An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR3-FP40.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)

This update for java-1_8_0-openjdk fixes the following security issues
- April 2016 Oracle CPU (bsc#976340) :

  - CVE-2016-0686: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to Serialization. 

  - CVE-2016-0687: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to the Hotspot     sub-component

  - CVE-2016-0695: Unspecified vulnerability allowed remote     attackers to affect confidentiality via vectors related     to the Security Component

  - CVE-2016-3425: Unspecified vulnerability allowed remote     attackers to affect availability via vectors related to     JAXP

  - CVE-2016-3426: Unspecified vulnerability allowed remote     attackers to affect confidentiality via vectors related     to JCE

  - CVE-2016-3427: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to JMX

This update for java-1_8_0-openjdk fixes the following security issues
- April 2016 Oracle CPU (bsc#976340) :

  - CVE-2016-0686: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to Serialization. 

  - CVE-2016-0687: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to the Hotspot     sub-component

  - CVE-2016-0695: Unspecified vulnerability allowed remote     attackers to affect confidentiality via vectors related     to the Security Component

  - CVE-2016-3425: Unspecified vulnerability allowed remote     attackers to affect availability via vectors related to     JAXP

  - CVE-2016-3426: Unspecified vulnerability allowed remote     attackers to affect confidentiality via vectors related     to JCE

  - CVE-2016-3427: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to JMX

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for java-1_8_0-openjdk fixes the following security issues
- April 2016 Oracle CPU (bsc#976340) :

  - CVE-2016-0686: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to Serialization.

  - CVE-2016-0687: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to the Hotspot     sub-component

  - CVE-2016-0695: Unspecified vulnerability allowed remote     attackers to affect confidentiality via vectors related     to the Security Component

  - CVE-2016-3425: Unspecified vulnerability allowed remote     attackers to affect availability via vectors related to     JAXP

  - CVE-2016-3426: Unspecified vulnerability allowed remote     attackers to affect confidentiality via vectors related     to JCE

  - CVE-2016-3427: Unspecified vulnerability allowed remote     attackers to affect confidentiality, integrity, and     availability via vectors related to JMX

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues.

These security issues were fixed :

  - CVE-2016-0686: Ensure thread consistency (bsc#976340).

  - CVE-2016-0687: Better byte behavior (bsc#976340).

  - CVE-2016-0695: Make DSA more fair (bsc#976340).

  - CVE-2016-3425: Better buffering of XML strings     (bsc#976340).

  - CVE-2016-3427: Improve JMX connections (bsc#976340).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR3.

Security Fix(es) :

* This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)

This IBM Java 1.6.0 SR16 FP25 release fixes the following issues :

Security issues fixed :

CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648)

CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650)

CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646)

The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Java SE installed on the remote host is prior to 6 Update 115, 7 Update 101, or 8 Update 92 and is affected by multiple vulnerabilities :

 - An unspecified flaw related to the 'Serialization' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0686)
 - An unspecified flaw related to the 'Hotspot' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0687)
 - An unspecified flaw related to the 'Security' subcomponent may allow a remote attacker to gain access to potentially sensitive information. (CVE-2016-0695)
 - An unspecified flaw related to the '2D' subcomponent may allow a context-dependent attacker to cause a denial of service. (CVE-2016-3422)
 - An unspecified flaw related to the 'JAXP' subcomponent may allow a remote attacker to cause a denial of service. (CVE-2016-3425)
 - An unspecified flaw related to the 'JCE' subcomponent may allow a context-dependent attacker to gain access to potentially sensitive information. (CVE-2016-3426)
 - A flaw related to the 'JMX' subcomponent may allow a remote attacker to execute arbitrary code through Java deserialization. (CVE-2016-3427)
 - An out-of-bounds read flaw within the '2D' subcomponent is triggered when handling specially crafted files. This may allow a context-dependent attacker gain unauthorized access to potentially sensitive information. (CVE-2016-3443)
 - An unspecified flaw related to the 'Deployment' subcomponent may allow a context-dependent attacker to execute arbitrary code. (CVE-2016-3449)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 91, 7 Update 101, or 6 Update 115. It is, therefore, affected by security vulnerabilities in the following subcomponents :

 - 2D
 - Deployment
 - Hotspot
 - JAXP
 - JCE
 - JMX
 - Security
 - Serialization

ID	Name	Product	Family	Published	Updated	Severity
90818	RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2016:0701)	Nessus	Red Hat Local Security Checks	5/2/2016	5/14/2023	critical
90906	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-554)	Nessus	SuSE Local Security Checks	5/5/2016	5/14/2023	critical
90984	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-572)	Nessus	SuSE Local Security Checks	5/9/2016	5/14/2023	critical
90992	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2016:1248-1)	Nessus	SuSE Local Security Checks	5/9/2016	5/14/2023	critical
90993	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2016:1250-1)	Nessus	SuSE Local Security Checks	5/9/2016	5/14/2023	critical
91079	RHEL 6 : java-1.8.0-ibm (RHSA-2016:1039)	Nessus	Red Hat Local Security Checks	5/12/2016	5/14/2023	critical
91319	SUSE SLES10 Security Update : IBM Java 1.6.0 (SUSE-SU-2016:1388-1)	Nessus	SuSE Local Security Checks	5/25/2016	5/14/2023	critical
9448	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 92 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/8/2016	3/6/2019	critical
700653	Oracle Java SE 6 < Update 115 / 7 < Update 101 / 8 < Update 91 Multiple Vulnerabilities (April 2016 CPU)	Nessus Network Monitor	Web Clients	5/2/2019	5/2/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

high