpp.1.el6
  • java-1.8.0-oracle-plugin-1:1.8.0.131-1jpp.1.el7_3
  • java-1.8.0-oracle-src-1:1.8.0.131-1jpp.1.el6
  • java-1.8.0-oracle-src-1:1.8.0.131-1jpp.1.el7_3
  • java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el6
  • java-1.7.0-oracle-1:1.7.0.141-1jpp.1.el7_3
  • java-1.7.0-oracle-devel-1:1.7.0.141-1jpp.1.el6
  • java-1.7.0-oracle-devel-1:1.7.0.141-1jpp.1.el7_3
  • java-1.7.0-oracle-javafx-1:1.7.0.141-1jpp.1.el6
  • java-1.7.0-oracle-javafx-1:1.7.0.141-1jpp.1.el7_3
  • java-1.7.0-oracle-jdbc-1:1.7.0.141-1jpp.1.el6
  • java-1.7.0-oracle-jdbc-1:1.7.0.141-1jpp.1.el7_3
  • java-1.7.0-oracle-plugin-1:1.7.0.141-1jpp.1.el6
  • java-1.7.0-oracle-plugin-1:1.7.0.141-1jpp.1.el7_3
  • java-1.7.0-oracle-src-1:1.7.0.141-1jpp.1.el6
  • java-1.7.0-oracle-src-1:1.7.0.141-1jpp.1.el7_3
  • java-1.6.0-sun-1:1.6.0.151-1jpp.1.el6
  • java-1.6.0-sun-1:1.6.0.151-1jpp.1.el7_3
  • java-1.6.0-sun-demo-1:1.6.0.151-1jpp.1.el6
  • java-1.6.0-sun-demo-1:1.6.0.151-1jpp.1.el7_3
  • java-1.6.0-sun-devel-1:1.6.0.151-1jpp.1.el6
  • java-1.6.0-sun-devel-1:1.6.0.151-1jpp.1.el7_3
  • java-1.6.0-sun-jdbc-1:1.6.0.151-1jpp.1.el6
  • java-1.6.0-sun-jdbc-1:1.6.0.151-1jpp.1.el7_3
  • java-1.6.0-sun-plugin-1:1.6.0.151-1jpp.1.el6
  • java-1.6.0-sun-plugin-1:1.6.0.151-1jpp.1.el7_3
  • java-1.6.0-sun-src-1:1.6.0.151-1jpp.1.el6
  • java-1.6.0-sun-src-1:1.6.0.151-1jpp.1.el7_3
  • java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el6_9
  • java-1.7.0-openjdk-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-accessibility-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-debuginfo-1:1.7.0.141-2.6.10.1.el6_9
  • java-1.7.0-openjdk-debuginfo-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-demo-1:1.7.0.141-2.6.10.1.el6_9
  • java-1.7.0-openjdk-demo-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-devel-1:1.7.0.141-2.6.10.1.el6_9
  • java-1.7.0-openjdk-devel-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-headless-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-javadoc-1:1.7.0.141-2.6.10.1.el6_9
  • java-1.7.0-openjdk-javadoc-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.7.0-openjdk-src-1:1.7.0.141-2.6.10.1.el6_9
  • java-1.7.0-openjdk-src-1:1.7.0.141-2.6.10.1.el7_3
  • java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el6_9
  • java-1.8.0-ibm-1:1.8.0.4.5-1jpp.1.el7_3
  • java-1.8.0-ibm-demo-1:1.8.0.4.5-1jpp.1.el6_9
  • java-1.8.0-ibm-demo-1:1.8.0.4.5-1jpp.1.el7_3
  • java-1.8.0-ibm-devel-1:1.8.0.4.5-1jpp.1.el6_9
  • java-1.8.0-ibm-devel-1:1.8.0.4.5-1jpp.1.el7_3
  • java-1.8.0-ibm-jdbc-1:1.8.0.4.5-1jpp.1.el6_9
  • java-1.8.0-ibm-jdbc-1:1.8.0.4.5-1jpp.1.el7_3
  • java-1.8.0-ibm-plugin-1:1.8.0.4.5-1jpp.1.el6_9
  • java-1.8.0-ibm-plugin-1:1.8.0.4.5-1jpp.1.el7_3
  • java-1.8.0-ibm-src-1:1.8.0.4.5-1jpp.1.el6_9
  • java-1.8.0-ibm-src-1:1.8.0.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-1:1.7.1.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-1:1.7.1.4.5-1jpp.2.el6_9
  • java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-demo-1:1.7.1.4.5-1jpp.2.el6_9
  • java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-devel-1:1.7.1.4.5-1jpp.2.el6_9
  • java-1.7.1-ibm-jdbc-1:1.7.1.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-jdbc-1:1.7.1.4.5-1jpp.2.el6_9
  • java-1.7.1-ibm-plugin-1:1.7.1.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-plugin-1:1.7.1.4.5-1jpp.2.el6_9
  • java-1.7.1-ibm-src-1:1.7.1.4.5-1jpp.1.el7_3
  • java-1.7.1-ibm-src-1:1.7.1.4.5-1jpp.2.el6_9
  • java-1.6.0-ibm-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.6.0-ibm-demo-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.6.0-ibm-devel-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.6.0-ibm-javacomm-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.6.0-ibm-jdbc-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.6.0-ibm-plugin-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.6.0-ibm-src-1:1.6.0.16.45-1jpp.1.el6_9
  • java-1.8.0-ibm-1:1.8.0.5.5-1jpp.1.el6_9
  • java-1.8.0-ibm-devel-1:1.8.0.5.5-1jpp.1.el6_9

The Hacker News

idTHN:E1A6F01891FE36DE7ABDBBAEFB511689
last seen2018-01-27
modified2017-07-07
published2017-07-06
reporterMohit Kumar
sourcehttps://thehackernews.com/2017/07/android-ios-broadcom-hacking.html
titleMillions of Android Devices Using Broadcom Wi-Fi Chip Can Be Hacked Remotely