The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0264 advisory.

  - IBM JDK: privilege escalation via shared class cache (CVE-2014-3065)

  - IBM JDK: Java CMS keystore provider potentially allows brute-force private key recovery (CVE-2014-3068)

  - IBM JDK: Privilege escalation issue (CVE-2014-3086)

  - SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack (CVE-2014-3566)

  - OpenJDK: SubjectDelegator protection insufficient (JMX, 8029755) (CVE-2014-4209)

  - OpenJDK: Clone interfaces passed to proxy methods (Libraries, 8035009) (CVE-2014-4218)

  - OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119)     (CVE-2014-4219)

  - Oracle JDK: unspecified vulnerability fixed in 6u81, 7u65 and 8u11 (Deployment) (CVE-2014-4227,     CVE-2014-4265)

  - OpenJDK: RSA blinding issues (Security, 8031346) (CVE-2014-4244)

  - OpenJDK: Prevent instantiation of service with non-public constructor (Security, 8035004) (CVE-2014-4252)

  - OpenJDK: AtomicReferenceFieldUpdater missing primitive type check (Libraries, 8039520) (CVE-2014-4262)

  - OpenJDK: insufficient Diffie-Hellman public key validation (Security, 8037162) (CVE-2014-4263)

  - Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) (CVE-2014-4288,     CVE-2014-6458, CVE-2014-6492, CVE-2014-6493, CVE-2014-6503, CVE-2014-6515, CVE-2014-6532)

  - OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066) (CVE-2014-6457)

  - OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797) (CVE-2014-6502)

  - OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564)     (CVE-2014-6506)

  - ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540) (CVE-2014-6511)

  - OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509) (CVE-2014-6512)

  - OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274) (CVE-2014-6531)

  - OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846) (CVE-2014-6558)

  - ICU: font parsing OOB read (OpenJDK 2D, 8055489) (CVE-2014-6585)

  - OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264) (CVE-2014-6587)

  - ICU: font parsing OOB read (OpenJDK 2D, 8056276) (CVE-2014-6591)

  - OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) (CVE-2014-6593)

  - IBM JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8891)

  - IBM JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update (CVE-2014-8892)

  - OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) (CVE-2015-0395)

  - Oracle JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment) (CVE-2015-0403,     CVE-2015-0406)

  - OpenJDK: directory information leak via file chooser (Swing, 8055304) (CVE-2015-0407)

  - OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) (CVE-2015-0408)

  - OpenJDK: DER decoder infinite loop  (Security, 8059485) (CVE-2015-0410)

  - OpenJDK: insufficient code privileges checks (JAX-WS, 8054367) (CVE-2015-0412)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Java SE or Java for Business installed on the remote host is prior to 8 Update 31, 7 Update 75, 6 Update 91, or 5 Update 81. It is, therefore, affected by security vulnerabilities in the following components :

 - 2D
 - Deployment
 - Hotspot
 - Install
 - JAX-WS
 - JSSE
 - Libraries
 - RMI
 - Security
 - Serviceability
 - Swing

The Oracle Java SE installed on the remote host is version 5 prior to Update 26, 6 prior to Update 91, 7 prior to Update 75, or 8 prior to Update 26; therefore, it is affected by multiple vulnerabilities.  While the details of these vulnerabilities are not currently known, the vendor has acknowledged that confidentiality, integrity, and availability can be impacted remotely.  The components affected by these vulnerabilities are:

 - 2D (CVE-2014-6585, CVE-2014-6591)
 - DER Decoder (CVE-2015-0410)
 - Hotspot (CVE-2015-0383)
 - Hotspot Garbage Collector (CVE-2015-0395)
 - JSSE (CVE-2014-6593)
 - RMI (CVE-2015-0408)
 - Swing (CVE-2015-0407)

ID	Name	Product	Family	Published	Updated	Severity
81505	RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:0264)	Nessus	Red Hat Local Security Checks	2/25/2015	4/24/2024	low
700649	Oracle Java SE 5 < Update 81 / 6 < Update 91 / 7 < Update 75 / 8 < Update 31 Multiple Vulnerabilities (January 2015 CPU) (POODLE)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	critical
8897	Oracle Java SE 5 < Update 76 / 6 < Update 86 / 7 < Update 73 / 8 < Update 26 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2/12/2015	3/6/2019	high

Detections

Analytics

Plugins Search

low

critical

high