A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:
Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.
**Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore _strongly_ recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes _without_ delay.**
This Critical Patch Update contains 276 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at <https://blogs.oracle.com/security>.
Please note that the vulnerabilities in this Critical Patch Update are scored using version 3.0 of Common Vulnerability Scoring Standard (CVSS).
This Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available here.
{"nessus": [{"lastseen": "2023-05-23T14:17:00", "description": "Oracle reports :\n\nThe quarterly Critical Patch Update contains 22 new security fixes for Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier", "cvss3": {}, "published": "2016-07-22T00:00:00", "type": "nessus", "title": "FreeBSD : MySQL -- Multiple vulnerabilities (ca5cb202-4f51-11e6-b2ec-b499baebfeaf)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-2105", "CVE-2016-3424", "CVE-2016-3440", "CVE-2016-3452", "CVE-2016-3459", "CVE-2016-3471", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3518", "CVE-2016-3521", "CVE-2016-3588", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5436", "CVE-2016-5437", "CVE-2016-5439", "CVE-2016-5440", "CVE-2016-5441", "CVE-2016-5442", "CVE-2016-5443", "CVE-2016-5444"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:mariadb100-server", "p-cpe:/a:freebsd:freebsd:mariadb101-server", "p-cpe:/a:freebsd:freebsd:mariadb55-server", "p-cpe:/a:freebsd:freebsd:mysql55-server", "p-cpe:/a:freebsd:freebsd:mysql56-server", "p-cpe:/a:freebsd:freebsd:mysql57-server", "p-cpe:/a:freebsd:freebsd:percona55-server", "p-cpe:/a:freebsd:freebsd:percona56-server", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_CA5CB2024F5111E6B2ECB499BAEBFEAF.NASL", "href": "https://www.tenable.com/plugins/nessus/92505", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92505);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2016-2105\", \"CVE-2016-3424\", \"CVE-2016-3440\", \"CVE-2016-3452\", \"CVE-2016-3459\", \"CVE-2016-3471\", \"CVE-2016-3477\", \"CVE-2016-3486\", \"CVE-2016-3501\", \"CVE-2016-3518\", \"CVE-2016-3521\", \"CVE-2016-3588\", \"CVE-2016-3614\", \"CVE-2016-3615\", \"CVE-2016-5436\", \"CVE-2016-5437\", \"CVE-2016-5439\", \"CVE-2016-5440\", \"CVE-2016-5441\", \"CVE-2016-5442\", \"CVE-2016-5443\", \"CVE-2016-5444\");\n\n script_name(english:\"FreeBSD : MySQL -- Multiple vulnerabilities (ca5cb202-4f51-11e6-b2ec-b499baebfeaf)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Oracle reports :\n\nThe quarterly Critical Patch Update contains 22 new security fixes for\nOracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier\"\n );\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2d65519a\"\n );\n # https://vuxml.freebsd.org/freebsd/ca5cb202-4f51-11e6-b2ec-b499baebfeaf.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2c288534\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mariadb100-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mariadb101-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mariadb55-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mysql55-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mysql56-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mysql57-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:percona55-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:percona56-server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"mariadb55-server<=5.5.49\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mariadb100-server<=10.0.25\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mariadb101-server<=10.1.14\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mysql55-server<=5.5.49\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mysql56-server<5.6.30\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mysql57-server<5.7.12_1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"percona55-server<=5.5.49\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"percona56-server<=5.6.30\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:49", "description": "The version of Oracle E-Business installed on the remote host is missing the July 2016 Oracle Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities :\n\n - An unspecified flaw exists in the Wireless Framework subcomponent within the CRM Technical Foundation component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3491)\n\n - An unspecified flaw exists in the Function Security subcomponent within the Customer Interaction History component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3512)\n\n - An unspecified flaw exists in the AOL diagnostic tests subcomponent within the Application Object Library component that allows an authenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3520)\n\n - An unspecified flaw exists in the Application Service subcomponent within the Web Applications Desktop Integrator component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3522)\n\n - An unspecified flaw exists in the Application Service subcomponent within the Web Applications Desktop Integrator component that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-3523)\n\n - An unspecified flaw exists in the Configuration subcomponent within the Applications Technology Stack component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3524)\n\n - An unspecified flaw exists in the Cookie Management subcomponent within the Applications Manager component that allows an unauthenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3525)\n\n - An unspecified flaw exists in the Expenses Admin Utilities subcomponent within the Internet Expenses component that allows an unauthenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3528)\n\n - An unspecified flaw exists in the SDK client integration subcomponent within the Advanced Inbound Telephony component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3532)\n\n - An unspecified flaw exists in the Search subcomponent within the Knowledge Management component that allows an unauthenticated, remote attacker to impact integrity.\n (CVE-2016-3533)\n\n - An unspecified flaw exists in the Engineering Change Order subcomponent within the Installed Base component that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-3534)\n\n - An unspecified flaw exists in the Remote Launch subcomponent within the CRM Technical Foundation component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3535)\n\n - An unspecified flaw exists in the Deliverables subcomponent within the Marketing component that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2016-3536)\n\n - An unspecified flaw exists in the Notes subcomponent within the Common Applications Calendar component that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2016-3541)\n\n - An unspecified flaw exists in the Search/Browse subcomponent within the Knowledge Management component that allows an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2016-3542)\n\n - An unspecified flaw exists in the Tasks subcomponent within the Common Applications Calendar component that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2016-3543)\n\n - An unspecified flaw exists in the Web based help screens subcomponent within the Application Object Library component that allows an unauthenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3545)\n\n - An unspecified flaw exists in the Report JSPs subcomponent within the Advanced Collections component that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2016-3546)\n\n - An unspecified flaw exists in the Content Manager subcomponent within the One-to-One Fulfillment component that allows an unauthenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3547)\n\n - An unspecified flaw exists in the Marketing activity collateral subcomponent within the Marketing component that allows an unauthenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3548)\n\n - An unspecified flaw exists in the Search Integration Engine subcomponent within the E-Business Suite Secure Enterprise Search component that allows an unauthenticated, remote attacker to disclose potentially sensitive information. (CVE-2016-3549)\n\n - Multiple unspecified flaws exist in the Email Center Agent Console subcomponent within the Email Center component that allow an unauthenticated, remote attacker to impact integrity. (CVE-2016-3558, CVE-2016-3559)", "cvss3": {}, "published": "2016-07-20T00:00:00", "type": "nessus", "title": "Oracle E-Business Multiple Vulnerabilities (July 2016 CPU)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3491", "CVE-2016-3512", "CVE-2016-3520", "CVE-2016-3522", "CVE-2016-3523", "CVE-2016-3524", "CVE-2016-3525", "CVE-2016-3528", "CVE-2016-3532", "CVE-2016-3533", "CVE-2016-3534", "CVE-2016-3535", "CVE-2016-3536", "CVE-2016-3541", "CVE-2016-3542", "CVE-2016-3543", "CVE-2016-3545", "CVE-2016-3546", "CVE-2016-3547", "CVE-2016-3548", "CVE-2016-3549", "CVE-2016-3558", "CVE-2016-3559"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:oracle:e-business_suite"], "id": "ORACLE_E-BUSINESS_CPU_JUL_2016.NASL", "href": "https://www.tenable.com/plugins/nessus/92461", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92461);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2016-3491\",\n \"CVE-2016-3512\",\n \"CVE-2016-3520\",\n \"CVE-2016-3522\",\n \"CVE-2016-3523\",\n \"CVE-2016-3524\",\n \"CVE-2016-3525\",\n \"CVE-2016-3528\",\n \"CVE-2016-3532\",\n \"CVE-2016-3533\",\n \"CVE-2016-3534\",\n \"CVE-2016-3535\",\n \"CVE-2016-3536\",\n \"CVE-2016-3541\",\n \"CVE-2016-3542\",\n \"CVE-2016-3543\",\n \"CVE-2016-3545\",\n \"CVE-2016-3546\",\n \"CVE-2016-3547\",\n \"CVE-2016-3548\",\n \"CVE-2016-3549\",\n \"CVE-2016-3558\",\n \"CVE-2016-3559\"\n );\n script_bugtraq_id(\n 91838,\n 91839,\n 91841,\n 91843,\n 91845,\n 91848,\n 91852,\n 91857,\n 91861,\n 91865,\n 91870,\n 91873,\n 91878,\n 91882,\n 91886,\n 91888,\n 91893,\n 91896,\n 91899,\n 91903,\n 91907,\n 91909,\n 91911\n );\n\n script_name(english:\"Oracle E-Business Multiple Vulnerabilities (July 2016 CPU)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web application installed on the remote host is affected by multiple\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Oracle E-Business installed on the remote host is\nmissing the July 2016 Oracle Critical Patch Update (CPU). It is,\ntherefore, affected by multiple vulnerabilities :\n\n - An unspecified flaw exists in the Wireless Framework\n subcomponent within the CRM Technical Foundation\n component that allows an unauthenticated, remote\n attacker to impact confidentiality and integrity.\n (CVE-2016-3491)\n\n - An unspecified flaw exists in the Function Security\n subcomponent within the Customer Interaction History\n component that allows an unauthenticated, remote\n attacker to impact confidentiality and integrity.\n (CVE-2016-3512)\n\n - An unspecified flaw exists in the AOL diagnostic tests\n subcomponent within the Application Object Library\n component that allows an authenticated, remote attacker\n to disclose potentially sensitive information.\n (CVE-2016-3520)\n\n - An unspecified flaw exists in the Application Service\n subcomponent within the Web Applications Desktop\n Integrator component that allows an unauthenticated,\n remote attacker to impact confidentiality and integrity.\n (CVE-2016-3522)\n\n - An unspecified flaw exists in the Application Service\n subcomponent within the Web Applications Desktop\n Integrator component that allows an unauthenticated,\n remote attacker to impact integrity. (CVE-2016-3523)\n\n - An unspecified flaw exists in the Configuration\n subcomponent within the Applications Technology Stack\n component that allows an unauthenticated, remote\n attacker to impact confidentiality and integrity.\n (CVE-2016-3524)\n\n - An unspecified flaw exists in the Cookie Management\n subcomponent within the Applications Manager component\n that allows an unauthenticated, remote attacker to\n disclose potentially sensitive information.\n (CVE-2016-3525)\n\n - An unspecified flaw exists in the Expenses Admin\n Utilities subcomponent within the Internet Expenses\n component that allows an unauthenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3528)\n\n - An unspecified flaw exists in the SDK client integration\n subcomponent within the Advanced Inbound Telephony\n component that allows an unauthenticated, remote\n attacker to impact confidentiality and integrity.\n (CVE-2016-3532)\n\n - An unspecified flaw exists in the Search subcomponent\n within the Knowledge Management component that allows an\n unauthenticated, remote attacker to impact integrity.\n (CVE-2016-3533)\n\n - An unspecified flaw exists in the Engineering Change\n Order subcomponent within the Installed Base component\n that allows an unauthenticated, remote attacker to\n impact integrity. (CVE-2016-3534)\n\n - An unspecified flaw exists in the Remote Launch\n subcomponent within the CRM Technical Foundation\n component that allows an unauthenticated, remote\n attacker to impact confidentiality and integrity.\n (CVE-2016-3535)\n\n - An unspecified flaw exists in the Deliverables\n subcomponent within the Marketing component that allows\n an unauthenticated, remote attacker to impact\n confidentiality and integrity. (CVE-2016-3536)\n\n - An unspecified flaw exists in the Notes subcomponent\n within the Common Applications Calendar component that\n allows an unauthenticated, remote attacker to impact\n confidentiality and integrity. (CVE-2016-3541)\n\n - An unspecified flaw exists in the Search/Browse\n subcomponent within the Knowledge Management component\n that allows an authenticated, remote attacker to\n impact confidentiality and integrity. (CVE-2016-3542)\n\n - An unspecified flaw exists in the Tasks subcomponent\n within the Common Applications Calendar component that\n allows an unauthenticated, remote attacker to impact\n confidentiality and integrity. (CVE-2016-3543)\n\n - An unspecified flaw exists in the Web based help screens\n subcomponent within the Application Object Library\n component that allows an unauthenticated, remote\n attacker to disclose potentially sensitive information.\n (CVE-2016-3545)\n\n - An unspecified flaw exists in the Report JSPs\n subcomponent within the Advanced Collections component\n that allows an unauthenticated, remote attacker to\n impact confidentiality and integrity. (CVE-2016-3546)\n\n - An unspecified flaw exists in the Content Manager\n subcomponent within the One-to-One Fulfillment component\n that allows an unauthenticated, remote attacker to\n disclose potentially sensitive information.\n (CVE-2016-3547)\n\n - An unspecified flaw exists in the Marketing activity\n collateral subcomponent within the Marketing component\n that allows an unauthenticated, remote attacker to\n disclose potentially sensitive information.\n (CVE-2016-3548)\n\n - An unspecified flaw exists in the Search Integration\n Engine subcomponent within the E-Business Suite Secure\n Enterprise Search component that allows an\n unauthenticated, remote attacker to disclose potentially\n sensitive information. (CVE-2016-3549)\n\n - Multiple unspecified flaws exist in the Email Center\n Agent Console subcomponent within the Email Center\n component that allow an unauthenticated, remote\n attacker to impact integrity. (CVE-2016-3558,\n CVE-2016-3559)\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the appropriate patch according to the July 2016 Oracle\nCritical Patch Update advisory.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-3546\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:e-business_suite\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"oracle_e-business_query_patch_info.nbin\");\n script_require_keys(\"Oracle/E-Business/Version\", \"Oracle/E-Business/patches/installed\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nversion = get_kb_item_or_exit(\"Oracle/E-Business/Version\");\npatches = get_kb_item_or_exit(\"Oracle/E-Business/patches/installed\");\n\n# Batch checks\nif (patches) patches = split(patches, sep:',', keep:FALSE);\nelse patches = make_list();\n\np12_1 = '23144507';\np12_2 = '23144508';\n\n# Check if the installed version is an affected version\naffected_versions = make_array(\n '12.1.1', make_list(p12_1),\n '12.1.2', make_list(p12_1),\n '12.1.3', make_list(p12_1),\n\n '12.2.3', make_list(p12_2),\n '12.2.4', make_list(p12_2),\n '12.2.5', make_list(p12_2)\n);\n\npatched = FALSE;\naffectedver = FALSE;\n\nif (affected_versions[version])\n{\n affectedver = TRUE;\n patchids = affected_versions[version];\n foreach required_patch (patchids)\n {\n foreach applied_patch (patches)\n {\n if(required_patch == applied_patch)\n {\n patched = applied_patch;\n break;\n }\n }\n if(patched) break;\n }\n if(!patched) patchreport = join(patchids,sep:\" or \");\n}\n\nif (!patched && affectedver)\n{\n if(report_verbosity > 0)\n {\n report =\n '\\n Installed version : '+version+\n '\\n Fixed version : '+version+' Patch '+patchreport+\n '\\n';\n security_hole(port:0,extra:report);\n }\n else security_hole(0);\n exit(0);\n}\nelse if (!affectedver) audit(AUDIT_INST_VER_NOT_VULN, 'Oracle E-Business', version);\nelse exit(0, 'The Oracle E-Business server ' + version + ' is not affected because patch ' + patched + ' has been applied.');\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:38", "description": "The version of MySQL running on the remote host is 5.7.x prior to 5.7.13. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the EVP_EncodeUpdate() function within file crypto/evp/encode.c that is triggered when handling a large amount of input data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2105)\n\n - Multiple unspecified flaws exist in the Optimizer subcomponent that allow an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3424, CVE-2016-3440, CVE-2016-3501, CVE-2016-3518)\n\n - An unspecified flaw exists in the Security: Encryption subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3459, CVE-2016-5436)\n\n - An unspecified flaw exists in the Parser subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Types subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to impact integrity and confidentiality. (CVE-2016-3588)\n\n - Multiple unspecified flaws exist in the Security:\n Encryption subcomponent that allow an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3614, CVE-2016-5442)\n\n - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Log subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5437)\n\n - An unspecified flaw exists in the Privileges subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-5441)\n\n - An unspecified flaw exists in the Connection subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-5443)\n\n - An unspecified flaw exists in the Connection subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple flaws exist in InnoDB that are triggered when handling specially crafted 'ALTER TABLE' operations. An authenticated, remote attacker can exploit these issues to crash the database, resulting in a denial of service condition.\n\n - Multiple overflow conditions exist due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser structure that is triggered during the validation of stored procedure names. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB memcached plugin due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when invoking Enterprise Encryption functions in multiple threads simultaneously or after creating and dropping them. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when handling a 'SELECT ... GROUP BY ... FOR UPDATE' query executed with a loose index scan. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when performing a 'FLUSH TABLES' operation on a table with a discarded tablespace. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - A flaw exists in InnoDB that is triggered when performing an 'OPTIMIZE TABLE' operation on a table with a full-text index. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when performing an UPDATE operation on a generated virtual BLOB column. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when performing a 'SHOW CREATE TABLE' operation on a table with a generated column. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2016-07-11T00:00:00", "type": "nessus", "title": "Oracle MySQL 5.7.x < 5.7.13 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-2105", "CVE-2016-3424", "CVE-2016-3440", "CVE-2016-3452", "CVE-2016-3459", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3518", "CVE-2016-3521", "CVE-2016-3588", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5436", "CVE-2016-5437", "CVE-2016-5439", "CVE-2016-5440", "CVE-2016-5441", "CVE-2016-5442", "CVE-2016-5443", "CVE-2016-5444", "CVE-2016-8288"], "modified": "2020-06-03T00:00:00", "cpe": ["cpe:/a:oracle:mysql", "p-cpe:/a:amazon:linux:mysql", "p-cpe:/a:centos:centos:mysql", "p-cpe:/a:fedoraproject:fedora:mysql", "p-cpe:/a:fermilab:scientific_linux:mysql", "p-cpe:/a:novell:opensuse:mysql", "p-cpe:/a:novell:suse_linux:mysql", "p-cpe:/a:oracle:linux:mysql", "p-cpe:/a:redhat:enterprise_linux:mysql"], "id": "MYSQL_5_7_13_RPM.NASL", "href": "https://www.tenable.com/plugins/nessus/91998", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91998);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/03\");\n\n script_cve_id(\n \"CVE-2016-2105\",\n \"CVE-2016-3424\",\n \"CVE-2016-3440\",\n \"CVE-2016-3452\",\n \"CVE-2016-3459\",\n \"CVE-2016-3477\",\n \"CVE-2016-3486\",\n \"CVE-2016-3501\",\n \"CVE-2016-3518\",\n \"CVE-2016-3521\",\n \"CVE-2016-3588\",\n \"CVE-2016-3614\",\n \"CVE-2016-3615\",\n \"CVE-2016-5436\",\n \"CVE-2016-5437\",\n \"CVE-2016-5439\",\n \"CVE-2016-5440\",\n \"CVE-2016-5441\",\n \"CVE-2016-5442\",\n \"CVE-2016-5443\",\n \"CVE-2016-5444\",\n \"CVE-2016-8288\"\n );\n script_bugtraq_id(\n 89757,\n 91902,\n 91906,\n 91910,\n 91915,\n 91917,\n 91932,\n 91943,\n 91949,\n 91953,\n 91960,\n 91963,\n 91967,\n 91969,\n 91974,\n 91976,\n 91980,\n 91983,\n 91987,\n 91992,\n 91999,\n 93740\n );\n\n script_name(english:\"Oracle MySQL 5.7.x < 5.7.13 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of MySQL running on the remote host is 5.7.x prior to\n5.7.13. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the\n EVP_EncodeUpdate() function within file\n crypto/evp/encode.c that is triggered when handling\n a large amount of input data. An unauthenticated, remote\n attacker can exploit this to cause a denial of service\n condition. (CVE-2016-2105)\n\n - Multiple unspecified flaws exist in the Optimizer\n subcomponent that allow an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3424, CVE-2016-3440, CVE-2016-3501,\n CVE-2016-3518)\n\n - An unspecified flaw exists in the Security: Encryption\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - Multiple unspecified flaws exist in the InnoDB\n subcomponent that allow an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3459, CVE-2016-5436)\n\n - An unspecified flaw exists in the Parser subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Types subcomponent\n that allows an authenticated, remote attacker to cause\n a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the InnoDB subcomponent\n that allows an authenticated, remote attacker to impact\n integrity and confidentiality. (CVE-2016-3588)\n\n - Multiple unspecified flaws exist in the Security:\n Encryption subcomponent that allow an authenticated,\n remote attacker to cause a denial of service condition.\n (CVE-2016-3614, CVE-2016-5442)\n\n - An unspecified flaw exists in the DML subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Log subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-5437)\n\n - An unspecified flaw exists in the Privileges\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Replication\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-5441)\n\n - An unspecified flaw exists in the Connection\n subcomponent that allows a local attacker to cause a\n denial of service condition. (CVE-2016-5443)\n\n - An unspecified flaw exists in the Connection\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin\n subcomponent that allows an authenticated, remote\n attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple flaws exist in InnoDB that are triggered when\n handling specially crafted 'ALTER TABLE' operations. An\n authenticated, remote attacker can exploit these issues\n to crash the database, resulting in a denial of service\n condition.\n\n - Multiple overflow conditions exist due to improper\n validation of user-supplied input. An authenticated,\n remote attacker can exploit these issues to cause a\n denial of service condition or the execution of\n arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser\n structure that is triggered during the validation of\n stored procedure names. An authenticated, remote\n attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB\n memcached plugin due to improper validation of\n user-supplied input. An authenticated, remote attacker\n can exploit these issues to cause a denial of service\n condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when\n invoking Enterprise Encryption functions in multiple\n threads simultaneously or after creating and dropping\n them. An authenticated, remote attacker can exploit this\n to crash the database, resulting in a denial of service\n condition.\n\n - An unspecified flaw exists that is triggered when\n handling a 'SELECT ... GROUP BY ... FOR UPDATE' query\n executed with a loose index scan. An authenticated,\n remote attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when\n performing a 'FLUSH TABLES' operation on a table with a\n discarded tablespace. An authenticated, remote attacker\n can exploit this to crash the database, resulting in a\n denial of service condition.\n\n - A flaw exists in InnoDB that is triggered when\n performing an 'OPTIMIZE TABLE' operation on a table with\n a full-text index. An authenticated, remote attacker can\n exploit this to crash the database, resulting in a\n denial of service condition.\n\n - An unspecified flaw exists that is triggered when\n performing an UPDATE operation on a generated virtual\n BLOB column. An authenticated, remote attacker can\n exploit this to crash the database, resulting in a\n denial of service condition.\n\n - An unspecified flaw exists that is triggered when\n performing a 'SHOW CREATE TABLE' operation on a table\n with a generated column. An authenticated, remote\n attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead\nrelied only on the application's self-reported version number.\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n # http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bac902d5\");\n script_set_attribute(attribute:\"see_also\", value:\"https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-13.html\");\n # http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3089849.xml\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?42cde00c\");\n # https://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3235388.xml\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453a538d\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.oracle.com/rs?type=doc&id=2157431.1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to MySQL version 5.7.13 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-8288\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/11\");\n\n script_set_attribute(attribute:\"agent\", value:\"unix\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:mysql\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\");\n script_require_ports(\"Host/RedHat/release\", \"Host/AmazonLinux/release\", \"Host/SuSE/release\", \"Host/CentOS/release\");\n\n exit(0);\n}\n\ninclude(\"mysql_version.inc\");\n\nfix_version = \"5.7.13\";\nexists_version = \"5.7\";\n\nmysql_check_rpms(mysql_packages:default_mysql_rpm_list_server_only, fix_ver:fix_version, exists_ver:exists_version, rhel_os_list:default_mysql_rhel_os_list, centos_os_list:default_mysql_centos_os_list, suse_os_list:default_mysql_suse_os_list, ala_os_list:default_mysql_ala_os_list, severity:SECURITY_WARNING);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:08", "description": "The version of MySQL running on the remote host is 5.7.x prior to 5.7.13. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the EVP_EncodeUpdate() function within file crypto/evp/encode.c that is triggered when handling a large amount of input data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2105)\n\n - Multiple unspecified flaws exist in the Optimizer subcomponent that allow an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3424, CVE-2016-3440, CVE-2016-3501, CVE-2016-3518)\n\n - An unspecified flaw exists in the Security: Encryption subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3459, CVE-2016-5436)\n\n - An unspecified flaw exists in the Parser subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Types subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to impact integrity and confidentiality. (CVE-2016-3588)\n\n - Multiple unspecified flaws exist in the Security:\n Encryption subcomponent that allow an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3614, CVE-2016-5442)\n\n - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Log subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5437)\n\n - An unspecified flaw exists in the Privileges subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-5441)\n\n - An unspecified flaw exists in the Connection subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-5443)\n\n - An unspecified flaw exists in the Connection subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple flaws exist in InnoDB that are triggered when handling specially crafted 'ALTER TABLE' operations. An authenticated, remote attacker can exploit these issues to crash the database, resulting in a denial of service condition.\n\n - Multiple overflow conditions exist due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser structure that is triggered during the validation of stored procedure names. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB memcached plugin due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when invoking Enterprise Encryption functions in multiple threads simultaneously or after creating and dropping them. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when handling a 'SELECT ... GROUP BY ... FOR UPDATE' query executed with a loose index scan. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when performing a 'FLUSH TABLES' operation on a table with a discarded tablespace. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - A flaw exists in InnoDB that is triggered when performing an 'OPTIMIZE TABLE' operation on a table with a full-text index. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when performing an UPDATE operation on a generated virtual BLOB column. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when performing a 'SHOW CREATE TABLE' operation on a table with a generated column. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2016-07-20T00:00:00", "type": "nessus", "title": "MySQL 5.7.x < 5.7.13 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-2105", "CVE-2016-3424", "CVE-2016-3440", "CVE-2016-3452", "CVE-2016-3459", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3518", "CVE-2016-3521", "CVE-2016-3588", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5436", "CVE-2016-5437", "CVE-2016-5439", "CVE-2016-5440", "CVE-2016-5441", "CVE-2016-5442", "CVE-2016-5443", "CVE-2016-5444", "CVE-2016-8288"], "modified": "2019-11-14T00:00:00", "cpe": ["cpe:/a:oracle:mysql"], "id": "MYSQL_5_7_13.NASL", "href": "https://www.tenable.com/plugins/nessus/91997", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91997);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2019/11/14\");\n\n script_cve_id(\n \"CVE-2016-2105\",\n \"CVE-2016-3424\",\n \"CVE-2016-3440\",\n \"CVE-2016-3452\",\n \"CVE-2016-3459\",\n \"CVE-2016-3477\",\n \"CVE-2016-3486\",\n \"CVE-2016-3501\",\n \"CVE-2016-3518\",\n \"CVE-2016-3521\",\n \"CVE-2016-3588\",\n \"CVE-2016-3614\",\n \"CVE-2016-3615\",\n \"CVE-2016-5436\",\n \"CVE-2016-5437\",\n \"CVE-2016-5439\",\n \"CVE-2016-5440\",\n \"CVE-2016-5441\",\n \"CVE-2016-5442\",\n \"CVE-2016-5443\",\n \"CVE-2016-5444\",\n \"CVE-2016-8288\"\n );\n script_bugtraq_id(\n 89757,\n 91902,\n 91906,\n 91910,\n 91915,\n 91917,\n 91932,\n 91943,\n 91949,\n 91953,\n 91960,\n 91963,\n 91967,\n 91969,\n 91974,\n 91976,\n 91980,\n 91983,\n 91987,\n 91992,\n 91999,\n 93740\n );\n\n script_name(english:\"MySQL 5.7.x < 5.7.13 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of MySQL server.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of MySQL running on the remote host is 5.7.x prior to\n5.7.13. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the\n EVP_EncodeUpdate() function within file\n crypto/evp/encode.c that is triggered when handling\n a large amount of input data. An unauthenticated, remote\n attacker can exploit this to cause a denial of service\n condition. (CVE-2016-2105)\n\n - Multiple unspecified flaws exist in the Optimizer\n subcomponent that allow an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3424, CVE-2016-3440, CVE-2016-3501,\n CVE-2016-3518)\n\n - An unspecified flaw exists in the Security: Encryption\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - Multiple unspecified flaws exist in the InnoDB\n subcomponent that allow an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3459, CVE-2016-5436)\n\n - An unspecified flaw exists in the Parser subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Types subcomponent\n that allows an authenticated, remote attacker to cause\n a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the InnoDB subcomponent\n that allows an authenticated, remote attacker to impact\n integrity and confidentiality. (CVE-2016-3588)\n\n - Multiple unspecified flaws exist in the Security:\n Encryption subcomponent that allow an authenticated,\n remote attacker to cause a denial of service condition.\n (CVE-2016-3614, CVE-2016-5442)\n\n - An unspecified flaw exists in the DML subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Log subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-5437)\n\n - An unspecified flaw exists in the Privileges\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Replication\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-5441)\n\n - An unspecified flaw exists in the Connection\n subcomponent that allows a local attacker to cause a\n denial of service condition. (CVE-2016-5443)\n\n - An unspecified flaw exists in the Connection\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin\n subcomponent that allows an authenticated, remote\n attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple flaws exist in InnoDB that are triggered when\n handling specially crafted 'ALTER TABLE' operations. An\n authenticated, remote attacker can exploit these issues\n to crash the database, resulting in a denial of service\n condition.\n\n - Multiple overflow conditions exist due to improper\n validation of user-supplied input. An authenticated,\n remote attacker can exploit these issues to cause a\n denial of service condition or the execution of\n arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser\n structure that is triggered during the validation of\n stored procedure names. An authenticated, remote\n attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB\n memcached plugin due to improper validation of\n user-supplied input. An authenticated, remote attacker\n can exploit these issues to cause a denial of service\n condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when\n invoking Enterprise Encryption functions in multiple\n threads simultaneously or after creating and dropping\n them. An authenticated, remote attacker can exploit this\n to crash the database, resulting in a denial of service\n condition.\n\n - An unspecified flaw exists that is triggered when\n handling a 'SELECT ... GROUP BY ... FOR UPDATE' query\n executed with a loose index scan. An authenticated,\n remote attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when\n performing a 'FLUSH TABLES' operation on a table with a\n discarded tablespace. An authenticated, remote attacker\n can exploit this to crash the database, resulting in a\n denial of service condition.\n\n - A flaw exists in InnoDB that is triggered when\n performing an 'OPTIMIZE TABLE' operation on a table with\n a full-text index. An authenticated, remote attacker can\n exploit this to crash the database, resulting in a\n denial of service condition.\n\n - An unspecified flaw exists that is triggered when\n performing an UPDATE operation on a generated virtual\n BLOB column. An authenticated, remote attacker can\n exploit this to crash the database, resulting in a\n denial of service condition.\n\n - An unspecified flaw exists that is triggered when\n performing a 'SHOW CREATE TABLE' operation on a table\n with a generated column. An authenticated, remote\n attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead\nrelied only on the application's self-reported version number.\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n # http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bac902d5\");\n script_set_attribute(attribute:\"see_also\", value:\"https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-13.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to MySQL version 5.7.13 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-8288\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/20\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:mysql\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mysql_version.nasl\", \"mysql_login.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/mysql\", 3306);\n\n exit(0);\n}\n\ninclude(\"mysql_version.inc\");\n\nmysql_check_version(fixed:'5.7.13', min:'5.7', severity:SECURITY_WARNING);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:26:04", "description": "Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.\n\nMySQL has been updated to 5.5.50 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.10 has been updated to MySQL 5.6.31. Ubuntu 16.04 LTS has been updated to MySQL 5.7.13.\n\nIn addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.\n\nPlease see the following for more information:\nhttp://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-13.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720 .html.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-07-22T00:00:00", "type": "nessus", "title": "Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : mysql-5.5, mysql-5.6, mysql-5.7 vulnerabilities (USN-3040-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3424", "CVE-2016-3459", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3518", "CVE-2016-3521", "CVE-2016-3588", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5436", "CVE-2016-5437", "CVE-2016-5439", "CVE-2016-5440", "CVE-2016-5441", "CVE-2016-5442", "CVE-2016-5443"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.5", "p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.6", "p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.7", "cpe:/o:canonical:ubuntu_linux:12.04:-:lts", "cpe:/o:canonical:ubuntu_linux:14.04", "cpe:/o:canonical:ubuntu_linux:15.10", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3040-1.NASL", "href": "https://www.tenable.com/plugins/nessus/92511", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3040-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(92511);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2016-3424\", \"CVE-2016-3459\", \"CVE-2016-3477\", \"CVE-2016-3486\", \"CVE-2016-3501\", \"CVE-2016-3518\", \"CVE-2016-3521\", \"CVE-2016-3588\", \"CVE-2016-3614\", \"CVE-2016-3615\", \"CVE-2016-5436\", \"CVE-2016-5437\", \"CVE-2016-5439\", \"CVE-2016-5440\", \"CVE-2016-5441\", \"CVE-2016-5442\", \"CVE-2016-5443\");\n script_xref(name:\"USN\", value:\"3040-1\");\n\n script_name(english:\"Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : mysql-5.5, mysql-5.6, mysql-5.7 vulnerabilities (USN-3040-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Multiple security issues were discovered in MySQL and this update\nincludes new upstream MySQL versions to fix these issues.\n\nMySQL has been updated to 5.5.50 in Ubuntu 12.04 LTS and Ubuntu 14.04\nLTS. Ubuntu 15.10 has been updated to MySQL 5.6.31. Ubuntu 16.04 LTS\nhas been updated to MySQL 5.7.13.\n\nIn addition to security fixes, the updated packages contain bug fixes,\nnew features, and possibly incompatible changes.\n\nPlease see the following for more information:\nhttp://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html\nhttp://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html\nhttp://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-13.html\nhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720\n.html.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3040-1/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Update the affected mysql-server-5.5, mysql-server-5.6 and / or\nmysql-server-5.7 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.5\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:15.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2023 Canonical, Inc. / NASL script (C) 2016-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(12\\.04|14\\.04|15\\.10|16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 12.04 / 14.04 / 15.10 / 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"12.04\", pkgname:\"mysql-server-5.5\", pkgver:\"5.5.50-0ubuntu0.12.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"mysql-server-5.5\", pkgver:\"5.5.50-0ubuntu0.14.04.1\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"mysql-server-5.6\", pkgver:\"5.6.31-0ubuntu0.15.10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"mysql-server-5.7\", pkgver:\"5.7.13-0ubuntu0.16.04.2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mysql-server-5.5 / mysql-server-5.6 / mysql-server-5.7\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-26T15:35:56", "description": "The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 101, 7 Update 111, or 6 Update 121. It is, therefore, affected by multiple vulnerabilities :\n\n - An unspecified flaw exists in the CORBA subcomponent that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-3458)\n\n - An unspecified flaw exists in the Networking subcomponent that allows a local attacker to impact integrity. (CVE-2016-3485)\n\n - An unspecified flaw exists in the JavaFX subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3498)\n\n - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3500)\n\n - An unspecified flaw exists in the Install subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3503)\n\n - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3508)\n\n - An unspecified flaw exists in the Deployment subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3511)\n\n - An unspecified flaw exists in the Hotspot subcomponent that allows an unauthenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3550)\n\n - An unspecified flaw exists in the Install subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3552)\n\n - A flaw exists in the Hotspot subcomponent due to improper access to the MethodHandle::invokeBasic() function. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-3587)\n\n - A flaw exists in the Libraries subcomponent within the MethodHandles::dropArguments() function that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3598)\n\n - A flaw exists in the Hotspot subcomponent within the ClassVerifier::ends_in_athrow() function when handling bytecode verification. An unauthenticated, remote attacker can exploit this to execute arbitrary code.\n (CVE-2016-3606)\n\n - An unspecified flaw exists in the Libraries subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3610)", "cvss3": {}, "published": "2016-07-22T00:00:00", "type": "nessus", "title": "Oracle Java SE Multiple Vulnerabilities (July 2016 CPU)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:oracle:jre", "cpe:/a:oracle:jdk"], "id": "ORACLE_JAVA_CPU_JUL_2016.NASL", "href": "https://www.tenable.com/plugins/nessus/92516", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92516);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2016-3458\",\n \"CVE-2016-3485\",\n \"CVE-2016-3498\",\n \"CVE-2016-3500\",\n \"CVE-2016-3503\",\n \"CVE-2016-3508\",\n \"CVE-2016-3511\",\n \"CVE-2016-3550\",\n \"CVE-2016-3552\",\n \"CVE-2016-3587\",\n \"CVE-2016-3598\",\n \"CVE-2016-3606\",\n \"CVE-2016-3610\"\n );\n script_bugtraq_id(\n 91904,\n 91912,\n 91918,\n 91930,\n 91945,\n 91951,\n 91956,\n 91962,\n 91972,\n 91990,\n 91996,\n 92000,\n 92006\n );\n\n script_name(english:\"Oracle Java SE Multiple Vulnerabilities (July 2016 CPU)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains a programming platform that is\naffected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Oracle (formerly Sun) Java SE or Java for Business\ninstalled on the remote host is prior to 8 Update 101, 7 Update 111,\nor 6 Update 121. It is, therefore, affected by multiple\nvulnerabilities :\n\n - An unspecified flaw exists in the CORBA subcomponent\n that allows an unauthenticated, remote attacker to\n impact integrity. (CVE-2016-3458)\n\n - An unspecified flaw exists in the Networking\n subcomponent that allows a local attacker to impact\n integrity. (CVE-2016-3485)\n\n - An unspecified flaw exists in the JavaFX subcomponent\n that allows an unauthenticated, remote attacker to cause\n a denial of service condition. (CVE-2016-3498)\n\n - An unspecified flaw exists in the JAXP subcomponent that\n allows an unauthenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3500)\n\n - An unspecified flaw exists in the Install subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3503)\n\n - An unspecified flaw exists in the JAXP subcomponent that\n allows an unauthenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3508)\n\n - An unspecified flaw exists in the Deployment\n subcomponent that allows a local attacker to gain\n elevated privileges. (CVE-2016-3511)\n\n - An unspecified flaw exists in the Hotspot subcomponent\n that allows an unauthenticated, remote attacker to\n disclose potentially sensitive information.\n (CVE-2016-3550)\n\n - An unspecified flaw exists in the Install subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3552)\n\n - A flaw exists in the Hotspot subcomponent due to\n improper access to the MethodHandle::invokeBasic()\n function. An unauthenticated, remote attacker can\n exploit this to execute arbitrary code. (CVE-2016-3587)\n\n - A flaw exists in the Libraries subcomponent within the\n MethodHandles::dropArguments() function that allows an\n unauthenticated, remote attacker to execute arbitrary\n code. (CVE-2016-3598)\n\n - A flaw exists in the Hotspot subcomponent within the\n ClassVerifier::ends_in_athrow() function when handling\n bytecode verification. An unauthenticated, remote\n attacker can exploit this to execute arbitrary code.\n (CVE-2016-3606)\n\n - An unspecified flaw exists in the Libraries subcomponent\n that allows an unauthenticated, remote attacker to\n execute arbitrary code. (CVE-2016-3610)\");\n # https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e71b6836\");\n # http://www.oracle.com/technetwork/java/javase/8u101-relnotes-3021761.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?92867054\");\n # https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_111\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6adbf356\");\n # https://www.oracle.com/technetwork/java/javase/documentation/overview-156328.html#R160_121\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?81636e81\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Oracle JDK / JRE 8 Update 101 / 7 Update 111 / 6 Update\n121 or later. If necessary, remove any affected versions.\n\nNote that an Extended Support contract with Oracle is needed to obtain\nJDK / JRE 6 Update 95 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-3610\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:jre\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:jdk\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"sun_java_jre_installed.nasl\");\n script_require_keys(\"SMB/Java/JRE/Installed\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Check each installed JRE.\ninstalls = get_kb_list_or_exit(\"SMB/Java/JRE/*\");\n\ninfo = \"\";\nvuln = 0;\ninstalled_versions = \"\";\n\nforeach install (list_uniq(keys(installs)))\n{\n ver = install - \"SMB/Java/JRE/\";\n if (ver !~ \"^[0-9.]+\") continue;\n\n installed_versions = installed_versions + \" & \" + ver;\n\n # Fixes : (JDK|JRE) 8 Update 101 / 7 Update 111 / 6 Update 121\n if (\n ver =~ '^1\\\\.6\\\\.0_([0-9]|[0-9][0-9]|1[01][0-9]|120)([^0-9]|$)' ||\n ver =~ '^1\\\\.7\\\\.0_([0-9]|[0-9][0-9]|10[0-9]|110)([^0-9]|$)' ||\n ver =~ '^1\\\\.8\\\\.0_([0-9]|[0-9][0-9]|100)([^0-9]|$)'\n )\n {\n dirs = make_list(get_kb_list(install));\n vuln += max_index(dirs);\n\n foreach dir (dirs)\n info += '\\n Path : ' + dir;\n\n info += '\\n Installed version : ' + ver;\n info += '\\n Fixed version : 1.6.0_121 / 1.7.0_111 / 1.8.0_101\\n';\n }\n}\n\n# Report if any were found to be vulnerable.\nif (info)\n{\n port = get_kb_item(\"SMB/transport\");\n if (!port) port = 445;\n\n if (report_verbosity > 0)\n {\n if (vuln > 1) s = \"s of Java are\";\n else s = \" of Java is\";\n\n report =\n '\\n' +\n 'The following vulnerable instance'+s+' installed on the\\n' +\n 'remote host :\\n' +\n info;\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\nelse\n{\n installed_versions = substr(installed_versions, 3);\n if (\" & \" >< installed_versions)\n exit(0, \"The Java \"+installed_versions+\" installations on the remote host are not affected.\");\n else\n audit(AUDIT_INST_VER_NOT_VULN, \"Java\", installed_versions);\n}\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-08-03T14:40:00", "description": "This update for java-1_8_0-openjdk fixes the following issues :\n\n - Upgrade to version jdk8u101 (icedtea 3.1.0)\n\n - New in release 3.1.0 (2016-07-25) :\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)\n\n - S8146514: Enforce GCM limits\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)\n\n - S8149070: Enforce update ordering\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8153312: Constrain AppCDS behavior\n\n - S8154475, CVE-2016-3587: Clean up lookup visibility (bsc#989721)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)\n\n - CVE-2016-3552 (bsc#989726)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - New features\n\n - S8145547, PR1061: [AWT/Swing] Conditional support for GTK 3 on Linux\n\n - PR2821: Support building OpenJDK with --disable-headful\n\n - PR2931, G478960: Provide Infinality Support via fontconfig\n\n - PR3079: Provide option to build Shenandoah on x86_64\n\n - Import of OpenJDK 8 u92 build 14\n\n - S6869327: Add new C2 flag to keep safepoints in counted loops.\n\n - S8022865: [TESTBUG] Compressed Oops testing needs to be revised\n\n - S8029630: Thread id should be displayed as a hex number in error report\n\n - S8029726: On OS X some dtrace probe names are mismatched with Solaris\n\n - S8029727: On OS X dtrace probes Call<type>MethodA/Call<type>MethodV are not fired.\n\n - S8029728: On OS X dtrace probes SetStaticBooleanField are not fired\n\n - S8038184: XMLSignature throws StringIndexOutOfBoundsException if ID attribute value is empty String\n\n - S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits\n\n - S8041501: ImageIO reader is not capable of reading JPEGs without JFIF header\n\n - S8041900: [macosx] Java forces the use of discrete GPU\n\n - S8044363: Remove special build options for unpack200 executable\n\n - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy value for hotspot ARCH\n\n - S8046611: Build errors with gcc on sparc/fastdebug\n\n - S8047763: Recognize sparc64 as a sparc platform\n\n - S8048232: Fix for 8046471 breaks PPC64 build\n\n - S8052396: Catch exceptions resulting from missing font cmap\n\n - S8058563: InstanceKlass::_dependencies list isn't cleared from empty nmethodBucket entries\n\n - S8061624: [TESTBUG] Some tests cannot be ran under compact profiles and therefore shall be excluded\n\n - S8062901: Iterators is spelled incorrectly in the Javadoc for Spliterator\n\n - S8064330: Remove SHA224 from the default support list if SunMSCAPI enabled\n\n - S8065579: WB method to start G1 concurrent mark cycle should be introduced\n\n - S8065986: Compiler fails to NullPointerException when calling super with Object<>()\n\n - S8066974: Compiler doesn't infer method's generic type information in lambda body\n\n - S8067800: Clarify java.time.chrono.Chronology.isLeapYear for out of range years\n\n - S8068033: JNI exception pending in jdk/src/share/bin/java.c\n\n - S8068042: Check jdk/src/share/native/sun/misc/URLClassPath.c for JNI pending\n\n - S8068162: jvmtiRedefineClasses.cpp: guarantee(false) failed: OLD and/or OBSOLETE method(s) found\n\n - S8068254: Method reference uses wrong qualifying type\n\n - S8074696: Remote debugging session hangs for several minutes when calling findBootType\n\n - S8074935: jdk8 keytool doesn't validate pem files for RFC 1421 correctness, as jdk7 did\n\n - S8078423: [TESTBUG] javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on system locale\n\n - S8080492: [Parfait] Uninitialised variable in jdk/src/java/desktop/windows/native/libawt/\n\n - S8080650: Enable stubs to use frame pointers correctly\n\n - S8122944: perfdata used is seen as too high on sparc zone with jdk1.9 and causes a test failure\n\n - S8129348: Debugger hangs in trace mode with TRACE_SENDS\n\n - S8129847: Compiling methods generated by Nashorn triggers high memory usage in C2\n\n - S8130506: javac AssertionError when invoking MethodHandle.invoke with lambda parameter\n\n - S8130910: hsperfdata file is created in wrong directory and not cleaned up if /tmp/hsperfdata_<username> has wrong permissions\n\n - S8131129: Attempt to define a duplicate BMH$Species class\n\n - S8131665: Bad exception message in HandshakeHash.getFinishedHash\n\n - S8131782: C1 Class.cast optimization breaks when Class is loaded from static final\n\n - S8132503: [macosx] Chinese full stop symbol cannot be entered with Pinyin IM on OS X\n\n - S8133207: ParallelProbes.java test fails after changes for JDK-8080115\n\n - S8133924: NPE may be thrown when xsltc select a non-existing node after JDK-8062518\n\n - S8134007: Improve string folding\n\n - S8134759: jdb: Incorrect stepping inside finally block\n\n - S8134963: [Newtest] New stress test for changing the coarseness level of G1 remembered set\n\n - S8136442: Don't tie Certificate signature algorithms to ciphersuites\n\n - S8137106: EUDC (End User Defined Characters) are not displayed on Windows with Java 8u60+\n\n - S8138745: Implement ExitOnOutOfMemory and CrashOnOutOfMemory in HotSpot\n\n - S8138764: In some cases the usage of TreeLock can be replaced by other synchronization\n\n - S8139373: [TEST_BUG] java/net/MulticastSocket/MultiDead.java failed with timeout\n\n - S8139424: SIGSEGV, Problematic frame: # V [libjvm.so+0xd0c0cc] void InstanceKlass::oop_oop_iterate_oop_maps_specialized<true ,oopDesc*,MarkAndPushClosure>\n\n - S8139436: sun.security.mscapi.KeyStore might load incomplete data\n\n - S8139751: Javac crash with -XDallowStringFolding=false\n\n - S8139863: [TESTBUG] Need to port tests for JDK-8134903 to 8u-dev\n\n - S8139985: JNI exception pending in jdk/src/jdk/hprof/agent/share/native/libhprof\n\n - S8140031: SA: Searching for a value in Threads does not work\n\n - S8140249: JVM Crashing During startUp If Flight Recording is enabled\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8140587: Atomic*FieldUpdaters should use Class.isInstance instead of direct class check\n\n - S8141260: isReachable crash in windows xp\n\n - S8143297: Nashorn compilation time reported in nanoseconds\n\n - S8143397: It looks like InetAddress.isReachable(timeout) works incorrectly\n\n - S8143855: Bad printf formatting in frame_zero.cpp\n\n - S8143896: java.lang.Long is implicitly converted to double\n\n - S8143963: improve ClassLoader::trace_class_path to accept an additional outputStream* arg\n\n - S8144020: Remove long as an internal numeric type\n\n - S8144131: ArrayData.getInt implementations do not convert to int32\n\n - S8144483: One long Safepoint pause directly after each GC log rotation\n\n - S8144487: PhaseIdealLoop::build_and_optimize() must restore major_progress flag if skip_loop_opts is true\n\n - S8144885: agent/src/os/linux/libproc.h needs to support Linux/SPARC builds\n\n - S8144935: C2: safepoint is pruned from a non-counted loop\n\n - S8144937: [TEST_BUG] testlibrary_tests should be excluded for compact1 and compact2 execution\n\n - S8145017: Add support for 3 digit hotspot minor version numbers\n\n - S8145099: Better error message when SA can't attach to a process\n\n - S8145442: Add the facility to verify remembered sets for G1\n\n - S8145466: javac: No line numbers in compilation error\n\n - S8145539: (coll) AbstractMap.keySet and .values should not be volatile\n\n - S8145550: Megamorphic invoke should use CompiledFunction variants without any LinkLogic\n\n - S8145669: apply2call optimized callsite fails after becoming megamorphic\n\n - S8145722: NullPointerException in javadoc\n\n - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset() does not match AddI\n\n - S8146147: Java linker indexed property getter does not work for computed nashorn string\n\n - S8146566: OpenJDK build can't handle commas in LDFLAGS\n\n - S8146725: Issues with SignatureAndHashAlgorithm.getSupportedAlgorithms\n\n - S8146979: Backport of 8046471 breaks ppc64 build in jdk8u because 8072383 was badly backported before\n\n - S8147087: Race when reusing PerRegionTable bitmaps may result in dropped remembered set entries\n\n - S8147630: Wrong test result pushed to 8u-dev\n\n - S8147845: Varargs Array functions still leaking longs\n\n - S8147857: RMIConnector logs attribute names incorrectly\n\n - S8148353: [linux-sparc] Crash in libawt.so on Linux SPARC\n\n - S8150791: 8u76 L10n resource file translation update\n\n - Import of OpenJDK 8 u101 build 13\n\n - S6483657: MSCAPI provider does not create unique alias names\n\n - S6675699: need comprehensive fix for unconstrained ConvI2L with narrowed type\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying timestamp hash algorithm\n\n - S8081778: Use Intel x64 CPU instructions for RSA acceleration\n\n - S8130150: Implement BigInteger.montgomeryMultiply intrinsic\n\n - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts\n\n - S8143913: MSCAPI keystore should accept Certificate[] in setEntry()\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146240: Three nashorn files contain 'GNU General Public License' header\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811\n\n - S8147994: [macosx] JScrollPane jitters up/down during trackpad scrolling on MacOS/Aqua\n\n - S8151522: Disable 8130150 and 8081778 intrinsics by default\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8152098: Fix 8151522 caused test compiler/intrinsics/squaretolen/TestSquareToLen.java to fail\n\n - S8157077: 8u101 L10n resource file updates\n\n - Backports\n\n - S6260348, PR3066: GTK+ L&F JTextComponent not respecting desktop caret blink rate\n\n - S6778087, PR1061: getLocationOnScreen() always returns (0, 0) for mouse wheel events\n\n - S6961123, PR2972: setWMClass fails to null-terminate WM_CLASS string\n\n - S8008657, PR3077: JSpinner setComponentOrientation doesn't affect on text orientation\n\n - S8014212, PR2866: Robot captures black screen\n\n - S8029339, PR1061: Custom MultiResolution image support on HiDPI displays\n\n - S8031145, PR3077: Re-examine closed i18n tests to see it they can be moved to the jdk repository.\n\n - S8034856, PR3095: gcc warnings compiling src/solaris/native/sun/security/pkcs11\n\n - S8034857, PR3095: gcc warnings compiling src/solaris/native/sun/management\n\n - S8035054, PR3095: JarFacade.c should not include ctype.h\n\n - S8035287, PR3095: gcc warnings compiling various libraries files\n\n - S8038631, PR3077: Create wrapper for awt.Robot with additional functionality\n\n - S8039279, PR3077: Move awt tests to openjdk repository\n\n - S8041561, PR3077: Inconsistent opacity behaviour between JCheckBox and JRadioButton\n\n - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing tests to jdk\n\n - S8041915, PR3077: Move 8 awt tests to OpenJDK regression tests tree\n\n - S8043126, PR3077: move awt automated functional tests from AWT_Events/Lw and AWT_Events/AWT to OpenJDK repository\n\n - S8043131, PR3077: Move ShapedAndTranslucentWindows and GC functional AWT tests to regression tree\n\n - S8044157, PR3077: [TEST_BUG] Improve recently submitted AWT_Mixing tests\n\n - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758 and AltPlusNumberKeyCombinationsTest to jdk\n\n - S8044429, PR3077: move awt automated tests for AWT_Modality to OpenJDK repository\n\n - S8044762, PR2960: com/sun/jdi/OptionTest.java test time out\n\n - S8044765, PR3077: Move functional tests AWT_SystemTray/Automated to openjdk repository\n\n - S8047180, PR3077: Move functional tests AWT_Headless/Automated to OpenJDK repository\n\n - S8047367, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 2\n\n - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated functional tests to OpenJDK\n\n - S8049226, PR2960: com/sun/jdi/OptionTest.java test times out again\n\n - S8049617, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 3\n\n - S8049694, PR3077: Migrate functional AWT_DesktopProperties/Automated tests to OpenJDK\n\n - S8050885, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 4\n\n - S8051440, PR3077: move tests about maximizing undecorated to OpenJDK\n\n - S8052012, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 5\n\n - S8052408, PR3077: Move AWT_BAT functional tests to OpenJDK (3 of 3)\n\n - S8053657, PR3077: [TEST_BUG] move some 5 tests related to undecorated Frame/JFrame to JDK\n\n - S8054143, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 6\n\n - S8054358, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 7\n\n - S8054359, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 8\n\n - S8055360, PR3077: Move the rest part of AWT ShapedAndTranslucent tests to OpenJDK\n\n - S8055664, PR3077: move 14 tests about setLocationRelativeTo to jdk\n\n - S8055836, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 9\n\n - S8056911, PR3077: Remove internal API usage from ExtendedRobot class\n\n - S8057694, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 10\n\n - S8058959, PR1061:\n closed/java/awt/event/ComponentEvent/MovedResizedTwiceTe st/MovedResizedTwiceTest.java failed automatically\n\n - S8062606, PR3077: Fix a typo in java.awt.Robot class\n\n - S8063102, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063104, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8063106, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063107, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8064573, PR3077: [TEST_BUG] javax/swing/text/AbstractDocument/6968363/Test6968363.ja va is asocial pressing VK_LEFT and not releasing\n\n - S8064575, PR3077: [TEST_BUG] javax/swing/JEditorPane/6917744/bug6917744.java 100 times press keys and never releases\n\n - S8064809, PR3077: [TEST_BUG] javax/swing/JComboBox/4199622/bug4199622.java contains a lot of keyPress and not a single keyRelease\n\n - S8067441, PR3077: Some tests fails with error: cannot find symbol getSystemMnemonicKeyCodes()\n\n - S8068228, PR3077: Test closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameT est fails with GTKLookAndFeel\n\n - S8069361, PR1061: SunGraphics2D.getDefaultTransform() does not include scale factor\n\n - S8073320, PR1061: Windows HiDPI Graphics support\n\n - S8074807, PR3077: Fix some tests unnecessary using internal API\n\n - S8076315, PR3077: move 4 manual functional swing tests to regression suite\n\n - S8078504, PR3094: Zero lacks declaration of VM_Version::initialize()\n\n - S8129822, PR3077: Define 'headful' jtreg keyword\n\n - S8132123, PR1061: MultiResolutionCachedImage unnecessarily creates base image to get its size\n\n - S8133539, PR1061: [TEST_BUG] Split java/awt/image/MultiResolutionImageTest.java in two to allow restricted access\n\n - S8137571, PR1061: Linux HiDPI Graphics support\n\n - S8142406, PR1061: [TEST] MultiResolution image: need test to cover the case when @2x image is corrupted\n\n - S8145188, PR2945: No LocalVariableTable generated for the entire JDK\n\n - S8150258, PR1061: [TEST] HiDPI: create a test for multiresolution menu items icons\n\n - S8150724, PR1061: [TEST] HiDPI: create a test for multiresolution icons\n\n - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale should be taken into account for OS X\n\n - S8151841, PR2882: Build needs additional flags to compile with GCC 6 [plus parts of 8149647 & 8032045]\n\n - S8155613, PR1061: [PIT] crash in AWT_Desktop/Automated/Exceptions/BasicTest\n\n - S8156020, PR1061: 8145547 breaks AIX and and uses RTLD_NOLOAD incorrectly\n\n - S8156128, PR1061: Tests for [AWT/Swing] Conditional support for GTK 3 on Linux\n\n - S8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651)\n\n - S8159244, PR3074: Partially initialized string object created by C2's string concat optimization may escape\n\n - S8159690, PR3077: [TESTBUG] Mark headful tests with @key headful.\n\n - S8160294, PR2882, PR3095: Some client libraries cannot be built with GCC 6\n\n - Bug fixes\n\n - PR1958: GTKLookAndFeel does not honor gtk-alternative-button-order\n\n - PR2822: Feed LIBS & CFLAGS into configure rather than make to avoid re-discovery by OpenJDK configure\n\n - PR2932: Support ccache in a non-automagic manner\n\n - PR2933: Support ccache 3.2 and later\n\n - PR2964: Set system defaults based on OS\n\n - PR2974, RH1337583: PKCS#10 certificate requests now use CRLF line endings rather than system line endings\n\n - PR3078: Remove duplicated line dating back to 6788347 and 6894807\n\n - PR3083, RH1346460: Regression in SSL debug output without an ECC provider\n\n - PR3089: Remove old memory limits patch\n\n - PR3090, RH1204159: SystemTap is heavily confused by multiple JDKs\n\n - PR3095: Fix warnings in URLClassPath.c\n\n - PR3096: Remove dead --disable-optimizations option\n\n - PR3105: Use version from hotspot.map to create tarball filename\n\n - PR3106: Handle both correctly-spelt property 'enableCustomValueHandler' introduced by S8079718 and typo version\n\n - PR3108: Shenandoah patches not included in release tarball\n\n - PR3110: Update hotspot.map documentation in INSTALL\n\n - AArch64 port\n\n - S8145320, PR3078: Create unsafe_arraycopy and generic_arraycopy for AArch64\n\n - S8148328, PR3078: aarch64: redundant lsr instructions in stub code.\n\n - S8148783, PR3078: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3078: aarch64: generate_copy_longs calls align() incorrectly\n\n - S8149080, PR3078: AArch64: Recognise disjoint array copy in stub code\n\n - S8149365, PR3078: aarch64: memory copy does not prefetch on backwards copy\n\n - S8149907, PR3078: aarch64: use load/store pair instructions in call_stub\n\n - S8150038, PR3078: aarch64: make use of CBZ and CBNZ when comparing narrow pointer with zero\n\n - S8150045, PR3078: arraycopy causes segfaults in SATB during garbage collection\n\n - S8150082, PR3078: aarch64: optimise small array copy\n\n - S8150229, PR3078: aarch64: pipeline class for several instructions is not set correctly\n\n - S8150313, PR3078: aarch64: optimise array copy using SIMD instructions\n\n - S8150394, PR3078: aarch64: add support for 8.1 LSE CAS instructions\n\n - S8151340, PR3078: aarch64: prefetch the destination word for write prior to ldxr/stxr loops.\n\n - S8151502, PR3078: optimize pd_disjoint_words and pd_conjoint_words\n\n - S8151775, PR3078: aarch64: add support for 8.1 LSE atomic operations\n\n - S8152537, PR3078: aarch64: Make use of CBZ and CBNZ when comparing unsigned values with zero.\n\n - S8152840, PR3078: aarch64: improve _unsafe_arraycopy stub routine\n\n - S8153713, PR3078: aarch64: improve short array clearing using store pair\n\n - S8153797, PR3078: aarch64: Add Arrays.fill stub code\n\n - S8154537, PR3078: AArch64: some integer rotate instructions are never emitted\n\n - S8154739, PR3078: AArch64: TemplateTable::fast_xaccess loads in wrong mode\n\n - S8155015, PR3078: Aarch64: bad assert in spill generation code\n\n - S8155100, PR3078: AArch64: Relax alignment requirement for byte_map_base\n\n - S8155612, PR3078: Aarch64: vector nodes need to support misaligned offset\n\n - S8155617, PR3078: aarch64: ClearArray does not use DC ZVA\n\n - S8155653, PR3078: TestVectorUnalignedOffset.java not pushed with 8155612\n\n - S8156731, PR3078: aarch64: java/util/Arrays/Correct.java fails due to _generic_arraycopy stub routine\n\n - S8157841, PR3078: aarch64: prefetch ignores cache line size\n\n - S8157906, PR3078: aarch64: some more integer rotate instructions are never emitted\n\n - S8158913, PR3078: aarch64: SEGV running Spark terasort\n\n - S8159052, PR3078: aarch64: optimise unaligned copies in pd_disjoint_words and pd_conjoint_words\n\n - S8159063, PR3078: aarch64: optimise unaligned array copy long\n\n - PR3078: Cleanup remaining differences from aarch64/jdk8u tree\n\n - Fix script linking /usr/share/javazi/tzdb.dat for platform where it applies (bsc#987895)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684)\n\n avoid some crashes\n\nThis update was imported from the SUSE:SLE-12-SP1:Update update project.", "cvss3": {}, "published": "2016-08-16T00:00:00", "type": "nessus", "title": "openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-978)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:java-1_8_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debugsource", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-src", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2016-978.NASL", "href": "https://www.tenable.com/plugins/nessus/92979", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-978.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92979);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3552\", \"CVE-2016-3587\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-978)\");\n script_summary(english:\"Check for the openSUSE-2016-978 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for java-1_8_0-openjdk fixes the following issues :\n\n - Upgrade to version jdk8u101 (icedtea 3.1.0)\n\n - New in release 3.1.0 (2016-07-25) :\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (bsc#989734)\n\n - S8146514: Enforce GCM limits\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (bsc#989730)\n\n - S8149070: Enforce update ordering\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8153312: Constrain AppCDS behavior\n\n - S8154475, CVE-2016-3587: Clean up lookup visibility\n (bsc#989721)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (bsc#989725)\n\n - CVE-2016-3552 (bsc#989726)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - New features\n\n - S8145547, PR1061: [AWT/Swing] Conditional support for\n GTK 3 on Linux\n\n - PR2821: Support building OpenJDK with --disable-headful\n\n - PR2931, G478960: Provide Infinality Support via\n fontconfig\n\n - PR3079: Provide option to build Shenandoah on x86_64\n\n - Import of OpenJDK 8 u92 build 14\n\n - S6869327: Add new C2 flag to keep safepoints in counted\n loops.\n\n - S8022865: [TESTBUG] Compressed Oops testing needs to be\n revised\n\n - S8029630: Thread id should be displayed as a hex number\n in error report\n\n - S8029726: On OS X some dtrace probe names are mismatched\n with Solaris\n\n - S8029727: On OS X dtrace probes\n Call<type>MethodA/Call<type>MethodV are not fired.\n\n - S8029728: On OS X dtrace probes SetStaticBooleanField\n are not fired\n\n - S8038184: XMLSignature throws\n StringIndexOutOfBoundsException if ID attribute value is\n empty String\n\n - S8038349: Signing XML with DSA throws Exception when key\n is larger than 1024 bits\n\n - S8041501: ImageIO reader is not capable of reading JPEGs\n without JFIF header\n\n - S8041900: [macosx] Java forces the use of discrete GPU\n\n - S8044363: Remove special build options for unpack200\n executable\n\n - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy\n value for hotspot ARCH\n\n - S8046611: Build errors with gcc on sparc/fastdebug\n\n - S8047763: Recognize sparc64 as a sparc platform\n\n - S8048232: Fix for 8046471 breaks PPC64 build\n\n - S8052396: Catch exceptions resulting from missing font\n cmap\n\n - S8058563: InstanceKlass::_dependencies list isn't\n cleared from empty nmethodBucket entries\n\n - S8061624: [TESTBUG] Some tests cannot be ran under\n compact profiles and therefore shall be excluded\n\n - S8062901: Iterators is spelled incorrectly in the\n Javadoc for Spliterator\n\n - S8064330: Remove SHA224 from the default support list if\n SunMSCAPI enabled\n\n - S8065579: WB method to start G1 concurrent mark cycle\n should be introduced\n\n - S8065986: Compiler fails to NullPointerException when\n calling super with Object<>()\n\n - S8066974: Compiler doesn't infer method's generic type\n information in lambda body\n\n - S8067800: Clarify java.time.chrono.Chronology.isLeapYear\n for out of range years\n\n - S8068033: JNI exception pending in\n jdk/src/share/bin/java.c\n\n - S8068042: Check\n jdk/src/share/native/sun/misc/URLClassPath.c for JNI\n pending\n\n - S8068162: jvmtiRedefineClasses.cpp: guarantee(false)\n failed: OLD and/or OBSOLETE method(s) found\n\n - S8068254: Method reference uses wrong qualifying type\n\n - S8074696: Remote debugging session hangs for several\n minutes when calling findBootType\n\n - S8074935: jdk8 keytool doesn't validate pem files for\n RFC 1421 correctness, as jdk7 did\n\n - S8078423: [TESTBUG]\n javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on\n system locale\n\n - S8080492: [Parfait] Uninitialised variable in\n jdk/src/java/desktop/windows/native/libawt/\n\n - S8080650: Enable stubs to use frame pointers correctly\n\n - S8122944: perfdata used is seen as too high on sparc\n zone with jdk1.9 and causes a test failure\n\n - S8129348: Debugger hangs in trace mode with TRACE_SENDS\n\n - S8129847: Compiling methods generated by Nashorn\n triggers high memory usage in C2\n\n - S8130506: javac AssertionError when invoking\n MethodHandle.invoke with lambda parameter\n\n - S8130910: hsperfdata file is created in wrong directory\n and not cleaned up if /tmp/hsperfdata_<username> has\n wrong permissions\n\n - S8131129: Attempt to define a duplicate BMH$Species\n class\n\n - S8131665: Bad exception message in\n HandshakeHash.getFinishedHash\n\n - S8131782: C1 Class.cast optimization breaks when Class\n is loaded from static final\n\n - S8132503: [macosx] Chinese full stop symbol cannot be\n entered with Pinyin IM on OS X\n\n - S8133207: ParallelProbes.java test fails after changes\n for JDK-8080115\n\n - S8133924: NPE may be thrown when xsltc select a\n non-existing node after JDK-8062518\n\n - S8134007: Improve string folding\n\n - S8134759: jdb: Incorrect stepping inside finally block\n\n - S8134963: [Newtest] New stress test for changing the\n coarseness level of G1 remembered set\n\n - S8136442: Don't tie Certificate signature algorithms to\n ciphersuites\n\n - S8137106: EUDC (End User Defined Characters) are not\n displayed on Windows with Java 8u60+\n\n - S8138745: Implement ExitOnOutOfMemory and\n CrashOnOutOfMemory in HotSpot\n\n - S8138764: In some cases the usage of TreeLock can be\n replaced by other synchronization\n\n - S8139373: [TEST_BUG]\n java/net/MulticastSocket/MultiDead.java failed with\n timeout\n\n - S8139424: SIGSEGV, Problematic frame: # V\n [libjvm.so+0xd0c0cc] void\n InstanceKlass::oop_oop_iterate_oop_maps_specialized<true\n ,oopDesc*,MarkAndPushClosure>\n\n - S8139436: sun.security.mscapi.KeyStore might load\n incomplete data\n\n - S8139751: Javac crash with -XDallowStringFolding=false\n\n - S8139863: [TESTBUG] Need to port tests for JDK-8134903\n to 8u-dev\n\n - S8139985: JNI exception pending in\n jdk/src/jdk/hprof/agent/share/native/libhprof\n\n - S8140031: SA: Searching for a value in Threads does not\n work\n\n - S8140249: JVM Crashing During startUp If Flight\n Recording is enabled\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8140587: Atomic*FieldUpdaters should use\n Class.isInstance instead of direct class check\n\n - S8141260: isReachable crash in windows xp\n\n - S8143297: Nashorn compilation time reported in\n nanoseconds\n\n - S8143397: It looks like InetAddress.isReachable(timeout)\n works incorrectly\n\n - S8143855: Bad printf formatting in frame_zero.cpp\n\n - S8143896: java.lang.Long is implicitly converted to\n double\n\n - S8143963: improve ClassLoader::trace_class_path to\n accept an additional outputStream* arg\n\n - S8144020: Remove long as an internal numeric type\n\n - S8144131: ArrayData.getInt implementations do not\n convert to int32\n\n - S8144483: One long Safepoint pause directly after each\n GC log rotation\n\n - S8144487: PhaseIdealLoop::build_and_optimize() must\n restore major_progress flag if skip_loop_opts is true\n\n - S8144885: agent/src/os/linux/libproc.h needs to support\n Linux/SPARC builds\n\n - S8144935: C2: safepoint is pruned from a non-counted\n loop\n\n - S8144937: [TEST_BUG] testlibrary_tests should be\n excluded for compact1 and compact2 execution\n\n - S8145017: Add support for 3 digit hotspot minor version\n numbers\n\n - S8145099: Better error message when SA can't attach to a\n process\n\n - S8145442: Add the facility to verify remembered sets for\n G1\n\n - S8145466: javac: No line numbers in compilation error\n\n - S8145539: (coll) AbstractMap.keySet and .values should\n not be volatile\n\n - S8145550: Megamorphic invoke should use CompiledFunction\n variants without any LinkLogic\n\n - S8145669: apply2call optimized callsite fails after\n becoming megamorphic\n\n - S8145722: NullPointerException in javadoc\n\n - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset()\n does not match AddI\n\n - S8146147: Java linker indexed property getter does not\n work for computed nashorn string\n\n - S8146566: OpenJDK build can't handle commas in LDFLAGS\n\n - S8146725: Issues with\n SignatureAndHashAlgorithm.getSupportedAlgorithms\n\n - S8146979: Backport of 8046471 breaks ppc64 build in\n jdk8u because 8072383 was badly backported before\n\n - S8147087: Race when reusing PerRegionTable bitmaps may\n result in dropped remembered set entries\n\n - S8147630: Wrong test result pushed to 8u-dev\n\n - S8147845: Varargs Array functions still leaking longs\n\n - S8147857: RMIConnector logs attribute names incorrectly\n\n - S8148353: [linux-sparc] Crash in libawt.so on Linux\n SPARC\n\n - S8150791: 8u76 L10n resource file translation update\n\n - Import of OpenJDK 8 u101 build 13\n\n - S6483657: MSCAPI provider does not create unique alias\n names\n\n - S6675699: need comprehensive fix for unconstrained\n ConvI2L with narrowed type\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying\n timestamp hash algorithm\n\n - S8081778: Use Intel x64 CPU instructions for RSA\n acceleration\n\n - S8130150: Implement BigInteger.montgomeryMultiply\n intrinsic\n\n - S8130735: javax.swing.TimerQueue: timer fires late when\n another timer starts\n\n - S8143913: MSCAPI keystore should accept Certificate[] in\n setEntry()\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146240: Three nashorn files contain 'GNU General\n Public License' header\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket\n accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory\n regression tests fail after JDK-8138811\n\n - S8147994: [macosx] JScrollPane jitters up/down during\n trackpad scrolling on MacOS/Aqua\n\n - S8151522: Disable 8130150 and 8081778 intrinsics by\n default\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8152098: Fix 8151522 caused test\n compiler/intrinsics/squaretolen/TestSquareToLen.java to\n fail\n\n - S8157077: 8u101 L10n resource file updates\n\n - Backports\n\n - S6260348, PR3066: GTK+ L&F JTextComponent not respecting\n desktop caret blink rate\n\n - S6778087, PR1061: getLocationOnScreen() always returns\n (0, 0) for mouse wheel events\n\n - S6961123, PR2972: setWMClass fails to null-terminate\n WM_CLASS string\n\n - S8008657, PR3077: JSpinner setComponentOrientation\n doesn't affect on text orientation\n\n - S8014212, PR2866: Robot captures black screen\n\n - S8029339, PR1061: Custom MultiResolution image support\n on HiDPI displays\n\n - S8031145, PR3077: Re-examine closed i18n tests to see it\n they can be moved to the jdk repository.\n\n - S8034856, PR3095: gcc warnings compiling\n src/solaris/native/sun/security/pkcs11\n\n - S8034857, PR3095: gcc warnings compiling\n src/solaris/native/sun/management\n\n - S8035054, PR3095: JarFacade.c should not include ctype.h\n\n - S8035287, PR3095: gcc warnings compiling various\n libraries files\n\n - S8038631, PR3077: Create wrapper for awt.Robot with\n additional functionality\n\n - S8039279, PR3077: Move awt tests to openjdk repository\n\n - S8041561, PR3077: Inconsistent opacity behaviour between\n JCheckBox and JRadioButton\n\n - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing\n tests to jdk\n\n - S8041915, PR3077: Move 8 awt tests to OpenJDK regression\n tests tree\n\n - S8043126, PR3077: move awt automated functional tests\n from AWT_Events/Lw and AWT_Events/AWT to OpenJDK\n repository\n\n - S8043131, PR3077: Move ShapedAndTranslucentWindows and\n GC functional AWT tests to regression tree\n\n - S8044157, PR3077: [TEST_BUG] Improve recently submitted\n AWT_Mixing tests\n\n - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758\n and AltPlusNumberKeyCombinationsTest to jdk\n\n - S8044429, PR3077: move awt automated tests for\n AWT_Modality to OpenJDK repository\n\n - S8044762, PR2960: com/sun/jdi/OptionTest.java test time\n out\n\n - S8044765, PR3077: Move functional tests\n AWT_SystemTray/Automated to openjdk repository\n\n - S8047180, PR3077: Move functional tests\n AWT_Headless/Automated to OpenJDK repository\n\n - S8047367, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 2\n\n - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated\n functional tests to OpenJDK\n\n - S8049226, PR2960: com/sun/jdi/OptionTest.java test times\n out again\n\n - S8049617, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 3\n\n - S8049694, PR3077: Migrate functional\n AWT_DesktopProperties/Automated tests to OpenJDK\n\n - S8050885, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 4\n\n - S8051440, PR3077: move tests about maximizing\n undecorated to OpenJDK\n\n - S8052012, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 5\n\n - S8052408, PR3077: Move AWT_BAT functional tests to\n OpenJDK (3 of 3)\n\n - S8053657, PR3077: [TEST_BUG] move some 5 tests related\n to undecorated Frame/JFrame to JDK\n\n - S8054143, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 6\n\n - S8054358, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 7\n\n - S8054359, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 8\n\n - S8055360, PR3077: Move the rest part of AWT\n ShapedAndTranslucent tests to OpenJDK\n\n - S8055664, PR3077: move 14 tests about\n setLocationRelativeTo to jdk\n\n - S8055836, PR3077: move awt tests from AWT_Modality to\n OpenJDK repository - part 9\n\n - S8056911, PR3077: Remove internal API usage from\n ExtendedRobot class\n\n - S8057694, PR3077: move awt tests from AWT_Modality to\n OpenJDK repository - part 10\n\n - S8058959, PR1061:\n closed/java/awt/event/ComponentEvent/MovedResizedTwiceTe\n st/MovedResizedTwiceTest.java failed automatically\n\n - S8062606, PR3077: Fix a typo in java.awt.Robot class\n\n - S8063102, PR3077: Change open awt regression tests to\n avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063104, PR3077: Change open awt regression tests to\n avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8063106, PR3077: Change open swing regression tests to\n avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063107, PR3077: Change open swing regression tests to\n avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8064573, PR3077: [TEST_BUG]\n javax/swing/text/AbstractDocument/6968363/Test6968363.ja\n va is asocial pressing VK_LEFT and not releasing\n\n - S8064575, PR3077: [TEST_BUG]\n javax/swing/JEditorPane/6917744/bug6917744.java 100\n times press keys and never releases\n\n - S8064809, PR3077: [TEST_BUG]\n javax/swing/JComboBox/4199622/bug4199622.java contains a\n lot of keyPress and not a single keyRelease\n\n - S8067441, PR3077: Some tests fails with error: cannot\n find symbol getSystemMnemonicKeyCodes()\n\n - S8068228, PR3077: Test\n closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameT\n est fails with GTKLookAndFeel\n\n - S8069361, PR1061: SunGraphics2D.getDefaultTransform()\n does not include scale factor\n\n - S8073320, PR1061: Windows HiDPI Graphics support\n\n - S8074807, PR3077: Fix some tests unnecessary using\n internal API\n\n - S8076315, PR3077: move 4 manual functional swing tests\n to regression suite\n\n - S8078504, PR3094: Zero lacks declaration of\n VM_Version::initialize()\n\n - S8129822, PR3077: Define 'headful' jtreg keyword\n\n - S8132123, PR1061: MultiResolutionCachedImage\n unnecessarily creates base image to get its size\n\n - S8133539, PR1061: [TEST_BUG] Split\n java/awt/image/MultiResolutionImageTest.java in two to\n allow restricted access\n\n - S8137571, PR1061: Linux HiDPI Graphics support\n\n - S8142406, PR1061: [TEST] MultiResolution image: need\n test to cover the case when @2x image is corrupted\n\n - S8145188, PR2945: No LocalVariableTable generated for\n the entire JDK\n\n - S8150258, PR1061: [TEST] HiDPI: create a test for\n multiresolution menu items icons\n\n - S8150724, PR1061: [TEST] HiDPI: create a test for\n multiresolution icons\n\n - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale\n should be taken into account for OS X\n\n - S8151841, PR2882: Build needs additional flags to\n compile with GCC 6 [plus parts of 8149647 & 8032045]\n\n - S8155613, PR1061: [PIT] crash in\n AWT_Desktop/Automated/Exceptions/BasicTest\n\n - S8156020, PR1061: 8145547 breaks AIX and and uses\n RTLD_NOLOAD incorrectly\n\n - S8156128, PR1061: Tests for [AWT/Swing] Conditional\n support for GTK 3 on Linux\n\n - S8158260, PR2991, RH1341258: PPC64: unaligned\n Unsafe.getInt can lead to the generation of illegal\n instructions (bsc#988651)\n\n - S8159244, PR3074: Partially initialized string object\n created by C2's string concat optimization may escape\n\n - S8159690, PR3077: [TESTBUG] Mark headful tests with @key\n headful.\n\n - S8160294, PR2882, PR3095: Some client libraries cannot\n be built with GCC 6\n\n - Bug fixes\n\n - PR1958: GTKLookAndFeel does not honor\n gtk-alternative-button-order\n\n - PR2822: Feed LIBS & CFLAGS into configure rather than\n make to avoid re-discovery by OpenJDK configure\n\n - PR2932: Support ccache in a non-automagic manner\n\n - PR2933: Support ccache 3.2 and later\n\n - PR2964: Set system defaults based on OS\n\n - PR2974, RH1337583: PKCS#10 certificate requests now use\n CRLF line endings rather than system line endings\n\n - PR3078: Remove duplicated line dating back to 6788347\n and 6894807\n\n - PR3083, RH1346460: Regression in SSL debug output\n without an ECC provider\n\n - PR3089: Remove old memory limits patch\n\n - PR3090, RH1204159: SystemTap is heavily confused by\n multiple JDKs\n\n - PR3095: Fix warnings in URLClassPath.c\n\n - PR3096: Remove dead --disable-optimizations option\n\n - PR3105: Use version from hotspot.map to create tarball\n filename\n\n - PR3106: Handle both correctly-spelt property\n 'enableCustomValueHandler' introduced by S8079718 and\n typo version\n\n - PR3108: Shenandoah patches not included in release\n tarball\n\n - PR3110: Update hotspot.map documentation in INSTALL\n\n - AArch64 port\n\n - S8145320, PR3078: Create unsafe_arraycopy and\n generic_arraycopy for AArch64\n\n - S8148328, PR3078: aarch64: redundant lsr instructions in\n stub code.\n\n - S8148783, PR3078: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3078: aarch64: generate_copy_longs calls\n align() incorrectly\n\n - S8149080, PR3078: AArch64: Recognise disjoint array copy\n in stub code\n\n - S8149365, PR3078: aarch64: memory copy does not prefetch\n on backwards copy\n\n - S8149907, PR3078: aarch64: use load/store pair\n instructions in call_stub\n\n - S8150038, PR3078: aarch64: make use of CBZ and CBNZ when\n comparing narrow pointer with zero\n\n - S8150045, PR3078: arraycopy causes segfaults in SATB\n during garbage collection\n\n - S8150082, PR3078: aarch64: optimise small array copy\n\n - S8150229, PR3078: aarch64: pipeline class for several\n instructions is not set correctly\n\n - S8150313, PR3078: aarch64: optimise array copy using\n SIMD instructions\n\n - S8150394, PR3078: aarch64: add support for 8.1 LSE CAS\n instructions\n\n - S8151340, PR3078: aarch64: prefetch the destination word\n for write prior to ldxr/stxr loops.\n\n - S8151502, PR3078: optimize pd_disjoint_words and\n pd_conjoint_words\n\n - S8151775, PR3078: aarch64: add support for 8.1 LSE\n atomic operations\n\n - S8152537, PR3078: aarch64: Make use of CBZ and CBNZ when\n comparing unsigned values with zero.\n\n - S8152840, PR3078: aarch64: improve _unsafe_arraycopy\n stub routine\n\n - S8153713, PR3078: aarch64: improve short array clearing\n using store pair\n\n - S8153797, PR3078: aarch64: Add Arrays.fill stub code\n\n - S8154537, PR3078: AArch64: some integer rotate\n instructions are never emitted\n\n - S8154739, PR3078: AArch64: TemplateTable::fast_xaccess\n loads in wrong mode\n\n - S8155015, PR3078: Aarch64: bad assert in spill\n generation code\n\n - S8155100, PR3078: AArch64: Relax alignment requirement\n for byte_map_base\n\n - S8155612, PR3078: Aarch64: vector nodes need to support\n misaligned offset\n\n - S8155617, PR3078: aarch64: ClearArray does not use DC\n ZVA\n\n - S8155653, PR3078: TestVectorUnalignedOffset.java not\n pushed with 8155612\n\n - S8156731, PR3078: aarch64: java/util/Arrays/Correct.java\n fails due to _generic_arraycopy stub routine\n\n - S8157841, PR3078: aarch64: prefetch ignores cache line\n size\n\n - S8157906, PR3078: aarch64: some more integer rotate\n instructions are never emitted\n\n - S8158913, PR3078: aarch64: SEGV running Spark terasort\n\n - S8159052, PR3078: aarch64: optimise unaligned copies in\n pd_disjoint_words and pd_conjoint_words\n\n - S8159063, PR3078: aarch64: optimise unaligned array copy\n long\n\n - PR3078: Cleanup remaining differences from aarch64/jdk8u\n tree\n\n - Fix script linking /usr/share/javazi/tzdb.dat for\n platform where it applies (bsc#987895)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684)\n\n avoid some crashes\n\nThis update was imported from the SUSE:SLE-12-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=984684\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=987895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989726\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1_8_0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-accessibility-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-demo-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-devel-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-headless-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-javadoc-1.8.0.101-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_8_0-openjdk-src-1.8.0.101-15.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-openjdk / java-1_8_0-openjdk-accessibility / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-25T15:03:09", "description": "This update for java-1_8_0-openjdk fixes the following issues :\n\n - Upgrade to version jdk8u101 (icedtea 3.1.0)\n\n - New in release 3.1.0 (2016-07-25) :\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)\n\n - S8146514: Enforce GCM limits\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)\n\n - S8149070: Enforce update ordering\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8153312: Constrain AppCDS behavior\n\n - S8154475, CVE-2016-3587: Clean up lookup visibility (bsc#989721)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)\n\n - CVE-2016-3552 (bsc#989726)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - New features\n\n - S8145547, PR1061: [AWT/Swing] Conditional support for GTK 3 on Linux\n\n - PR2821: Support building OpenJDK with --disable-headful\n\n - PR2931, G478960: Provide Infinality Support via fontconfig\n\n - PR3079: Provide option to build Shenandoah on x86_64\n\n - Import of OpenJDK 8 u92 build 14\n\n - S6869327: Add new C2 flag to keep safepoints in counted loops.\n\n - S8022865: [TESTBUG] Compressed Oops testing needs to be revised\n\n - S8029630: Thread id should be displayed as a hex number in error report\n\n - S8029726: On OS X some dtrace probe names are mismatched with Solaris\n\n - S8029727: On OS X dtrace probes Call<type>MethodA/Call<type>MethodV are not fired.\n\n - S8029728: On OS X dtrace probes SetStaticBooleanField are not fired\n\n - S8038184: XMLSignature throws StringIndexOutOfBoundsException if ID attribute value is empty String\n\n - S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits\n\n - S8041501: ImageIO reader is not capable of reading JPEGs without JFIF header\n\n - S8041900: [macosx] Java forces the use of discrete GPU\n\n - S8044363: Remove special build options for unpack200 executable\n\n - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy value for hotspot ARCH\n\n - S8046611: Build errors with gcc on sparc/fastdebug\n\n - S8047763: Recognize sparc64 as a sparc platform\n\n - S8048232: Fix for 8046471 breaks PPC64 build\n\n - S8052396: Catch exceptions resulting from missing font cmap\n\n - S8058563: InstanceKlass::_dependencies list isn't cleared from empty nmethodBucket entries\n\n - S8061624: [TESTBUG] Some tests cannot be ran under compact profiles and therefore shall be excluded\n\n - S8062901: Iterators is spelled incorrectly in the Javadoc for Spliterator\n\n - S8064330: Remove SHA224 from the default support list if SunMSCAPI enabled\n\n - S8065579: WB method to start G1 concurrent mark cycle should be introduced\n\n - S8065986: Compiler fails to NullPointerException when calling super with Object()\n\n - S8066974: Compiler doesn't infer method's generic type information in lambda body\n\n - S8067800: Clarify java.time.chrono.Chronology.isLeapYear for out of range years\n\n - S8068033: JNI exception pending in jdk/src/share/bin/java.c\n\n - S8068042: Check jdk/src/share/native/sun/misc/URLClassPath.c for JNI pending\n\n - S8068162: jvmtiRedefineClasses.cpp: guarantee(false) failed: OLD and/or OBSOLETE method(s) found\n\n - S8068254: Method reference uses wrong qualifying type\n\n - S8074696: Remote debugging session hangs for several minutes when calling findBootType\n\n - S8074935: jdk8 keytool doesn't validate pem files for RFC 1421 correctness, as jdk7 did\n\n - S8078423: [TESTBUG] javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on system locale\n\n - S8080492: [Parfait] Uninitialised variable in jdk/src/java/desktop/windows/native/libawt/\n\n - S8080650: Enable stubs to use frame pointers correctly\n\n - S8122944: perfdata used is seen as too high on sparc zone with jdk1.9 and causes a test failure\n\n - S8129348: Debugger hangs in trace mode with TRACE_SENDS\n\n - S8129847: Compiling methods generated by Nashorn triggers high memory usage in C2\n\n - S8130506: javac AssertionError when invoking MethodHandle.invoke with lambda parameter\n\n - S8130910: hsperfdata file is created in wrong directory and not cleaned up if /tmp/hsperfdata_<username> has wrong permissions\n\n - S8131129: Attempt to define a duplicate BMH$Species class\n\n - S8131665: Bad exception message in HandshakeHash.getFinishedHash\n\n - S8131782: C1 Class.cast optimization breaks when Class is loaded from static final\n\n - S8132503: [macosx] Chinese full stop symbol cannot be entered with Pinyin IM on OS X\n\n - S8133207: ParallelProbes.java test fails after changes for JDK-8080115\n\n - S8133924: NPE may be thrown when xsltc select a non-existing node after JDK-8062518\n\n - S8134007: Improve string folding\n\n - S8134759: jdb: Incorrect stepping inside finally block\n\n - S8134963: [Newtest] New stress test for changing the coarseness level of G1 remembered set\n\n - S8136442: Don't tie Certificate signature algorithms to ciphersuites\n\n - S8137106: EUDC (End User Defined Characters) are not displayed on Windows with Java 8u60+\n\n - S8138745: Implement ExitOnOutOfMemory and CrashOnOutOfMemory in HotSpot\n\n - S8138764: In some cases the usage of TreeLock can be replaced by other synchronization\n\n - S8139373: [TEST_BUG] java/net/MulticastSocket/MultiDead.java failed with timeout\n\n - S8139424: SIGSEGV, Problematic frame: # V [libjvm.so+0xd0c0cc] void InstanceKlass::oop_oop_iterate_oop_maps_specialized<true ></true> shClosure>\n\n - S8139436: sun.security.mscapi.KeyStore might load incomplete data\n\n - S8139751: Javac crash with -XDallowStringFolding=false\n\n - S8139863: [TESTBUG] Need to port tests for JDK-8134903 to 8u-dev\n\n - S8139985: JNI exception pending in jdk/src/jdk/hprof/agent/share/native/libhprof\n\n - S8140031: SA: Searching for a value in Threads does not work\n\n - S8140249: JVM Crashing During startUp If Flight Recording is enabled\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8140587: Atomic*FieldUpdaters should use Class.isInstance instead of direct class check\n\n - S8141260: isReachable crash in windows xp\n\n - S8143297: Nashorn compilation time reported in nanoseconds\n\n - S8143397: It looks like InetAddress.isReachable(timeout) works incorrectly\n\n - S8143855: Bad printf formatting in frame_zero.cpp\n\n - S8143896: java.lang.Long is implicitly converted to double\n\n - S8143963: improve ClassLoader::trace_class_path to accept an additional outputStream* arg\n\n - S8144020: Remove long as an internal numeric type\n\n - S8144131: ArrayData.getInt implementations do not convert to int32\n\n - S8144483: One long Safepoint pause directly after each GC log rotation\n\n - S8144487: PhaseIdealLoop::build_and_optimize() must restore major_progress flag if skip_loop_opts is true\n\n - S8144885: agent/src/os/linux/libproc.h needs to support Linux/SPARC builds\n\n - S8144935: C2: safepoint is pruned from a non-counted loop\n\n - S8144937: [TEST_BUG] testlibrary_tests should be excluded for compact1 and compact2 execution\n\n - S8145017: Add support for 3 digit hotspot minor version numbers\n\n - S8145099: Better error message when SA can't attach to a process\n\n - S8145442: Add the facility to verify remembered sets for G1\n\n - S8145466: javac: No line numbers in compilation error\n\n - S8145539: (coll) AbstractMap.keySet and .values should not be volatile\n\n - S8145550: Megamorphic invoke should use CompiledFunction variants without any LinkLogic\n\n - S8145669: apply2call optimized callsite fails after becoming megamorphic\n\n - S8145722: NullPointerException in javadoc\n\n - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset() does not match AddI\n\n - S8146147: Java linker indexed property getter does not work for computed nashorn string\n\n - S8146566: OpenJDK build can't handle commas in LDFLAGS\n\n - S8146725: Issues with SignatureAndHashAlgorithm.getSupportedAlgorithms\n\n - S8146979: Backport of 8046471 breaks ppc64 build in jdk8u because 8072383 was badly backported before\n\n - S8147087: Race when reusing PerRegionTable bitmaps may result in dropped remembered set entries\n\n - S8147630: Wrong test result pushed to 8u-dev\n\n - S8147845: Varargs Array functions still leaking longs\n\n - S8147857: RMIConnector logs attribute names incorrectly\n\n - S8148353: [linux-sparc] Crash in libawt.so on Linux SPARC\n\n - S8150791: 8u76 L10n resource file translation update\n\n - Import of OpenJDK 8 u101 build 13\n\n - S6483657: MSCAPI provider does not create unique alias names\n\n - S6675699: need comprehensive fix for unconstrained ConvI2L with narrowed type\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying timestamp hash algorithm\n\n - S8081778: Use Intel x64 CPU instructions for RSA acceleration\n\n - S8130150: Implement BigInteger.montgomeryMultiply intrinsic\n\n - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts\n\n - S8143913: MSCAPI keystore should accept Certificate[] in setEntry()\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146240: Three nashorn files contain 'GNU General Public License' header\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811\n\n - S8147994: [macosx] JScrollPane jitters up/down during trackpad scrolling on MacOS/Aqua\n\n - S8151522: Disable 8130150 and 8081778 intrinsics by default\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8152098: Fix 8151522 caused test compiler/intrinsics/squaretolen/TestSquareToLen.java to fail\n\n - S8157077: 8u101 L10n resource file updates\n\n - Backports\n\n - S6260348, PR3066: GTK+ L&F JTextComponent not respecting desktop caret blink rate\n\n - S6778087, PR1061: getLocationOnScreen() always returns (0, 0) for mouse wheel events\n\n - S6961123, PR2972: setWMClass fails to null-terminate WM_CLASS string\n\n - S8008657, PR3077: JSpinner setComponentOrientation doesn't affect on text orientation\n\n - S8014212, PR2866: Robot captures black screen\n\n - S8029339, PR1061: Custom MultiResolution image support on HiDPI displays\n\n - S8031145, PR3077: Re-examine closed i18n tests to see it they can be moved to the jdk repository.\n\n - S8034856, PR3095: gcc warnings compiling src/solaris/native/sun/security/pkcs11\n\n - S8034857, PR3095: gcc warnings compiling src/solaris/native/sun/management\n\n - S8035054, PR3095: JarFacade.c should not include ctype.h\n\n - S8035287, PR3095: gcc warnings compiling various libraries files\n\n - S8038631, PR3077: Create wrapper for awt.Robot with additional functionality\n\n - S8039279, PR3077: Move awt tests to openjdk repository\n\n - S8041561, PR3077: Inconsistent opacity behaviour between JCheckBox and JRadioButton\n\n - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing tests to jdk\n\n - S8041915, PR3077: Move 8 awt tests to OpenJDK regression tests tree\n\n - S8043126, PR3077: move awt automated functional tests from AWT_Events/Lw and AWT_Events/AWT to OpenJDK repository\n\n - S8043131, PR3077: Move ShapedAndTranslucentWindows and GC functional AWT tests to regression tree\n\n - S8044157, PR3077: [TEST_BUG] Improve recently submitted AWT_Mixing tests\n\n - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758 and AltPlusNumberKeyCombinationsTest to jdk\n\n - S8044429, PR3077: move awt automated tests for AWT_Modality to OpenJDK repository\n\n - S8044762, PR2960: com/sun/jdi/OptionTest.java test time out\n\n - S8044765, PR3077: Move functional tests AWT_SystemTray/Automated to openjdk repository\n\n - S8047180, PR3077: Move functional tests AWT_Headless/Automated to OpenJDK repository\n\n - S8047367, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 2\n\n - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated functional tests to OpenJDK\n\n - S8049226, PR2960: com/sun/jdi/OptionTest.java test times out again\n\n - S8049617, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 3\n\n - S8049694, PR3077: Migrate functional AWT_DesktopProperties/Automated tests to OpenJDK\n\n - S8050885, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 4\n\n - S8051440, PR3077: move tests about maximizing undecorated to OpenJDK\n\n - S8052012, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 5\n\n - S8052408, PR3077: Move AWT_BAT functional tests to OpenJDK (3 of 3)\n\n - S8053657, PR3077: [TEST_BUG] move some 5 tests related to undecorated Frame/JFrame to JDK\n\n - S8054143, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 6\n\n - S8054358, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 7\n\n - S8054359, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 8\n\n - S8055360, PR3077: Move the rest part of AWT ShapedAndTranslucent tests to OpenJDK\n\n - S8055664, PR3077: move 14 tests about setLocationRelativeTo to jdk\n\n - S8055836, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 9\n\n - S8056911, PR3077: Remove internal API usage from ExtendedRobot class\n\n - S8057694, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 10\n\n - S8058959, PR1061:\n closed/java/awt/event/ComponentEvent/MovedResizedTwiceTe st/MovedResizedTwic eTest.java failed automatically\n\n - S8062606, PR3077: Fix a typo in java.awt.Robot class\n\n - S8063102, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063104, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8063106, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063107, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8064573, PR3077: [TEST_BUG] javax/swing/text/AbstractDocument/6968363/Test6968363.ja va is asocial pressing VK_LEFT and not releasing\n\n - S8064575, PR3077: [TEST_BUG] javax/swing/JEditorPane/6917744/bug6917744.java 100 times press keys and never releases\n\n - S8064809, PR3077: [TEST_BUG] javax/swing/JComboBox/4199622/bug4199622.java contains a lot of keyPress and not a single keyRelease\n\n - S8067441, PR3077: Some tests fails with error: cannot find symbol getSystemMnemonicKeyCodes()\n\n - S8068228, PR3077: Test closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameT est fails with GTKLookAndFeel\n\n - S8069361, PR1061: SunGraphics2D.getDefaultTransform() does not include scale factor\n\n - S8073320, PR1061: Windows HiDPI Graphics support\n\n - S8074807, PR3077: Fix some tests unnecessary using internal API\n\n - S8076315, PR3077: move 4 manual functional swing tests to regression suite\n\n - S8078504, PR3094: Zero lacks declaration of VM_Version::initialize()\n\n - S8129822, PR3077: Define 'headful' jtreg keyword\n\n - S8132123, PR1061: MultiResolutionCachedImage unnecessarily creates base image to get its size\n\n - S8133539, PR1061: [TEST_BUG] Split java/awt/image/MultiResolutionImageTest.java in two to allow restricted access\n\n - S8137571, PR1061: Linux HiDPI Graphics support\n\n - S8142406, PR1061: [TEST] MultiResolution image: need test to cover the case when @2x image is corrupted\n\n - S8145188, PR2945: No LocalVariableTable generated for the entire JDK\n\n - S8150258, PR1061: [TEST] HiDPI: create a test for multiresolution menu items icons\n\n - S8150724, PR1061: [TEST] HiDPI: create a test for multiresolution icons\n\n - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale should be taken into account for OS X\n\n - S8151841, PR2882: Build needs additional flags to compile with GCC 6 [plus parts of 8149647 & 8032045]\n\n - S8155613, PR1061: [PIT] crash in AWT_Desktop/Automated/Exceptions/BasicTest\n\n - S8156020, PR1061: 8145547 breaks AIX and and uses RTLD_NOLOAD incorrectly\n\n - S8156128, PR1061: Tests for [AWT/Swing] Conditional support for GTK 3 on Linux\n\n - S8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651)\n\n - S8159244, PR3074: Partially initialized string object created by C2's string concat optimization may escape\n\n - S8159690, PR3077: [TESTBUG] Mark headful tests with @key headful.\n\n - S8160294, PR2882, PR3095: Some client libraries cannot be built with GCC 6\n\n - Bug fixes\n\n - PR1958: GTKLookAndFeel does not honor gtk-alternative-button-order\n\n - PR2822: Feed LIBS & CFLAGS into configure rather than make to avoid re-discovery by OpenJDK configure\n\n - PR2932: Support ccache in a non-automagic manner\n\n - PR2933: Support ccache 3.2 and later\n\n - PR2964: Set system defaults based on OS\n\n - PR2974, RH1337583: PKCS#10 certificate requests now use CRLF line endings rather than system line endings\n\n - PR3078: Remove duplicated line dating back to 6788347 and 6894807\n\n - PR3083, RH1346460: Regression in SSL debug output without an ECC provider\n\n - PR3089: Remove old memory limits patch\n\n - PR3090, RH1204159: SystemTap is heavily confused by multiple JDKs\n\n - PR3095: Fix warnings in URLClassPath.c\n\n - PR3096: Remove dead --disable-optimizations option\n\n - PR3105: Use version from hotspot.map to create tarball filename\n\n - PR3106: Handle both correctly-spelt property 'enableCustomValueHandler' introduced by S8079718 and typo version\n\n - PR3108: Shenandoah patches not included in release tarball\n\n - PR3110: Update hotspot.map documentation in INSTALL\n\n - AArch64 port\n\n - S8145320, PR3078: Create unsafe_arraycopy and generic_arraycopy for AArch64\n\n - S8148328, PR3078: aarch64: redundant lsr instructions in stub code.\n\n - S8148783, PR3078: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3078: aarch64: generate_copy_longs calls align() incorrectly\n\n - S8149080, PR3078: AArch64: Recognise disjoint array copy in stub code\n\n - S8149365, PR3078: aarch64: memory copy does not prefetch on backwards copy\n\n - S8149907, PR3078: aarch64: use load/store pair instructions in call_stub\n\n - S8150038, PR3078: aarch64: make use of CBZ and CBNZ when comparing narrow pointer with zero\n\n - S8150045, PR3078: arraycopy causes segfaults in SATB during garbage collection\n\n - S8150082, PR3078: aarch64: optimise small array copy\n\n - S8150229, PR3078: aarch64: pipeline class for several instructions is not set correctly\n\n - S8150313, PR3078: aarch64: optimise array copy using SIMD instructions\n\n - S8150394, PR3078: aarch64: add support for 8.1 LSE CAS instructions\n\n - S8151340, PR3078: aarch64: prefetch the destination word for write prior to ldxr/stxr loops.\n\n - S8151502, PR3078: optimize pd_disjoint_words and pd_conjoint_words\n\n - S8151775, PR3078: aarch64: add support for 8.1 LSE atomic operations\n\n - S8152537, PR3078: aarch64: Make use of CBZ and CBNZ when comparing unsigned values with zero.\n\n - S8152840, PR3078: aarch64: improve _unsafe_arraycopy stub routine\n\n - S8153713, PR3078: aarch64: improve short array clearing using store pair\n\n - S8153797, PR3078: aarch64: Add Arrays.fill stub code\n\n - S8154537, PR3078: AArch64: some integer rotate instructions are never emitted\n\n - S8154739, PR3078: AArch64: TemplateTable::fast_xaccess loads in wrong mode\n\n - S8155015, PR3078: Aarch64: bad assert in spill generation code\n\n - S8155100, PR3078: AArch64: Relax alignment requirement for byte_map_base\n\n - S8155612, PR3078: Aarch64: vector nodes need to support misaligned offset\n\n - S8155617, PR3078: aarch64: ClearArray does not use DC ZVA\n\n - S8155653, PR3078: TestVectorUnalignedOffset.java not pushed with 8155612\n\n - S8156731, PR3078: aarch64: java/util/Arrays/Correct.java fails due to _generic_arraycopy stub routine\n\n - S8157841, PR3078: aarch64: prefetch ignores cache line size\n\n - S8157906, PR3078: aarch64: some more integer rotate instructions are never emitted\n\n - S8158913, PR3078: aarch64: SEGV running Spark terasort\n\n - S8159052, PR3078: aarch64: optimise unaligned copies in pd_disjoint_words and pd_conjoint_words\n\n - S8159063, PR3078: aarch64: optimise unaligned array copy long\n\n - PR3078: Cleanup remaining differences from aarch64/jdk8u tree\n\n - Fix script linking /usr/share/javazi/tzdb.dat for platform where it applies (bsc#987895)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684) avoid some crashes</username></type></type>\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-09-02T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2016:2012-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debugsource", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-2012-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93281", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:2012-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93281);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3552\", \"CVE-2016-3587\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2016:2012-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for java-1_8_0-openjdk fixes the following issues :\n\n - Upgrade to version jdk8u101 (icedtea 3.1.0)\n\n - New in release 3.1.0 (2016-07-25) :\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (bsc#989734)\n\n - S8146514: Enforce GCM limits\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (bsc#989730)\n\n - S8149070: Enforce update ordering\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8153312: Constrain AppCDS behavior\n\n - S8154475, CVE-2016-3587: Clean up lookup visibility\n (bsc#989721)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (bsc#989725)\n\n - CVE-2016-3552 (bsc#989726)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - New features\n\n - S8145547, PR1061: [AWT/Swing] Conditional support for\n GTK 3 on Linux\n\n - PR2821: Support building OpenJDK with --disable-headful\n\n - PR2931, G478960: Provide Infinality Support via\n fontconfig\n\n - PR3079: Provide option to build Shenandoah on x86_64\n\n - Import of OpenJDK 8 u92 build 14\n\n - S6869327: Add new C2 flag to keep safepoints in counted\n loops.\n\n - S8022865: [TESTBUG] Compressed Oops testing needs to be\n revised\n\n - S8029630: Thread id should be displayed as a hex number\n in error report\n\n - S8029726: On OS X some dtrace probe names are mismatched\n with Solaris\n\n - S8029727: On OS X dtrace probes\n Call<type>MethodA/Call<type>MethodV are not fired.\n\n - S8029728: On OS X dtrace probes SetStaticBooleanField\n are not fired\n\n - S8038184: XMLSignature throws\n StringIndexOutOfBoundsException if ID attribute value is\n empty String\n\n - S8038349: Signing XML with DSA throws Exception when key\n is larger than 1024 bits\n\n - S8041501: ImageIO reader is not capable of reading JPEGs\n without JFIF header\n\n - S8041900: [macosx] Java forces the use of discrete GPU\n\n - S8044363: Remove special build options for unpack200\n executable\n\n - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy\n value for hotspot ARCH\n\n - S8046611: Build errors with gcc on sparc/fastdebug\n\n - S8047763: Recognize sparc64 as a sparc platform\n\n - S8048232: Fix for 8046471 breaks PPC64 build\n\n - S8052396: Catch exceptions resulting from missing font\n cmap\n\n - S8058563: InstanceKlass::_dependencies list isn't\n cleared from empty nmethodBucket entries\n\n - S8061624: [TESTBUG] Some tests cannot be ran under\n compact profiles and therefore shall be excluded\n\n - S8062901: Iterators is spelled incorrectly in the\n Javadoc for Spliterator\n\n - S8064330: Remove SHA224 from the default support list if\n SunMSCAPI enabled\n\n - S8065579: WB method to start G1 concurrent mark cycle\n should be introduced\n\n - S8065986: Compiler fails to NullPointerException when\n calling super with Object()\n\n - S8066974: Compiler doesn't infer method's generic type\n information in lambda body\n\n - S8067800: Clarify java.time.chrono.Chronology.isLeapYear\n for out of range years\n\n - S8068033: JNI exception pending in\n jdk/src/share/bin/java.c\n\n - S8068042: Check\n jdk/src/share/native/sun/misc/URLClassPath.c for JNI\n pending\n\n - S8068162: jvmtiRedefineClasses.cpp: guarantee(false)\n failed: OLD and/or OBSOLETE method(s) found\n\n - S8068254: Method reference uses wrong qualifying type\n\n - S8074696: Remote debugging session hangs for several\n minutes when calling findBootType\n\n - S8074935: jdk8 keytool doesn't validate pem files for\n RFC 1421 correctness, as jdk7 did\n\n - S8078423: [TESTBUG]\n javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on\n system locale\n\n - S8080492: [Parfait] Uninitialised variable in\n jdk/src/java/desktop/windows/native/libawt/\n\n - S8080650: Enable stubs to use frame pointers correctly\n\n - S8122944: perfdata used is seen as too high on sparc\n zone with jdk1.9 and causes a test failure\n\n - S8129348: Debugger hangs in trace mode with TRACE_SENDS\n\n - S8129847: Compiling methods generated by Nashorn\n triggers high memory usage in C2\n\n - S8130506: javac AssertionError when invoking\n MethodHandle.invoke with lambda parameter\n\n - S8130910: hsperfdata file is created in wrong directory\n and not cleaned up if /tmp/hsperfdata_<username> has\n wrong permissions\n\n - S8131129: Attempt to define a duplicate BMH$Species\n class\n\n - S8131665: Bad exception message in\n HandshakeHash.getFinishedHash\n\n - S8131782: C1 Class.cast optimization breaks when Class\n is loaded from static final\n\n - S8132503: [macosx] Chinese full stop symbol cannot be\n entered with Pinyin IM on OS X\n\n - S8133207: ParallelProbes.java test fails after changes\n for JDK-8080115\n\n - S8133924: NPE may be thrown when xsltc select a\n non-existing node after JDK-8062518\n\n - S8134007: Improve string folding\n\n - S8134759: jdb: Incorrect stepping inside finally block\n\n - S8134963: [Newtest] New stress test for changing the\n coarseness level of G1 remembered set\n\n - S8136442: Don't tie Certificate signature algorithms to\n ciphersuites\n\n - S8137106: EUDC (End User Defined Characters) are not\n displayed on Windows with Java 8u60+\n\n - S8138745: Implement ExitOnOutOfMemory and\n CrashOnOutOfMemory in HotSpot\n\n - S8138764: In some cases the usage of TreeLock can be\n replaced by other synchronization\n\n - S8139373: [TEST_BUG]\n java/net/MulticastSocket/MultiDead.java failed with\n timeout\n\n - S8139424: SIGSEGV, Problematic frame: # V\n [libjvm.so+0xd0c0cc] void\n InstanceKlass::oop_oop_iterate_oop_maps_specialized<true\n ></true> shClosure>\n\n - S8139436: sun.security.mscapi.KeyStore might load\n incomplete data\n\n - S8139751: Javac crash with -XDallowStringFolding=false\n\n - S8139863: [TESTBUG] Need to port tests for JDK-8134903\n to 8u-dev\n\n - S8139985: JNI exception pending in\n jdk/src/jdk/hprof/agent/share/native/libhprof\n\n - S8140031: SA: Searching for a value in Threads does not\n work\n\n - S8140249: JVM Crashing During startUp If Flight\n Recording is enabled\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8140587: Atomic*FieldUpdaters should use\n Class.isInstance instead of direct class check\n\n - S8141260: isReachable crash in windows xp\n\n - S8143297: Nashorn compilation time reported in\n nanoseconds\n\n - S8143397: It looks like InetAddress.isReachable(timeout)\n works incorrectly\n\n - S8143855: Bad printf formatting in frame_zero.cpp\n\n - S8143896: java.lang.Long is implicitly converted to\n double\n\n - S8143963: improve ClassLoader::trace_class_path to\n accept an additional outputStream* arg\n\n - S8144020: Remove long as an internal numeric type\n\n - S8144131: ArrayData.getInt implementations do not\n convert to int32\n\n - S8144483: One long Safepoint pause directly after each\n GC log rotation\n\n - S8144487: PhaseIdealLoop::build_and_optimize() must\n restore major_progress flag if skip_loop_opts is true\n\n - S8144885: agent/src/os/linux/libproc.h needs to support\n Linux/SPARC builds\n\n - S8144935: C2: safepoint is pruned from a non-counted\n loop\n\n - S8144937: [TEST_BUG] testlibrary_tests should be\n excluded for compact1 and compact2 execution\n\n - S8145017: Add support for 3 digit hotspot minor version\n numbers\n\n - S8145099: Better error message when SA can't attach to a\n process\n\n - S8145442: Add the facility to verify remembered sets for\n G1\n\n - S8145466: javac: No line numbers in compilation error\n\n - S8145539: (coll) AbstractMap.keySet and .values should\n not be volatile\n\n - S8145550: Megamorphic invoke should use CompiledFunction\n variants without any LinkLogic\n\n - S8145669: apply2call optimized callsite fails after\n becoming megamorphic\n\n - S8145722: NullPointerException in javadoc\n\n - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset()\n does not match AddI\n\n - S8146147: Java linker indexed property getter does not\n work for computed nashorn string\n\n - S8146566: OpenJDK build can't handle commas in LDFLAGS\n\n - S8146725: Issues with\n SignatureAndHashAlgorithm.getSupportedAlgorithms\n\n - S8146979: Backport of 8046471 breaks ppc64 build in\n jdk8u because 8072383 was badly backported before\n\n - S8147087: Race when reusing PerRegionTable bitmaps may\n result in dropped remembered set entries\n\n - S8147630: Wrong test result pushed to 8u-dev\n\n - S8147845: Varargs Array functions still leaking longs\n\n - S8147857: RMIConnector logs attribute names incorrectly\n\n - S8148353: [linux-sparc] Crash in libawt.so on Linux\n SPARC\n\n - S8150791: 8u76 L10n resource file translation update\n\n - Import of OpenJDK 8 u101 build 13\n\n - S6483657: MSCAPI provider does not create unique alias\n names\n\n - S6675699: need comprehensive fix for unconstrained\n ConvI2L with narrowed type\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying\n timestamp hash algorithm\n\n - S8081778: Use Intel x64 CPU instructions for RSA\n acceleration\n\n - S8130150: Implement BigInteger.montgomeryMultiply\n intrinsic\n\n - S8130735: javax.swing.TimerQueue: timer fires late when\n another timer starts\n\n - S8143913: MSCAPI keystore should accept Certificate[] in\n setEntry()\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146240: Three nashorn files contain 'GNU General\n Public License' header\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket\n accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory\n regression tests fail after JDK-8138811\n\n - S8147994: [macosx] JScrollPane jitters up/down during\n trackpad scrolling on MacOS/Aqua\n\n - S8151522: Disable 8130150 and 8081778 intrinsics by\n default\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8152098: Fix 8151522 caused test\n compiler/intrinsics/squaretolen/TestSquareToLen.java to\n fail\n\n - S8157077: 8u101 L10n resource file updates\n\n - Backports\n\n - S6260348, PR3066: GTK+ L&F JTextComponent not respecting\n desktop caret blink rate\n\n - S6778087, PR1061: getLocationOnScreen() always returns\n (0, 0) for mouse wheel events\n\n - S6961123, PR2972: setWMClass fails to null-terminate\n WM_CLASS string\n\n - S8008657, PR3077: JSpinner setComponentOrientation\n doesn't affect on text orientation\n\n - S8014212, PR2866: Robot captures black screen\n\n - S8029339, PR1061: Custom MultiResolution image support\n on HiDPI displays\n\n - S8031145, PR3077: Re-examine closed i18n tests to see it\n they can be moved to the jdk repository.\n\n - S8034856, PR3095: gcc warnings compiling\n src/solaris/native/sun/security/pkcs11\n\n - S8034857, PR3095: gcc warnings compiling\n src/solaris/native/sun/management\n\n - S8035054, PR3095: JarFacade.c should not include ctype.h\n\n - S8035287, PR3095: gcc warnings compiling various\n libraries files\n\n - S8038631, PR3077: Create wrapper for awt.Robot with\n additional functionality\n\n - S8039279, PR3077: Move awt tests to openjdk repository\n\n - S8041561, PR3077: Inconsistent opacity behaviour between\n JCheckBox and JRadioButton\n\n - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing\n tests to jdk\n\n - S8041915, PR3077: Move 8 awt tests to OpenJDK regression\n tests tree\n\n - S8043126, PR3077: move awt automated functional tests\n from AWT_Events/Lw and AWT_Events/AWT to OpenJDK\n repository\n\n - S8043131, PR3077: Move ShapedAndTranslucentWindows and\n GC functional AWT tests to regression tree\n\n - S8044157, PR3077: [TEST_BUG] Improve recently submitted\n AWT_Mixing tests\n\n - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758\n and AltPlusNumberKeyCombinationsTest to jdk\n\n - S8044429, PR3077: move awt automated tests for\n AWT_Modality to OpenJDK repository\n\n - S8044762, PR2960: com/sun/jdi/OptionTest.java test time\n out\n\n - S8044765, PR3077: Move functional tests\n AWT_SystemTray/Automated to openjdk repository\n\n - S8047180, PR3077: Move functional tests\n AWT_Headless/Automated to OpenJDK repository\n\n - S8047367, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 2\n\n - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated\n functional tests to OpenJDK\n\n - S8049226, PR2960: com/sun/jdi/OptionTest.java test times\n out again\n\n - S8049617, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 3\n\n - S8049694, PR3077: Migrate functional\n AWT_DesktopProperties/Automated tests to OpenJDK\n\n - S8050885, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 4\n\n - S8051440, PR3077: move tests about maximizing\n undecorated to OpenJDK\n\n - S8052012, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 5\n\n - S8052408, PR3077: Move AWT_BAT functional tests to\n OpenJDK (3 of 3)\n\n - S8053657, PR3077: [TEST_BUG] move some 5 tests related\n to undecorated Frame/JFrame to JDK\n\n - S8054143, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 6\n\n - S8054358, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 7\n\n - S8054359, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 8\n\n - S8055360, PR3077: Move the rest part of AWT\n ShapedAndTranslucent tests to OpenJDK\n\n - S8055664, PR3077: move 14 tests about\n setLocationRelativeTo to jdk\n\n - S8055836, PR3077: move awt tests from AWT_Modality to\n OpenJDK repository - part 9\n\n - S8056911, PR3077: Remove internal API usage from\n ExtendedRobot class\n\n - S8057694, PR3077: move awt tests from AWT_Modality to\n OpenJDK repository - part 10\n\n - S8058959, PR1061:\n closed/java/awt/event/ComponentEvent/MovedResizedTwiceTe\n st/MovedResizedTwic eTest.java failed automatically\n\n - S8062606, PR3077: Fix a typo in java.awt.Robot class\n\n - S8063102, PR3077: Change open awt regression tests to\n avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063104, PR3077: Change open awt regression tests to\n avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8063106, PR3077: Change open swing regression tests to\n avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063107, PR3077: Change open swing regression tests to\n avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8064573, PR3077: [TEST_BUG]\n javax/swing/text/AbstractDocument/6968363/Test6968363.ja\n va is asocial pressing VK_LEFT and not releasing\n\n - S8064575, PR3077: [TEST_BUG]\n javax/swing/JEditorPane/6917744/bug6917744.java 100\n times press keys and never releases\n\n - S8064809, PR3077: [TEST_BUG]\n javax/swing/JComboBox/4199622/bug4199622.java contains a\n lot of keyPress and not a single keyRelease\n\n - S8067441, PR3077: Some tests fails with error: cannot\n find symbol getSystemMnemonicKeyCodes()\n\n - S8068228, PR3077: Test\n closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameT\n est fails with GTKLookAndFeel\n\n - S8069361, PR1061: SunGraphics2D.getDefaultTransform()\n does not include scale factor\n\n - S8073320, PR1061: Windows HiDPI Graphics support\n\n - S8074807, PR3077: Fix some tests unnecessary using\n internal API\n\n - S8076315, PR3077: move 4 manual functional swing tests\n to regression suite\n\n - S8078504, PR3094: Zero lacks declaration of\n VM_Version::initialize()\n\n - S8129822, PR3077: Define 'headful' jtreg keyword\n\n - S8132123, PR1061: MultiResolutionCachedImage\n unnecessarily creates base image to get its size\n\n - S8133539, PR1061: [TEST_BUG] Split\n java/awt/image/MultiResolutionImageTest.java in two to\n allow restricted access\n\n - S8137571, PR1061: Linux HiDPI Graphics support\n\n - S8142406, PR1061: [TEST] MultiResolution image: need\n test to cover the case when @2x image is corrupted\n\n - S8145188, PR2945: No LocalVariableTable generated for\n the entire JDK\n\n - S8150258, PR1061: [TEST] HiDPI: create a test for\n multiresolution menu items icons\n\n - S8150724, PR1061: [TEST] HiDPI: create a test for\n multiresolution icons\n\n - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale\n should be taken into account for OS X\n\n - S8151841, PR2882: Build needs additional flags to\n compile with GCC 6 [plus parts of 8149647 & 8032045]\n\n - S8155613, PR1061: [PIT] crash in\n AWT_Desktop/Automated/Exceptions/BasicTest\n\n - S8156020, PR1061: 8145547 breaks AIX and and uses\n RTLD_NOLOAD incorrectly\n\n - S8156128, PR1061: Tests for [AWT/Swing] Conditional\n support for GTK 3 on Linux\n\n - S8158260, PR2991, RH1341258: PPC64: unaligned\n Unsafe.getInt can lead to the generation of illegal\n instructions (bsc#988651)\n\n - S8159244, PR3074: Partially initialized string object\n created by C2's string concat optimization may escape\n\n - S8159690, PR3077: [TESTBUG] Mark headful tests with @key\n headful.\n\n - S8160294, PR2882, PR3095: Some client libraries cannot\n be built with GCC 6\n\n - Bug fixes\n\n - PR1958: GTKLookAndFeel does not honor\n gtk-alternative-button-order\n\n - PR2822: Feed LIBS & CFLAGS into configure rather than\n make to avoid re-discovery by OpenJDK configure\n\n - PR2932: Support ccache in a non-automagic manner\n\n - PR2933: Support ccache 3.2 and later\n\n - PR2964: Set system defaults based on OS\n\n - PR2974, RH1337583: PKCS#10 certificate requests now use\n CRLF line endings rather than system line endings\n\n - PR3078: Remove duplicated line dating back to 6788347\n and 6894807\n\n - PR3083, RH1346460: Regression in SSL debug output\n without an ECC provider\n\n - PR3089: Remove old memory limits patch\n\n - PR3090, RH1204159: SystemTap is heavily confused by\n multiple JDKs\n\n - PR3095: Fix warnings in URLClassPath.c\n\n - PR3096: Remove dead --disable-optimizations option\n\n - PR3105: Use version from hotspot.map to create tarball\n filename\n\n - PR3106: Handle both correctly-spelt property\n 'enableCustomValueHandler' introduced by S8079718 and\n typo version\n\n - PR3108: Shenandoah patches not included in release\n tarball\n\n - PR3110: Update hotspot.map documentation in INSTALL\n\n - AArch64 port\n\n - S8145320, PR3078: Create unsafe_arraycopy and\n generic_arraycopy for AArch64\n\n - S8148328, PR3078: aarch64: redundant lsr instructions in\n stub code.\n\n - S8148783, PR3078: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3078: aarch64: generate_copy_longs calls\n align() incorrectly\n\n - S8149080, PR3078: AArch64: Recognise disjoint array copy\n in stub code\n\n - S8149365, PR3078: aarch64: memory copy does not prefetch\n on backwards copy\n\n - S8149907, PR3078: aarch64: use load/store pair\n instructions in call_stub\n\n - S8150038, PR3078: aarch64: make use of CBZ and CBNZ when\n comparing narrow pointer with zero\n\n - S8150045, PR3078: arraycopy causes segfaults in SATB\n during garbage collection\n\n - S8150082, PR3078: aarch64: optimise small array copy\n\n - S8150229, PR3078: aarch64: pipeline class for several\n instructions is not set correctly\n\n - S8150313, PR3078: aarch64: optimise array copy using\n SIMD instructions\n\n - S8150394, PR3078: aarch64: add support for 8.1 LSE CAS\n instructions\n\n - S8151340, PR3078: aarch64: prefetch the destination word\n for write prior to ldxr/stxr loops.\n\n - S8151502, PR3078: optimize pd_disjoint_words and\n pd_conjoint_words\n\n - S8151775, PR3078: aarch64: add support for 8.1 LSE\n atomic operations\n\n - S8152537, PR3078: aarch64: Make use of CBZ and CBNZ when\n comparing unsigned values with zero.\n\n - S8152840, PR3078: aarch64: improve _unsafe_arraycopy\n stub routine\n\n - S8153713, PR3078: aarch64: improve short array clearing\n using store pair\n\n - S8153797, PR3078: aarch64: Add Arrays.fill stub code\n\n - S8154537, PR3078: AArch64: some integer rotate\n instructions are never emitted\n\n - S8154739, PR3078: AArch64: TemplateTable::fast_xaccess\n loads in wrong mode\n\n - S8155015, PR3078: Aarch64: bad assert in spill\n generation code\n\n - S8155100, PR3078: AArch64: Relax alignment requirement\n for byte_map_base\n\n - S8155612, PR3078: Aarch64: vector nodes need to support\n misaligned offset\n\n - S8155617, PR3078: aarch64: ClearArray does not use DC\n ZVA\n\n - S8155653, PR3078: TestVectorUnalignedOffset.java not\n pushed with 8155612\n\n - S8156731, PR3078: aarch64: java/util/Arrays/Correct.java\n fails due to _generic_arraycopy stub routine\n\n - S8157841, PR3078: aarch64: prefetch ignores cache line\n size\n\n - S8157906, PR3078: aarch64: some more integer rotate\n instructions are never emitted\n\n - S8158913, PR3078: aarch64: SEGV running Spark terasort\n\n - S8159052, PR3078: aarch64: optimise unaligned copies in\n pd_disjoint_words and pd_conjoint_words\n\n - S8159063, PR3078: aarch64: optimise unaligned array copy\n long\n\n - PR3078: Cleanup remaining differences from aarch64/jdk8u\n tree\n\n - Fix script linking /usr/share/javazi/tzdb.dat for\n platform where it applies (bsc#987895)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684)\n avoid some crashes</username></type></type>\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=984684\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=987895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=988651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989726\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3458/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3485/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3498/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3500/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3503/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3508/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3511/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3552/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3587/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3598/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3606/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3610/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20162012-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5ae51c3f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP1:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2016-1187=1\n\nSUSE Linux Enterprise Desktop 12-SP1:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP1-2016-1187=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-demo-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-devel-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-headless-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-openjdk-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-openjdk-headless-1.8.0.101-14.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.101-14.3\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-openjdk\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-26T15:35:08", "description": "The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 101, 7 Update 111, or 6 Update 121. It is, therefore, affected by multiple vulnerabilities :\n\n - An unspecified flaw exists in the CORBA subcomponent that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-3458)\n\n - An unspecified flaw exists in the Networking subcomponent that allows a local attacker to impact integrity. (CVE-2016-3485)\n\n - An unspecified flaw exists in the JavaFX subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3498)\n\n - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3500)\n\n - An unspecified flaw exists in the Install subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3503)\n\n - An unspecified flaw exists in the JAXP subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3508)\n\n - An unspecified flaw exists in the Deployment subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3511)\n\n - An unspecified flaw exists in the Hotspot subcomponent that allows an unauthenticated, remote attacker to disclose potentially sensitive information.\n (CVE-2016-3550)\n\n - An unspecified flaw exists in the Install subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3552)\n\n - A flaw exists in the Hotspot subcomponent due to improper access to the MethodHandle::invokeBasic() function. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-3587)\n\n - A flaw exists in the Libraries subcomponent within the MethodHandles::dropArguments() function that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3598)\n\n - A flaw exists in the Hotspot subcomponent within the ClassVerifier::ends_in_athrow() function when handling bytecode verification. An unauthenticated, remote attacker can exploit this to execute arbitrary code.\n (CVE-2016-3606)\n\n - An unspecified flaw exists in the Libraries subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3610)", "cvss3": {}, "published": "2016-07-22T00:00:00", "type": "nessus", "title": "Oracle Java SE Multiple Vulnerabilities (July 2016 CPU) (Unix)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:oracle:jre", "cpe:/a:oracle:jdk"], "id": "ORACLE_JAVA_CPU_JUL_2016_UNIX.NASL", "href": "https://www.tenable.com/plugins/nessus/92517", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92517);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2016-3458\",\n \"CVE-2016-3485\",\n \"CVE-2016-3498\",\n \"CVE-2016-3500\",\n \"CVE-2016-3503\",\n \"CVE-2016-3508\",\n \"CVE-2016-3511\",\n \"CVE-2016-3550\",\n \"CVE-2016-3552\",\n \"CVE-2016-3587\",\n \"CVE-2016-3598\",\n \"CVE-2016-3606\",\n \"CVE-2016-3610\"\n );\n script_bugtraq_id(\n 91904,\n 91912,\n 91918,\n 91930,\n 91945,\n 91951,\n 91956,\n 91962,\n 91972,\n 91990,\n 91996,\n 92000,\n 92006\n );\n\n script_name(english:\"Oracle Java SE Multiple Vulnerabilities (July 2016 CPU) (Unix)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Unix host contains a programming platform that is affected\nby multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Oracle (formerly Sun) Java SE or Java for Business\ninstalled on the remote host is prior to 8 Update 101, 7 Update 111,\nor 6 Update 121. It is, therefore, affected by multiple\nvulnerabilities :\n\n - An unspecified flaw exists in the CORBA subcomponent\n that allows an unauthenticated, remote attacker to\n impact integrity. (CVE-2016-3458)\n\n - An unspecified flaw exists in the Networking\n subcomponent that allows a local attacker to impact\n integrity. (CVE-2016-3485)\n\n - An unspecified flaw exists in the JavaFX subcomponent\n that allows an unauthenticated, remote attacker to cause\n a denial of service condition. (CVE-2016-3498)\n\n - An unspecified flaw exists in the JAXP subcomponent that\n allows an unauthenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3500)\n\n - An unspecified flaw exists in the Install subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3503)\n\n - An unspecified flaw exists in the JAXP subcomponent that\n allows an unauthenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3508)\n\n - An unspecified flaw exists in the Deployment\n subcomponent that allows a local attacker to gain\n elevated privileges. (CVE-2016-3511)\n\n - An unspecified flaw exists in the Hotspot subcomponent\n that allows an unauthenticated, remote attacker to\n disclose potentially sensitive information.\n (CVE-2016-3550)\n\n - An unspecified flaw exists in the Install subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3552)\n\n - A flaw exists in the Hotspot subcomponent due to\n improper access to the MethodHandle::invokeBasic()\n function. An unauthenticated, remote attacker can\n exploit this to execute arbitrary code. (CVE-2016-3587)\n\n - A flaw exists in the Libraries subcomponent within the\n MethodHandles::dropArguments() function that allows an\n unauthenticated, remote attacker to execute arbitrary\n code. (CVE-2016-3598)\n\n - A flaw exists in the Hotspot subcomponent within the\n ClassVerifier::ends_in_athrow() function when handling\n bytecode verification. An unauthenticated, remote\n attacker can exploit this to execute arbitrary code.\n (CVE-2016-3606)\n\n - An unspecified flaw exists in the Libraries subcomponent\n that allows an unauthenticated, remote attacker to\n execute arbitrary code. (CVE-2016-3610)\");\n # https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e71b6836\");\n # http://www.oracle.com/technetwork/java/javase/8u101-relnotes-3021761.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?92867054\");\n # https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_111\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6adbf356\");\n # https://www.oracle.com/technetwork/java/javase/documentation/overview-156328.html#R160_121\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?81636e81\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Oracle JDK / JRE 8 Update 101 / 7 Update 111 / 6 Update\n121 or later. If necessary, remove any affected versions.\n\nNote that an Extended Support contract with Oracle is needed to obtain\nJDK / JRE 6 Update 95 or later.\");\n script_set_attribute(attribute:\"agent\", value:\"unix\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-3610\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:jre\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:jdk\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"sun_java_jre_installed_unix.nasl\");\n script_require_keys(\"Host/Java/JRE/Installed\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Check each installed JRE.\ninstalls = get_kb_list_or_exit(\"Host/Java/JRE/Unmanaged/*\");\n\ninfo = \"\";\nvuln = 0;\nvuln2 = 0;\ninstalled_versions = \"\";\ngranular = \"\";\n\nforeach install (list_uniq(keys(installs)))\n{\n ver = install - \"Host/Java/JRE/Unmanaged/\";\n if (ver !~ \"^[0-9.]+\") continue;\n\n installed_versions = installed_versions + \" & \" + ver;\n\n # Fixes : (JDK|JRE) 8 Update 101 / 7 Update 111 / 6 Update 121\n if (\n ver =~ '^1\\\\.6\\\\.0_([0-9]|[0-9][0-9]|1[01][0-9]|120)([^0-9]|$)' ||\n ver =~ '^1\\\\.7\\\\.0_([0-9]|[0-9][0-9]|10[0-9]|110)([^0-9]|$)' ||\n ver =~ '^1\\\\.8\\\\.0_([0-9]|[0-9][0-9]|100)([^0-9]|$)'\n )\n {\n dirs = make_list(get_kb_list(install));\n vuln += max_index(dirs);\n\n foreach dir (dirs)\n info += '\\n Path : ' + dir;\n\n info += '\\n Installed version : ' + ver;\n info += '\\n Fixed version : 1.6.0_121 / 1.7.0_111 / 1.8.0_101\\n';\n }\n else if (ver =~ \"^[\\d\\.]+$\")\n {\n dirs = make_list(get_kb_list(install));\n foreach dir (dirs)\n granular += \"The Oracle Java version \"+ver+\" at \"+dir+\" is not granular enough to make a determination.\"+'\\n';\n }\n else\n {\n dirs = make_list(get_kb_list(install));\n vuln2 += max_index(dirs);\n }\n\n}\n\n# Report if any were found to be vulnerable.\nif (info)\n{\n if (report_verbosity > 0)\n {\n if (vuln > 1) s = \"s of Java are\";\n else s = \" of Java is\";\n\n report =\n '\\n' +\n 'The following vulnerable instance'+s+' installed on the\\n' +\n 'remote host :\\n' +\n info;\n security_hole(port:0, extra:report);\n }\n else security_hole(0);\n if (granular) exit(0, granular);\n}\nelse\n{\n if (granular) exit(0, granular);\n\n installed_versions = substr(installed_versions, 3);\n if (vuln2 > 1)\n exit(0, \"The Java \"+installed_versions+\" installations on the remote host are not affected.\");\n else\n audit(AUDIT_INST_VER_NOT_VULN, \"Java\", installed_versions);\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-25T15:02:09", "description": "This update for java-1_8_0-openjdk fixes the following issues :\n\n - Upgrade to version jdk8u101 (icedtea 3.1.0)\n\n - New in release 3.1.0 (2016-07-25) :\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (boo#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (boo#989734)\n\n - S8146514: Enforce GCM limits\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (boo#989730)\n\n - S8149070: Enforce update ordering\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (boo#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (boo#989733)\n\n - S8153312: Constrain AppCDS behavior\n\n - S8154475, CVE-2016-3587: Clean up lookup visibility (boo#989721)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (boo#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (boo#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (boo#989725)\n\n - CVE-2016-3552 (boo#989726)\n\n - CVE-2016-3511 (boo#989727)\n\n - CVE-2016-3503 (boo#989728)\n\n - CVE-2016-3498 (boo#989729)\n\n - New features\n\n - S8145547, PR1061: [AWT/Swing] Conditional support for GTK 3 on Linux\n\n - PR2821: Support building OpenJDK with --disable-headful\n\n - PR2931, G478960: Provide Infinality Support via fontconfig\n\n - PR3079: Provide option to build Shenandoah on x86_64\n\n - Import of OpenJDK 8 u92 build 14\n\n - S6869327: Add new C2 flag to keep safepoints in counted loops.\n\n - S8022865: [TESTBUG] Compressed Oops testing needs to be revised\n\n - S8029630: Thread id should be displayed as a hex number in error report\n\n - S8029726: On OS X some dtrace probe names are mismatched with Solaris\n\n - S8029727: On OS X dtrace probes Call<type>MethodA/Call<type>MethodV are not fired.\n\n - S8029728: On OS X dtrace probes SetStaticBooleanField are not fired\n\n - S8038184: XMLSignature throws StringIndexOutOfBoundsException if ID attribute value is empty String\n\n - S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits\n\n - S8041501: ImageIO reader is not capable of reading JPEGs without JFIF header\n\n - S8041900: [macosx] Java forces the use of discrete GPU\n\n - S8044363: Remove special build options for unpack200 executable\n\n - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy value for hotspot ARCH\n\n - S8046611: Build errors with gcc on sparc/fastdebug\n\n - S8047763: Recognize sparc64 as a sparc platform\n\n - S8048232: Fix for 8046471 breaks PPC64 build\n\n - S8052396: Catch exceptions resulting from missing font cmap\n\n - S8058563: InstanceKlass::_dependencies list isn't cleared from empty nmethodBucket entries\n\n - S8061624: [TESTBUG] Some tests cannot be ran under compact profiles and therefore shall be excluded\n\n - S8062901: Iterators is spelled incorrectly in the Javadoc for Spliterator\n\n - S8064330: Remove SHA224 from the default support list if SunMSCAPI enabled\n\n - S8065579: WB method to start G1 concurrent mark cycle should be introduced\n\n - S8065986: Compiler fails to NullPointerException when calling super with Object<>()\n\n - S8066974: Compiler doesn't infer method's generic type information in lambda body\n\n - S8067800: Clarify java.time.chrono.Chronology.isLeapYear for out of range years\n\n - S8068033: JNI exception pending in jdk/src/share/bin/java.c\n\n - S8068042: Check jdk/src/share/native/sun/misc/URLClassPath.c for JNI pending\n\n - S8068162: jvmtiRedefineClasses.cpp: guarantee(false) failed: OLD and/or OBSOLETE method(s) found\n\n - S8068254: Method reference uses wrong qualifying type\n\n - S8074696: Remote debugging session hangs for several minutes when calling findBootType\n\n - S8074935: jdk8 keytool doesn't validate pem files for RFC 1421 correctness, as jdk7 did\n\n - S8078423: [TESTBUG] javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on system locale\n\n - S8080492: [Parfait] Uninitialised variable in jdk/src/java/desktop/windows/native/libawt/\n\n - S8080650: Enable stubs to use frame pointers correctly\n\n - S8122944: perfdata used is seen as too high on sparc zone with jdk1.9 and causes a test failure\n\n - S8129348: Debugger hangs in trace mode with TRACE_SENDS\n\n - S8129847: Compiling methods generated by Nashorn triggers high memory usage in C2\n\n - S8130506: javac AssertionError when invoking MethodHandle.invoke with lambda parameter\n\n - S8130910: hsperfdata file is created in wrong directory and not cleaned up if /tmp/hsperfdata_<username> has wrong permissions\n\n - S8131129: Attempt to define a duplicate BMH$Species class\n\n - S8131665: Bad exception message in HandshakeHash.getFinishedHash\n\n - S8131782: C1 Class.cast optimization breaks when Class is loaded from static final\n\n - S8132503: [macosx] Chinese full stop symbol cannot be entered with Pinyin IM on OS X\n\n - S8133207: ParallelProbes.java test fails after changes for JDK-8080115\n\n - S8133924: NPE may be thrown when xsltc select a non-existing node after JDK-8062518\n\n - S8134007: Improve string folding\n\n - S8134759: jdb: Incorrect stepping inside finally block\n\n - S8134963: [Newtest] New stress test for changing the coarseness level of G1 remembered set\n\n - S8136442: Don't tie Certificate signature algorithms to ciphersuites\n\n - S8137106: EUDC (End User Defined Characters) are not displayed on Windows with Java 8u60+\n\n - S8138745: Implement ExitOnOutOfMemory and CrashOnOutOfMemory in HotSpot\n\n - S8138764: In some cases the usage of TreeLock can be replaced by other synchronization\n\n - S8139373: [TEST_BUG] java/net/MulticastSocket/MultiDead.java failed with timeout\n\n - S8139424: SIGSEGV, Problematic frame: # V [libjvm.so+0xd0c0cc] void InstanceKlass::oop_oop_iterate_oop_maps_specialized<true ,oopDesc*,MarkAndPushClosure>\n\n - S8139436: sun.security.mscapi.KeyStore might load incomplete data\n\n - S8139751: Javac crash with -XDallowStringFolding=false\n\n - S8139863: [TESTBUG] Need to port tests for JDK-8134903 to 8u-dev\n\n - S8139985: JNI exception pending in jdk/src/jdk/hprof/agent/share/native/libhprof\n\n - S8140031: SA: Searching for a value in Threads does not work\n\n - S8140249: JVM Crashing During startUp If Flight Recording is enabled\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8140587: Atomic*FieldUpdaters should use Class.isInstance instead of direct class check\n\n - S8141260: isReachable crash in windows xp\n\n - S8143297: Nashorn compilation time reported in nanoseconds\n\n - S8143397: It looks like InetAddress.isReachable(timeout) works incorrectly\n\n - S8143855: Bad printf formatting in frame_zero.cpp\n\n - S8143896: java.lang.Long is implicitly converted to double\n\n - S8143963: improve ClassLoader::trace_class_path to accept an additional outputStream* arg\n\n - S8144020: Remove long as an internal numeric type\n\n - S8144131: ArrayData.getInt implementations do not convert to int32\n\n - S8144483: One long Safepoint pause directly after each GC log rotation\n\n - S8144487: PhaseIdealLoop::build_and_optimize() must restore major_progress flag if skip_loop_opts is true\n\n - S8144885: agent/src/os/linux/libproc.h needs to support Linux/SPARC builds\n\n - S8144935: C2: safepoint is pruned from a non-counted loop\n\n - S8144937: [TEST_BUG] testlibrary_tests should be excluded for compact1 and compact2 execution\n\n - S8145017: Add support for 3 digit hotspot minor version numbers\n\n - S8145099: Better error message when SA can't attach to a process\n\n - S8145442: Add the facility to verify remembered sets for G1\n\n - S8145466: javac: No line numbers in compilation error\n\n - S8145539: (coll) AbstractMap.keySet and .values should not be volatile\n\n - S8145550: Megamorphic invoke should use CompiledFunction variants without any LinkLogic\n\n - S8145669: apply2call optimized callsite fails after becoming megamorphic\n\n - S8145722: NullPointerException in javadoc\n\n - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset() does not match AddI\n\n - S8146147: Java linker indexed property getter does not work for computed nashorn string\n\n - S8146566: OpenJDK build can't handle commas in LDFLAGS\n\n - S8146725: Issues with SignatureAndHashAlgorithm.getSupportedAlgorithms\n\n - S8146979: Backport of 8046471 breaks ppc64 build in jdk8u because 8072383 was badly backported before\n\n - S8147087: Race when reusing PerRegionTable bitmaps may result in dropped remembered set entries\n\n - S8147630: Wrong test result pushed to 8u-dev\n\n - S8147845: Varargs Array functions still leaking longs\n\n - S8147857: RMIConnector logs attribute names incorrectly\n\n - S8148353: [linux-sparc] Crash in libawt.so on Linux SPARC\n\n - S8150791: 8u76 L10n resource file translation update\n\n - Import of OpenJDK 8 u101 build 13\n\n - S6483657: MSCAPI provider does not create unique alias names\n\n - S6675699: need comprehensive fix for unconstrained ConvI2L with narrowed type\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying timestamp hash algorithm\n\n - S8081778: Use Intel x64 CPU instructions for RSA acceleration\n\n - S8130150: Implement BigInteger.montgomeryMultiply intrinsic\n\n - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts\n\n - S8143913: MSCAPI keystore should accept Certificate[] in setEntry()\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146240: Three nashorn files contain 'GNU General Public License' header\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811\n\n - S8147994: [macosx] JScrollPane jitters up/down during trackpad scrolling on MacOS/Aqua\n\n - S8151522: Disable 8130150 and 8081778 intrinsics by default\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8152098: Fix 8151522 caused test compiler/intrinsics/squaretolen/TestSquareToLen.java to fail\n\n - S8157077: 8u101 L10n resource file updates\n\n - Backports\n\n - S6260348, PR3066: GTK+ L&F JTextComponent not respecting desktop caret blink rate\n\n - S6778087, PR1061: getLocationOnScreen() always returns (0, 0) for mouse wheel events\n\n - S6961123, PR2972: setWMClass fails to null-terminate WM_CLASS string\n\n - S8008657, PR3077: JSpinner setComponentOrientation doesn't affect on text orientation\n\n - S8014212, PR2866: Robot captures black screen\n\n - S8029339, PR1061: Custom MultiResolution image support on HiDPI displays\n\n - S8031145, PR3077: Re-examine closed i18n tests to see it they can be moved to the jdk repository.\n\n - S8034856, PR3095: gcc warnings compiling src/solaris/native/sun/security/pkcs11\n\n - S8034857, PR3095: gcc warnings compiling src/solaris/native/sun/management\n\n - S8035054, PR3095: JarFacade.c should not include ctype.h\n\n - S8035287, PR3095: gcc warnings compiling various libraries files\n\n - S8038631, PR3077: Create wrapper for awt.Robot with additional functionality\n\n - S8039279, PR3077: Move awt tests to openjdk repository\n\n - S8041561, PR3077: Inconsistent opacity behaviour between JCheckBox and JRadioButton\n\n - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing tests to jdk\n\n - S8041915, PR3077: Move 8 awt tests to OpenJDK regression tests tree\n\n - S8043126, PR3077: move awt automated functional tests from AWT_Events/Lw and AWT_Events/AWT to OpenJDK repository\n\n - S8043131, PR3077: Move ShapedAndTranslucentWindows and GC functional AWT tests to regression tree\n\n - S8044157, PR3077: [TEST_BUG] Improve recently submitted AWT_Mixing tests\n\n - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758 and AltPlusNumberKeyCombinationsTest to jdk\n\n - S8044429, PR3077: move awt automated tests for AWT_Modality to OpenJDK repository\n\n - S8044762, PR2960: com/sun/jdi/OptionTest.java test time out\n\n - S8044765, PR3077: Move functional tests AWT_SystemTray/Automated to openjdk repository\n\n - S8047180, PR3077: Move functional tests AWT_Headless/Automated to OpenJDK repository\n\n - S8047367, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 2\n\n - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated functional tests to OpenJDK\n\n - S8049226, PR2960: com/sun/jdi/OptionTest.java test times out again\n\n - S8049617, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 3\n\n - S8049694, PR3077: Migrate functional AWT_DesktopProperties/Automated tests to OpenJDK\n\n - S8050885, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 4\n\n - S8051440, PR3077: move tests about maximizing undecorated to OpenJDK\n\n - S8052012, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 5\n\n - S8052408, PR3077: Move AWT_BAT functional tests to OpenJDK (3 of 3)\n\n - S8053657, PR3077: [TEST_BUG] move some 5 tests related to undecorated Frame/JFrame to JDK\n\n - S8054143, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 6\n\n - S8054358, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 7\n\n - S8054359, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 8\n\n - S8055360, PR3077: Move the rest part of AWT ShapedAndTranslucent tests to OpenJDK\n\n - S8055664, PR3077: move 14 tests about setLocationRelativeTo to jdk\n\n - S8055836, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 9\n\n - S8056911, PR3077: Remove internal API usage from ExtendedRobot class\n\n - S8057694, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 10\n\n - S8058959, PR1061:\n closed/java/awt/event/ComponentEvent/MovedResizedTwiceTe st/MovedResizedTwiceTest.java failed automatically\n\n - S8062606, PR3077: Fix a typo in java.awt.Robot class\n\n - S8063102, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063104, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8063106, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063107, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8064573, PR3077: [TEST_BUG] javax/swing/text/AbstractDocument/6968363/Test6968363.ja va is asocial pressing VK_LEFT and not releasing\n\n - S8064575, PR3077: [TEST_BUG] javax/swing/JEditorPane/6917744/bug6917744.java 100 times press keys and never releases\n\n - S8064809, PR3077: [TEST_BUG] javax/swing/JComboBox/4199622/bug4199622.java contains a lot of keyPress and not a single keyRelease\n\n - S8067441, PR3077: Some tests fails with error: cannot find symbol getSystemMnemonicKeyCodes()\n\n - S8068228, PR3077: Test closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameT est fails with GTKLookAndFeel\n\n - S8069361, PR1061: SunGraphics2D.getDefaultTransform() does not include scale factor\n\n - S8073320, PR1061: Windows HiDPI Graphics support\n\n - S8074807, PR3077: Fix some tests unnecessary using internal API\n\n - S8076315, PR3077: move 4 manual functional swing tests to regression suite\n\n - S8078504, PR3094: Zero lacks declaration of VM_Version::initialize()\n\n - S8129822, PR3077: Define 'headful' jtreg keyword\n\n - S8132123, PR1061: MultiResolutionCachedImage unnecessarily creates base image to get its size\n\n - S8133539, PR1061: [TEST_BUG] Split java/awt/image/MultiResolutionImageTest.java in two to allow restricted access\n\n - S8137571, PR1061: Linux HiDPI Graphics support\n\n - S8142406, PR1061: [TEST] MultiResolution image: need test to cover the case when @2x image is corrupted\n\n - S8145188, PR2945: No LocalVariableTable generated for the entire JDK\n\n - S8150258, PR1061: [TEST] HiDPI: create a test for multiresolution menu items icons\n\n - S8150724, PR1061: [TEST] HiDPI: create a test for multiresolution icons\n\n - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale should be taken into account for OS X\n\n - S8151841, PR2882: Build needs additional flags to compile with GCC 6 [plus parts of 8149647 & 8032045]\n\n - S8155613, PR1061: [PIT] crash in AWT_Desktop/Automated/Exceptions/BasicTest\n\n - S8156020, PR1061: 8145547 breaks AIX and and uses RTLD_NOLOAD incorrectly\n\n - S8156128, PR1061: Tests for [AWT/Swing] Conditional support for GTK 3 on Linux\n\n - S8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions\n\n - S8159244, PR3074: Partially initialized string object created by C2's string concat optimization may escape\n\n - S8159690, PR3077: [TESTBUG] Mark headful tests with @key headful.\n\n - S8160294, PR2882, PR3095: Some client libraries cannot be built with GCC 6\n\n - Bug fixes\n\n - PR1958: GTKLookAndFeel does not honor gtk-alternative-button-order\n\n - PR2822: Feed LIBS & CFLAGS into configure rather than make to avoid re-discovery by OpenJDK configure\n\n - PR2932: Support ccache in a non-automagic manner\n\n - PR2933: Support ccache 3.2 and later\n\n - PR2964: Set system defaults based on OS\n\n - PR2974, RH1337583: PKCS#10 certificate requests now use CRLF line endings rather than system line endings\n\n - PR3078: Remove duplicated line dating back to 6788347 and 6894807\n\n - PR3083, RH1346460: Regression in SSL debug output without an ECC provider\n\n - PR3089: Remove old memory limits patch\n\n - PR3090, RH1204159: SystemTap is heavily confused by multiple JDKs\n\n - PR3095: Fix warnings in URLClassPath.c\n\n - PR3096: Remove dead --disable-optimizations option\n\n - PR3105: Use version from hotspot.map to create tarball filename\n\n - PR3106: Handle both correctly-spelt property 'enableCustomValueHandler' introduced by S8079718 and typo version\n\n - PR3108: Shenandoah patches not included in release tarball\n\n - PR3110: Update hotspot.map documentation in INSTALL\n\n - Fix script linking /usr/share/javazi/tzdb.dat for platform where it applies (boo#987895)\n\n - Fix aarch64 running with 48 bits va space (boo#984684)", "cvss3": {}, "published": "2016-08-08T00:00:00", "type": "nessus", "title": "openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-944)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:java-1_8_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debugsource", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-src", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2016-944.NASL", "href": "https://www.tenable.com/plugins/nessus/92774", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-944.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92774);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3552\", \"CVE-2016-3587\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2016-944)\");\n script_summary(english:\"Check for the openSUSE-2016-944 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for java-1_8_0-openjdk fixes the following issues :\n\n - Upgrade to version jdk8u101 (icedtea 3.1.0)\n\n - New in release 3.1.0 (2016-07-25) :\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (boo#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (boo#989734)\n\n - S8146514: Enforce GCM limits\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (boo#989730)\n\n - S8149070: Enforce update ordering\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (boo#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (boo#989733)\n\n - S8153312: Constrain AppCDS behavior\n\n - S8154475, CVE-2016-3587: Clean up lookup visibility\n (boo#989721)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (boo#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (boo#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (boo#989725)\n\n - CVE-2016-3552 (boo#989726)\n\n - CVE-2016-3511 (boo#989727)\n\n - CVE-2016-3503 (boo#989728)\n\n - CVE-2016-3498 (boo#989729)\n\n - New features\n\n - S8145547, PR1061: [AWT/Swing] Conditional support for\n GTK 3 on Linux\n\n - PR2821: Support building OpenJDK with --disable-headful\n\n - PR2931, G478960: Provide Infinality Support via\n fontconfig\n\n - PR3079: Provide option to build Shenandoah on x86_64\n\n - Import of OpenJDK 8 u92 build 14\n\n - S6869327: Add new C2 flag to keep safepoints in counted\n loops.\n\n - S8022865: [TESTBUG] Compressed Oops testing needs to be\n revised\n\n - S8029630: Thread id should be displayed as a hex number\n in error report\n\n - S8029726: On OS X some dtrace probe names are mismatched\n with Solaris\n\n - S8029727: On OS X dtrace probes\n Call<type>MethodA/Call<type>MethodV are not fired.\n\n - S8029728: On OS X dtrace probes SetStaticBooleanField\n are not fired\n\n - S8038184: XMLSignature throws\n StringIndexOutOfBoundsException if ID attribute value is\n empty String\n\n - S8038349: Signing XML with DSA throws Exception when key\n is larger than 1024 bits\n\n - S8041501: ImageIO reader is not capable of reading JPEGs\n without JFIF header\n\n - S8041900: [macosx] Java forces the use of discrete GPU\n\n - S8044363: Remove special build options for unpack200\n executable\n\n - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy\n value for hotspot ARCH\n\n - S8046611: Build errors with gcc on sparc/fastdebug\n\n - S8047763: Recognize sparc64 as a sparc platform\n\n - S8048232: Fix for 8046471 breaks PPC64 build\n\n - S8052396: Catch exceptions resulting from missing font\n cmap\n\n - S8058563: InstanceKlass::_dependencies list isn't\n cleared from empty nmethodBucket entries\n\n - S8061624: [TESTBUG] Some tests cannot be ran under\n compact profiles and therefore shall be excluded\n\n - S8062901: Iterators is spelled incorrectly in the\n Javadoc for Spliterator\n\n - S8064330: Remove SHA224 from the default support list if\n SunMSCAPI enabled\n\n - S8065579: WB method to start G1 concurrent mark cycle\n should be introduced\n\n - S8065986: Compiler fails to NullPointerException when\n calling super with Object<>()\n\n - S8066974: Compiler doesn't infer method's generic type\n information in lambda body\n\n - S8067800: Clarify java.time.chrono.Chronology.isLeapYear\n for out of range years\n\n - S8068033: JNI exception pending in\n jdk/src/share/bin/java.c\n\n - S8068042: Check\n jdk/src/share/native/sun/misc/URLClassPath.c for JNI\n pending\n\n - S8068162: jvmtiRedefineClasses.cpp: guarantee(false)\n failed: OLD and/or OBSOLETE method(s) found\n\n - S8068254: Method reference uses wrong qualifying type\n\n - S8074696: Remote debugging session hangs for several\n minutes when calling findBootType\n\n - S8074935: jdk8 keytool doesn't validate pem files for\n RFC 1421 correctness, as jdk7 did\n\n - S8078423: [TESTBUG]\n javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on\n system locale\n\n - S8080492: [Parfait] Uninitialised variable in\n jdk/src/java/desktop/windows/native/libawt/\n\n - S8080650: Enable stubs to use frame pointers correctly\n\n - S8122944: perfdata used is seen as too high on sparc\n zone with jdk1.9 and causes a test failure\n\n - S8129348: Debugger hangs in trace mode with TRACE_SENDS\n\n - S8129847: Compiling methods generated by Nashorn\n triggers high memory usage in C2\n\n - S8130506: javac AssertionError when invoking\n MethodHandle.invoke with lambda parameter\n\n - S8130910: hsperfdata file is created in wrong directory\n and not cleaned up if /tmp/hsperfdata_<username> has\n wrong permissions\n\n - S8131129: Attempt to define a duplicate BMH$Species\n class\n\n - S8131665: Bad exception message in\n HandshakeHash.getFinishedHash\n\n - S8131782: C1 Class.cast optimization breaks when Class\n is loaded from static final\n\n - S8132503: [macosx] Chinese full stop symbol cannot be\n entered with Pinyin IM on OS X\n\n - S8133207: ParallelProbes.java test fails after changes\n for JDK-8080115\n\n - S8133924: NPE may be thrown when xsltc select a\n non-existing node after JDK-8062518\n\n - S8134007: Improve string folding\n\n - S8134759: jdb: Incorrect stepping inside finally block\n\n - S8134963: [Newtest] New stress test for changing the\n coarseness level of G1 remembered set\n\n - S8136442: Don't tie Certificate signature algorithms to\n ciphersuites\n\n - S8137106: EUDC (End User Defined Characters) are not\n displayed on Windows with Java 8u60+\n\n - S8138745: Implement ExitOnOutOfMemory and\n CrashOnOutOfMemory in HotSpot\n\n - S8138764: In some cases the usage of TreeLock can be\n replaced by other synchronization\n\n - S8139373: [TEST_BUG]\n java/net/MulticastSocket/MultiDead.java failed with\n timeout\n\n - S8139424: SIGSEGV, Problematic frame: # V\n [libjvm.so+0xd0c0cc] void\n InstanceKlass::oop_oop_iterate_oop_maps_specialized<true\n ,oopDesc*,MarkAndPushClosure>\n\n - S8139436: sun.security.mscapi.KeyStore might load\n incomplete data\n\n - S8139751: Javac crash with -XDallowStringFolding=false\n\n - S8139863: [TESTBUG] Need to port tests for JDK-8134903\n to 8u-dev\n\n - S8139985: JNI exception pending in\n jdk/src/jdk/hprof/agent/share/native/libhprof\n\n - S8140031: SA: Searching for a value in Threads does not\n work\n\n - S8140249: JVM Crashing During startUp If Flight\n Recording is enabled\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8140587: Atomic*FieldUpdaters should use\n Class.isInstance instead of direct class check\n\n - S8141260: isReachable crash in windows xp\n\n - S8143297: Nashorn compilation time reported in\n nanoseconds\n\n - S8143397: It looks like InetAddress.isReachable(timeout)\n works incorrectly\n\n - S8143855: Bad printf formatting in frame_zero.cpp\n\n - S8143896: java.lang.Long is implicitly converted to\n double\n\n - S8143963: improve ClassLoader::trace_class_path to\n accept an additional outputStream* arg\n\n - S8144020: Remove long as an internal numeric type\n\n - S8144131: ArrayData.getInt implementations do not\n convert to int32\n\n - S8144483: One long Safepoint pause directly after each\n GC log rotation\n\n - S8144487: PhaseIdealLoop::build_and_optimize() must\n restore major_progress flag if skip_loop_opts is true\n\n - S8144885: agent/src/os/linux/libproc.h needs to support\n Linux/SPARC builds\n\n - S8144935: C2: safepoint is pruned from a non-counted\n loop\n\n - S8144937: [TEST_BUG] testlibrary_tests should be\n excluded for compact1 and compact2 execution\n\n - S8145017: Add support for 3 digit hotspot minor version\n numbers\n\n - S8145099: Better error message when SA can't attach to a\n process\n\n - S8145442: Add the facility to verify remembered sets for\n G1\n\n - S8145466: javac: No line numbers in compilation error\n\n - S8145539: (coll) AbstractMap.keySet and .values should\n not be volatile\n\n - S8145550: Megamorphic invoke should use CompiledFunction\n variants without any LinkLogic\n\n - S8145669: apply2call optimized callsite fails after\n becoming megamorphic\n\n - S8145722: NullPointerException in javadoc\n\n - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset()\n does not match AddI\n\n - S8146147: Java linker indexed property getter does not\n work for computed nashorn string\n\n - S8146566: OpenJDK build can't handle commas in LDFLAGS\n\n - S8146725: Issues with\n SignatureAndHashAlgorithm.getSupportedAlgorithms\n\n - S8146979: Backport of 8046471 breaks ppc64 build in\n jdk8u because 8072383 was badly backported before\n\n - S8147087: Race when reusing PerRegionTable bitmaps may\n result in dropped remembered set entries\n\n - S8147630: Wrong test result pushed to 8u-dev\n\n - S8147845: Varargs Array functions still leaking longs\n\n - S8147857: RMIConnector logs attribute names incorrectly\n\n - S8148353: [linux-sparc] Crash in libawt.so on Linux\n SPARC\n\n - S8150791: 8u76 L10n resource file translation update\n\n - Import of OpenJDK 8 u101 build 13\n\n - S6483657: MSCAPI provider does not create unique alias\n names\n\n - S6675699: need comprehensive fix for unconstrained\n ConvI2L with narrowed type\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying\n timestamp hash algorithm\n\n - S8081778: Use Intel x64 CPU instructions for RSA\n acceleration\n\n - S8130150: Implement BigInteger.montgomeryMultiply\n intrinsic\n\n - S8130735: javax.swing.TimerQueue: timer fires late when\n another timer starts\n\n - S8143913: MSCAPI keystore should accept Certificate[] in\n setEntry()\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146240: Three nashorn files contain 'GNU General\n Public License' header\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket\n accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory\n regression tests fail after JDK-8138811\n\n - S8147994: [macosx] JScrollPane jitters up/down during\n trackpad scrolling on MacOS/Aqua\n\n - S8151522: Disable 8130150 and 8081778 intrinsics by\n default\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8152098: Fix 8151522 caused test\n compiler/intrinsics/squaretolen/TestSquareToLen.java to\n fail\n\n - S8157077: 8u101 L10n resource file updates\n\n - Backports\n\n - S6260348, PR3066: GTK+ L&F JTextComponent not respecting\n desktop caret blink rate\n\n - S6778087, PR1061: getLocationOnScreen() always returns\n (0, 0) for mouse wheel events\n\n - S6961123, PR2972: setWMClass fails to null-terminate\n WM_CLASS string\n\n - S8008657, PR3077: JSpinner setComponentOrientation\n doesn't affect on text orientation\n\n - S8014212, PR2866: Robot captures black screen\n\n - S8029339, PR1061: Custom MultiResolution image support\n on HiDPI displays\n\n - S8031145, PR3077: Re-examine closed i18n tests to see it\n they can be moved to the jdk repository.\n\n - S8034856, PR3095: gcc warnings compiling\n src/solaris/native/sun/security/pkcs11\n\n - S8034857, PR3095: gcc warnings compiling\n src/solaris/native/sun/management\n\n - S8035054, PR3095: JarFacade.c should not include ctype.h\n\n - S8035287, PR3095: gcc warnings compiling various\n libraries files\n\n - S8038631, PR3077: Create wrapper for awt.Robot with\n additional functionality\n\n - S8039279, PR3077: Move awt tests to openjdk repository\n\n - S8041561, PR3077: Inconsistent opacity behaviour between\n JCheckBox and JRadioButton\n\n - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing\n tests to jdk\n\n - S8041915, PR3077: Move 8 awt tests to OpenJDK regression\n tests tree\n\n - S8043126, PR3077: move awt automated functional tests\n from AWT_Events/Lw and AWT_Events/AWT to OpenJDK\n repository\n\n - S8043131, PR3077: Move ShapedAndTranslucentWindows and\n GC functional AWT tests to regression tree\n\n - S8044157, PR3077: [TEST_BUG] Improve recently submitted\n AWT_Mixing tests\n\n - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758\n and AltPlusNumberKeyCombinationsTest to jdk\n\n - S8044429, PR3077: move awt automated tests for\n AWT_Modality to OpenJDK repository\n\n - S8044762, PR2960: com/sun/jdi/OptionTest.java test time\n out\n\n - S8044765, PR3077: Move functional tests\n AWT_SystemTray/Automated to openjdk repository\n\n - S8047180, PR3077: Move functional tests\n AWT_Headless/Automated to OpenJDK repository\n\n - S8047367, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 2\n\n - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated\n functional tests to OpenJDK\n\n - S8049226, PR2960: com/sun/jdi/OptionTest.java test times\n out again\n\n - S8049617, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 3\n\n - S8049694, PR3077: Migrate functional\n AWT_DesktopProperties/Automated tests to OpenJDK\n\n - S8050885, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 4\n\n - S8051440, PR3077: move tests about maximizing\n undecorated to OpenJDK\n\n - S8052012, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 5\n\n - S8052408, PR3077: Move AWT_BAT functional tests to\n OpenJDK (3 of 3)\n\n - S8053657, PR3077: [TEST_BUG] move some 5 tests related\n to undecorated Frame/JFrame to JDK\n\n - S8054143, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 6\n\n - S8054358, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 7\n\n - S8054359, PR3077: move awt automated tests from\n AWT_Modality to OpenJDK repository - part 8\n\n - S8055360, PR3077: Move the rest part of AWT\n ShapedAndTranslucent tests to OpenJDK\n\n - S8055664, PR3077: move 14 tests about\n setLocationRelativeTo to jdk\n\n - S8055836, PR3077: move awt tests from AWT_Modality to\n OpenJDK repository - part 9\n\n - S8056911, PR3077: Remove internal API usage from\n ExtendedRobot class\n\n - S8057694, PR3077: move awt tests from AWT_Modality to\n OpenJDK repository - part 10\n\n - S8058959, PR1061:\n closed/java/awt/event/ComponentEvent/MovedResizedTwiceTe\n st/MovedResizedTwiceTest.java failed automatically\n\n - S8062606, PR3077: Fix a typo in java.awt.Robot class\n\n - S8063102, PR3077: Change open awt regression tests to\n avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063104, PR3077: Change open awt regression tests to\n avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8063106, PR3077: Change open swing regression tests to\n avoid sun.awt.SunToolkit.realSync, part 1\n\n - S8063107, PR3077: Change open swing regression tests to\n avoid sun.awt.SunToolkit.realSync, part 2\n\n - S8064573, PR3077: [TEST_BUG]\n javax/swing/text/AbstractDocument/6968363/Test6968363.ja\n va is asocial pressing VK_LEFT and not releasing\n\n - S8064575, PR3077: [TEST_BUG]\n javax/swing/JEditorPane/6917744/bug6917744.java 100\n times press keys and never releases\n\n - S8064809, PR3077: [TEST_BUG]\n javax/swing/JComboBox/4199622/bug4199622.java contains a\n lot of keyPress and not a single keyRelease\n\n - S8067441, PR3077: Some tests fails with error: cannot\n find symbol getSystemMnemonicKeyCodes()\n\n - S8068228, PR3077: Test\n closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameT\n est fails with GTKLookAndFeel\n\n - S8069361, PR1061: SunGraphics2D.getDefaultTransform()\n does not include scale factor\n\n - S8073320, PR1061: Windows HiDPI Graphics support\n\n - S8074807, PR3077: Fix some tests unnecessary using\n internal API\n\n - S8076315, PR3077: move 4 manual functional swing tests\n to regression suite\n\n - S8078504, PR3094: Zero lacks declaration of\n VM_Version::initialize()\n\n - S8129822, PR3077: Define 'headful' jtreg keyword\n\n - S8132123, PR1061: MultiResolutionCachedImage\n unnecessarily creates base image to get its size\n\n - S8133539, PR1061: [TEST_BUG] Split\n java/awt/image/MultiResolutionImageTest.java in two to\n allow restricted access\n\n - S8137571, PR1061: Linux HiDPI Graphics support\n\n - S8142406, PR1061: [TEST] MultiResolution image: need\n test to cover the case when @2x image is corrupted\n\n - S8145188, PR2945: No LocalVariableTable generated for\n the entire JDK\n\n - S8150258, PR1061: [TEST] HiDPI: create a test for\n multiresolution menu items icons\n\n - S8150724, PR1061: [TEST] HiDPI: create a test for\n multiresolution icons\n\n - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale\n should be taken into account for OS X\n\n - S8151841, PR2882: Build needs additional flags to\n compile with GCC 6 [plus parts of 8149647 & 8032045]\n\n - S8155613, PR1061: [PIT] crash in\n AWT_Desktop/Automated/Exceptions/BasicTest\n\n - S8156020, PR1061: 8145547 breaks AIX and and uses\n RTLD_NOLOAD incorrectly\n\n - S8156128, PR1061: Tests for [AWT/Swing] Conditional\n support for GTK 3 on Linux\n\n - S8158260, PR2991, RH1341258: PPC64: unaligned\n Unsafe.getInt can lead to the generation of illegal\n instructions\n\n - S8159244, PR3074: Partially initialized string object\n created by C2's string concat optimization may escape\n\n - S8159690, PR3077: [TESTBUG] Mark headful tests with @key\n headful.\n\n - S8160294, PR2882, PR3095: Some client libraries cannot\n be built with GCC 6\n\n - Bug fixes\n\n - PR1958: GTKLookAndFeel does not honor\n gtk-alternative-button-order\n\n - PR2822: Feed LIBS & CFLAGS into configure rather than\n make to avoid re-discovery by OpenJDK configure\n\n - PR2932: Support ccache in a non-automagic manner\n\n - PR2933: Support ccache 3.2 and later\n\n - PR2964: Set system defaults based on OS\n\n - PR2974, RH1337583: PKCS#10 certificate requests now use\n CRLF line endings rather than system line endings\n\n - PR3078: Remove duplicated line dating back to 6788347\n and 6894807\n\n - PR3083, RH1346460: Regression in SSL debug output\n without an ECC provider\n\n - PR3089: Remove old memory limits patch\n\n - PR3090, RH1204159: SystemTap is heavily confused by\n multiple JDKs\n\n - PR3095: Fix warnings in URLClassPath.c\n\n - PR3096: Remove dead --disable-optimizations option\n\n - PR3105: Use version from hotspot.map to create tarball\n filename\n\n - PR3106: Handle both correctly-spelt property\n 'enableCustomValueHandler' introduced by S8079718 and\n typo version\n\n - PR3108: Shenandoah patches not included in release\n tarball\n\n - PR3110: Update hotspot.map documentation in INSTALL\n\n - Fix script linking /usr/share/javazi/tzdb.dat for\n platform where it applies (boo#987895)\n\n - Fix aarch64 running with 48 bits va space (boo#984684)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=984684\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=987895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989726\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1_8_0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-accessibility-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-demo-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-devel-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-headless-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-javadoc-1.8.0.101-30.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_8_0-openjdk-src-1.8.0.101-30.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-openjdk / java-1_8_0-openjdk-accessibility / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:26:15", "description": "The version of Oracle Java SE installed on the remote host is prior to 6 Update 121, 7 Update 111, or 8 Update 102 and is affected by multiple vulnerabilities :\n\n - An unspecified flaw exists in the 'CORBA' subcomponent that allows an unauthenticated, remote attacker to impact integrity. (CVE-2016-3458)\n - An unspecified flaw exists in the 'Networking' subcomponent that allows a local attacker to impact integrity. (CVE-2016-3485)\n - An unspecified flaw exists in the 'JavaFX' subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3498)\n - An unspecified flaw exists in the 'JAXP' subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2016-3500, CVE-2016-3508)\n - An unspecified flaw exists in the 'Install' subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3503, CVE-2016-3552)\n - An unspecified flaw exists in the 'Deployment' subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3511)\n - An unspecified flaw exists in the 'Hotspot' subcomponent that allows an unauthenticated, remote attacker to disclose potentially sensitive information. (CVE-2016-3550)\n - A flaw exists in the 'Hotspot' subcomponent due to improper access to the 'MethodHandle::invokeBasic()' function. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-3587)\n - A flaw exists in the 'Libraries' subcomponent within the 'MethodHandles::dropArguments()' function that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3598)\n - A flaw exists in the 'Hotspot' subcomponent within the 'ClassVerifier::ends_in_athrow()' function when handling bytecode verification. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-3606)\n - An unspecified flaw exists in the 'Libraries' subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3610)", "cvss3": {}, "published": "2016-08-09T00:00:00", "type": "nessus", "title": "Oracle Java SE 6 < Update 121 / 7 < Update 111 / 8 < Update 102 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2019-03-06T00:00:00", "cpe": ["cpe:/a:oracle:java_se"], "id": "9449.PRM", "href": "https://www.tenable.com/plugins/nnm/9449", "sourceData": "Binary data 9449.prm", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-25T15:03:34", "description": "This update for java-1_7_0-openjdk fixes the following issues :\n\n - Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - Import of OpenJDK 7 u111 build 0\n\n - S6953295: Move few sun.security.{util, x509, pkcs} classes used by keytool/jarsigner to another package\n\n - S7060849: Eliminate pack200 build warnings\n\n - S7064075: Security libraries don't build with javac\n\n -Xlint:all,-deprecation -Werror\n\n - S7069870: Parts of the JDK erroneously rely on generic array initializers with diamond\n\n - S7102686: Restructure timestamp code so that jars and modules can more easily share the same code\n\n - S7105780: Add SSLSocket client/SSLEngine server to templates directory\n\n - S7142339: PKCS7.java is needlessly creating SHA1PRNG SecureRandom instances when timestamping is not done\n\n - S7152582: PKCS11 tests should use the NSS libraries available in the OS\n\n - S7192202: Make sure keytool prints both unknown and unparseable extensions\n\n - S7194449: String resources for Key Tool and Policy Tool should be in their respective packages\n\n - S7196855: autotest.sh fails on ubuntu because libsoftokn.so not found\n\n - S7200682: TEST_BUG: keytool/autotest.sh still has problems with libsoftokn.so\n\n - S8002306: (se) Selector.open fails if invoked with thread interrupt status set [win]\n\n - S8009636: JARSigner including TimeStamp PolicyID (TSAPolicyID) as defined in RFC3161\n\n - S8019341: Update CookieHttpsClientTest to use the newer framework.\n\n - S8022228: Intermittent test failures in sun/security/ssl/javax/net/ssl/NewAPIs\n\n - S8022439: Fix lint warnings in sun.security.ec\n\n - S8022594: Potential deadlock in <clinit> of sun.nio.ch.Util/IOUtil\n\n - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently\n\n - S8036612: [parfait] JNI exception pending in jdk/src/windows/native/sun/security/mscapi/security.cpp\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying timestamp hash algorithm\n\n - S8079410: Hotspot version to share the same update and build version from JDK\n\n - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts\n\n - S8139436: sun.security.mscapi.KeyStore might load incomplete data\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811\n\n - S8147857: [TEST] RMIConnector logs attribute names incorrectly\n\n - S8151841, PR3098: Build needs additional flags to compile with GCC 6\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8157077: 8u101 L10n resource file updates\n\n - S8161262: Fix jdk build with gcc 4.1.2:\n -fno-strict-overflow not known.\n\n - Import of OpenJDK 7 u111 build 1\n\n - S7081817:\n test/sun/security/provider/certpath/X509CertPath/Illegal Certificates.java f ailing\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8145017: Add support for 3 digit hotspot minor version numbers\n\n - S8162344: The API changes made by CR 7064075 need to be reverted\n\n - Backports\n\n - S2178143, PR2958: JVM crashes if the number of bound CPUs changed during runtime\n\n - S4900206, PR3101: Include worst-case rounding tests for Math library functions\n\n - S6260348, PR3067: GTK+ L&F JTextComponent not respecting desktop caret blink rate\n\n - S6934604, PR3075: enable parts of EliminateAutoBox by default\n\n - S7043064, PR3020: sun/java2d/cmm/ tests failed against RI b141 & b138-nightly\n\n - S7051394, PR3020: NullPointerException when running regression tests LoadProfileTest by using openjdk-7-b144\n\n - S7086015, PR3013: fix test/tools/javac/parser/netbeans/JavacParserTest.java\n\n - S7119487, PR3013: JavacParserTest.java test fails on Windows platforms\n\n - S7124245, PR3020: [lcms] ColorConvertOp to color space CS_GRAY apparently converts orange to 244,244,0\n\n - S7159445, PR3013: (javac) emits inaccurate diagnostics for enhanced for-loops\n\n - S7175845, PR1437, RH1207129: 'jar uf' changes file permissions unexpectedly\n\n - S8005402, PR3020: Need to provide benchmarks for color management\n\n - S8005530, PR3020: [lcms] Improve performance of ColorConverOp for default destinations\n\n - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel is not transferred from source to destination.\n\n - S8013430, PR3020: REGRESSION:\n closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadPr ofileTest.java fail s with java.io.StreamCorruptedException: invalid type code: EE since 8b87\n\n - S8014286, PR3075: failed java/lang/Math/DivModTests.java after 6934604 changes\n\n - S8014959, PR3075:\n assert(Compile::current()->live_nodes() (uint)MaxNodeLimit) failed: Live Node limit exceeded limit\n\n - S8019247, PR3075: SIGSEGV in compiled method c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object\n\n - S8024511, PR3020: Crash during color profile destruction\n\n - S8025429, PR3020: [parfait] warnings from b107 for sun.java2d.cmm: JNI exception pending\n\n - S8026702, PR3020: Fix for 8025429 breaks jdk build on windows\n\n - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for Java_awt test suit\n\n - S8047066, PR3020: Test test/sun/awt/image/bug8038000.java fails with ClassCastException\n\n - S8069181, PR3012, RH1015612: java.lang.AssertionError when compiling JDK 1.4 code in JDK 8\n\n - S8158260, PR2992, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651)\n\n - S8159244, PR3075: Partially initialized string object created by C2's string concat optimization may escape\n\n - Bug fixes\n\n - PR2799, RH1195203: Files are missing from resources.jar\n\n - PR2900: Don't use WithSeed versions of NSS functions as they don't fully process the seed\n\n - PR3091: SystemTap is heavily confused by multiple JDKs\n\n - PR3102: Extend 8022594 to AixPollPort\n\n - PR3103: Handle case in clean-fonts where linux.fontconfig.Gentoo.properties.old has not been created\n\n - PR3111: Provide option to disable SystemTap tests\n\n - PR3114: Don't assume system mime.types supports text/x-java-source\n\n - PR3115: Add check for elliptic curve cryptography implementation\n\n - PR3116: Add tests for Java debug info and source files\n\n - PR3118: Path to agpl-3.0.txt not updated\n\n - PR3119: Makefile handles cacerts as a symlink, but the configure check doesn't\n\n - AArch64 port\n\n - S8148328, PR3100: aarch64: redundant lsr instructions in stub code.\n\n - S8148783, PR3100: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3100: aarch64: generate_copy_longs calls align() incorrectly\n\n - S8150045, PR3100: arraycopy causes segfaults in SATB during garbage collection\n\n - S8154537, PR3100: AArch64: some integer rotate instructions are never emitted\n\n - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess loads in wrong mode\n\n - S8157906, PR3100: aarch64: some more integer rotate instructions are never emitted\n\n - Enable SunEC for SLE12 and Leap (bsc#982366)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684)</clinit>\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-09-02T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2016:1997-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-1997-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93272", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1997-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93272);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2016:1997-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for java-1_7_0-openjdk fixes the following issues :\n\n - Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (bsc#989734)\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - Import of OpenJDK 7 u111 build 0\n\n - S6953295: Move few sun.security.{util, x509, pkcs}\n classes used by keytool/jarsigner to another package\n\n - S7060849: Eliminate pack200 build warnings\n\n - S7064075: Security libraries don't build with javac\n\n -Xlint:all,-deprecation -Werror\n\n - S7069870: Parts of the JDK erroneously rely on generic\n array initializers with diamond\n\n - S7102686: Restructure timestamp code so that jars and\n modules can more easily share the same code\n\n - S7105780: Add SSLSocket client/SSLEngine server to\n templates directory\n\n - S7142339: PKCS7.java is needlessly creating SHA1PRNG\n SecureRandom instances when timestamping is not done\n\n - S7152582: PKCS11 tests should use the NSS libraries\n available in the OS\n\n - S7192202: Make sure keytool prints both unknown and\n unparseable extensions\n\n - S7194449: String resources for Key Tool and Policy Tool\n should be in their respective packages\n\n - S7196855: autotest.sh fails on ubuntu because\n libsoftokn.so not found\n\n - S7200682: TEST_BUG: keytool/autotest.sh still has\n problems with libsoftokn.so\n\n - S8002306: (se) Selector.open fails if invoked with\n thread interrupt status set [win]\n\n - S8009636: JARSigner including TimeStamp PolicyID\n (TSAPolicyID) as defined in RFC3161\n\n - S8019341: Update CookieHttpsClientTest to use the newer\n framework.\n\n - S8022228: Intermittent test failures in\n sun/security/ssl/javax/net/ssl/NewAPIs\n\n - S8022439: Fix lint warnings in sun.security.ec\n\n - S8022594: Potential deadlock in <clinit> of\n sun.nio.ch.Util/IOUtil\n\n - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails\n intermittently\n\n - S8036612: [parfait] JNI exception pending in\n jdk/src/windows/native/sun/security/mscapi/security.cpp\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying\n timestamp hash algorithm\n\n - S8079410: Hotspot version to share the same update and\n build version from JDK\n\n - S8130735: javax.swing.TimerQueue: timer fires late when\n another timer starts\n\n - S8139436: sun.security.mscapi.KeyStore might load\n incomplete data\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket\n accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory\n regression tests fail after JDK-8138811\n\n - S8147857: [TEST] RMIConnector logs attribute names\n incorrectly\n\n - S8151841, PR3098: Build needs additional flags to\n compile with GCC 6\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8157077: 8u101 L10n resource file updates\n\n - S8161262: Fix jdk build with gcc 4.1.2:\n -fno-strict-overflow not known.\n\n - Import of OpenJDK 7 u111 build 1\n\n - S7081817:\n test/sun/security/provider/certpath/X509CertPath/Illegal\n Certificates.java f ailing\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8145017: Add support for 3 digit hotspot minor version\n numbers\n\n - S8162344: The API changes made by CR 7064075 need to be\n reverted\n\n - Backports\n\n - S2178143, PR2958: JVM crashes if the number of bound\n CPUs changed during runtime\n\n - S4900206, PR3101: Include worst-case rounding tests for\n Math library functions\n\n - S6260348, PR3067: GTK+ L&F JTextComponent not respecting\n desktop caret blink rate\n\n - S6934604, PR3075: enable parts of EliminateAutoBox by\n default\n\n - S7043064, PR3020: sun/java2d/cmm/ tests failed against\n RI b141 & b138-nightly\n\n - S7051394, PR3020: NullPointerException when running\n regression tests LoadProfileTest by using openjdk-7-b144\n\n - S7086015, PR3013: fix\n test/tools/javac/parser/netbeans/JavacParserTest.java\n\n - S7119487, PR3013: JavacParserTest.java test fails on\n Windows platforms\n\n - S7124245, PR3020: [lcms] ColorConvertOp to color space\n CS_GRAY apparently converts orange to 244,244,0\n\n - S7159445, PR3013: (javac) emits inaccurate diagnostics\n for enhanced for-loops\n\n - S7175845, PR1437, RH1207129: 'jar uf' changes file\n permissions unexpectedly\n\n - S8005402, PR3020: Need to provide benchmarks for color\n management\n\n - S8005530, PR3020: [lcms] Improve performance of\n ColorConverOp for default destinations\n\n - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel\n is not transferred from source to destination.\n\n - S8013430, PR3020: REGRESSION:\n closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadPr\n ofileTest.java fail s with\n java.io.StreamCorruptedException: invalid type code: EE\n since 8b87\n\n - S8014286, PR3075: failed java/lang/Math/DivModTests.java\n after 6934604 changes\n\n - S8014959, PR3075:\n assert(Compile::current()->live_nodes()\n (uint)MaxNodeLimit) failed: Live Node limit exceeded\n limit\n\n - S8019247, PR3075: SIGSEGV in compiled method\n c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object\n\n - S8024511, PR3020: Crash during color profile destruction\n\n - S8025429, PR3020: [parfait] warnings from b107 for\n sun.java2d.cmm: JNI exception pending\n\n - S8026702, PR3020: Fix for 8025429 breaks jdk build on\n windows\n\n - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for\n Java_awt test suit\n\n - S8047066, PR3020: Test\n test/sun/awt/image/bug8038000.java fails with\n ClassCastException\n\n - S8069181, PR3012, RH1015612: java.lang.AssertionError\n when compiling JDK 1.4 code in JDK 8\n\n - S8158260, PR2992, RH1341258: PPC64: unaligned\n Unsafe.getInt can lead to the generation of illegal\n instructions (bsc#988651)\n\n - S8159244, PR3075: Partially initialized string object\n created by C2's string concat optimization may escape\n\n - Bug fixes\n\n - PR2799, RH1195203: Files are missing from resources.jar\n\n - PR2900: Don't use WithSeed versions of NSS functions as\n they don't fully process the seed\n\n - PR3091: SystemTap is heavily confused by multiple JDKs\n\n - PR3102: Extend 8022594 to AixPollPort\n\n - PR3103: Handle case in clean-fonts where\n linux.fontconfig.Gentoo.properties.old has not been\n created\n\n - PR3111: Provide option to disable SystemTap tests\n\n - PR3114: Don't assume system mime.types supports\n text/x-java-source\n\n - PR3115: Add check for elliptic curve cryptography\n implementation\n\n - PR3116: Add tests for Java debug info and source files\n\n - PR3118: Path to agpl-3.0.txt not updated\n\n - PR3119: Makefile handles cacerts as a symlink, but the\n configure check doesn't\n\n - AArch64 port\n\n - S8148328, PR3100: aarch64: redundant lsr instructions in\n stub code.\n\n - S8148783, PR3100: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3100: aarch64: generate_copy_longs calls\n align() incorrectly\n\n - S8150045, PR3100: arraycopy causes segfaults in SATB\n during garbage collection\n\n - S8154537, PR3100: AArch64: some integer rotate\n instructions are never emitted\n\n - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess\n loads in wrong mode\n\n - S8157906, PR3100: aarch64: some more integer rotate\n instructions are never emitted\n\n - Enable SunEC for SLE12 and Leap (bsc#982366)\n\n - Fix aarch64 running with 48 bits va space\n (bsc#984684)</clinit>\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=982366\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=984684\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=988651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3458/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3485/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3498/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3500/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3503/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3508/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3511/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3598/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3606/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3610/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161997-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2041c177\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP1:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2016-1186=1\n\nSUSE Linux Enterprise Desktop 12-SP1:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP1-2016-1186=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-demo-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-devel-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-headless-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-headless-1.7.0.111-33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-33.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-26T15:36:04", "description": "An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[Updated 12 September 2016] This advisory has been updated to push packages into the Oracle Java for Red Hat Enterprise Linux 6 Compute Node channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.\n\nOracle Java SE version 8 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.\n\nThis update upgrades Oracle Java SE 8 to version 8 Update 101.\n\nSecurity Fix(es) :\n\n* This update fixes multiple vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit.\nFurther information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2016-3458, CVE-2016-3498, CVE-2016-3500, CVE-2016-3503, CVE-2016-3508, CVE-2016-3511, CVE-2016-3550, CVE-2016-3552, CVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)", "cvss3": {}, "published": "2016-07-22T00:00:00", "type": "nessus", "title": "RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:1475)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3552", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-devel", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-javafx", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-jdbc", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-plugin", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-src", "cpe:/o:redhat:enterprise_linux:6", "cpe:/o:redhat:enterprise_linux:7", "cpe:/o:redhat:enterprise_linux:7.2"], "id": "REDHAT-RHSA-2016-1475.NASL", "href": "https://www.tenable.com/plugins/nessus/92508", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:1475. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(92508);\n script_version(\"2.10\");\n script_cvs_date(\"Date: 2019/10/24 15:35:41\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3552\", \"CVE-2016-3587\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n script_xref(name:\"RHSA\", value:\"2016:1475\");\n\n script_name(english:\"RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:1475)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for java-1.8.0-oracle is now available for Oracle Java for\nRed Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise\nLinux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Critical. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\n[Updated 12 September 2016] This advisory has been updated to push\npackages into the Oracle Java for Red Hat Enterprise Linux 6 Compute\nNode channels. The packages included in this revised update have not\nbeen changed in any way from the packages included in the original\nadvisory.\n\nOracle Java SE version 8 includes the Oracle Java Runtime Environment\nand the Oracle Java Software Development Kit.\n\nThis update upgrades Oracle Java SE 8 to version 8 Update 101.\n\nSecurity Fix(es) :\n\n* This update fixes multiple vulnerabilities in the Oracle Java\nRuntime Environment and the Oracle Java Software Development Kit.\nFurther information about these flaws can be found on the Oracle Java\nSE Critical Patch Update Advisory page, listed in the References\nsection. (CVE-2016-3458, CVE-2016-3498, CVE-2016-3500, CVE-2016-3503,\nCVE-2016-3508, CVE-2016-3511, CVE-2016-3550, CVE-2016-3552,\nCVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610)\"\n );\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?453b5f8c\"\n );\n # http://www.oracle.com/technetwork/java/javase/8u101-relnotes-3021761.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?92867054\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:1475\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3458\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3498\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3500\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3503\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3511\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3550\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3552\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3587\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3598\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3606\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3610\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-javafx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-oracle-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:1475\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.8.0-oracle-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.8.0-oracle-devel-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-devel-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.8.0-oracle-javafx-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-javafx-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.8.0-oracle-jdbc-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-jdbc-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.8.0-oracle-plugin-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-plugin-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.8.0-oracle-src-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-src-1.8.0.101-1jpp.1.el6_8\")) flag++;\n\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-1.8.0.101-1jpp.1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-devel-1.8.0.101-1jpp.1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-javafx-1.8.0.101-1jpp.1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-jdbc-1.8.0.101-1jpp.1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-plugin-1.8.0.101-1jpp.1.el7\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.8.0-oracle-src-1.8.0.101-1jpp.1.el7\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.8.0-oracle / java-1.8.0-oracle-devel / etc\");\n }\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-25T15:02:15", "description": "This update for java-1_7_0-openjdk fixes the following issues :\n\n - Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - Import of OpenJDK 7 u111 build 0\n\n - S6953295: Move few sun.security.(util, x509, pkcs) classes used by keytool/jarsigner to another package\n\n - S7060849: Eliminate pack200 build warnings\n\n - S7064075: Security libraries don't build with javac\n -Xlint:all,-deprecation -Werror\n\n - S7069870: Parts of the JDK erroneously rely on generic array initializers with diamond\n\n - S7102686: Restructure timestamp code so that jars and modules can more easily share the same code\n\n - S7105780: Add SSLSocket client/SSLEngine server to templates directory\n\n - S7142339: PKCS7.java is needlessly creating SHA1PRNG SecureRandom instances when timestamping is not done\n\n - S7152582: PKCS11 tests should use the NSS libraries available in the OS\n\n - S7192202: Make sure keytool prints both unknown and unparseable extensions\n\n - S7194449: String resources for Key Tool and Policy Tool should be in their respective packages\n\n - S7196855: autotest.sh fails on ubuntu because libsoftokn.so not found\n\n - S7200682: TEST_BUG: keytool/autotest.sh still has problems with libsoftokn.so\n\n - S8002306: (se) Selector.open fails if invoked with thread interrupt status set [win]\n\n - S8009636: JARSigner including TimeStamp PolicyID (TSAPolicyID) as defined in RFC3161\n\n - S8019341: Update CookieHttpsClientTest to use the newer framework.\n\n - S8022228: Intermittent test failures in sun/security/ssl/javax/net/ssl/NewAPIs\n\n - S8022439: Fix lint warnings in sun.security.ec\n\n - S8022594: Potential deadlock in <clinit> of sun.nio.ch.Util/IOUtil\n\n - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently\n\n - S8036612: [parfait] JNI exception pending in jdk/src/windows/native/sun/security/mscapi/security.cpp\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying timestamp hash algorithm\n\n - S8079410: Hotspot version to share the same update and build version from JDK\n\n - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts\n\n - S8139436: sun.security.mscapi.KeyStore might load incomplete data\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811\n\n - S8147857: [TEST] RMIConnector logs attribute names incorrectly\n\n - S8151841, PR3098: Build needs additional flags to compile with GCC 6\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8157077: 8u101 L10n resource file updates\n\n - S8161262: Fix jdk build with gcc 4.1.2:\n -fno-strict-overflow not known.\n\n - Import of OpenJDK 7 u111 build 1\n\n - S7081817:\n test/sun/security/provider/certpath/X509CertPath/Illegal Certificates.java failing\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8145017: Add support for 3 digit hotspot minor version numbers\n\n - S8162344: The API changes made by CR 7064075 need to be reverted\n\n - Backports\n\n - S2178143, PR2958: JVM crashes if the number of bound CPUs changed during runtime\n\n - S4900206, PR3101: Include worst-case rounding tests for Math library functions\n\n - S6260348, PR3067: GTK+ L&F JTextComponent not respecting desktop caret blink rate\n\n - S6934604, PR3075: enable parts of EliminateAutoBox by default\n\n - S7043064, PR3020: sun/java2d/cmm/ tests failed against RI b141 & b138-nightly\n\n - S7051394, PR3020: NullPointerException when running regression tests LoadProfileTest by using openjdk-7-b144\n\n - S7086015, PR3013: fix test/tools/javac/parser/netbeans/JavacParserTest.java\n\n - S7119487, PR3013: JavacParserTest.java test fails on Windows platforms\n\n - S7124245, PR3020: [lcms] ColorConvertOp to color space CS_GRAY apparently converts orange to 244,244,0\n\n - S7159445, PR3013: (javac) emits inaccurate diagnostics for enhanced for-loops\n\n - S7175845, PR1437, RH1207129: 'jar uf' changes file permissions unexpectedly\n\n - S8005402, PR3020: Need to provide benchmarks for color management\n\n - S8005530, PR3020: [lcms] Improve performance of ColorConverOp for default destinations\n\n - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel is not transferred from source to destination.\n\n - S8013430, PR3020: REGRESSION:\n closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadPr ofileTest.java fails with java.io.StreamCorruptedException: invalid type code: EE since 8b87\n\n - S8014286, PR3075: failed java/lang/Math/DivModTests.java after 6934604 changes\n\n - S8014959, PR3075:\n assert(Compile::current()->live_nodes() < (uint)MaxNodeLimit) failed: Live Node limit exceeded limit\n\n - S8019247, PR3075: SIGSEGV in compiled method c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object\n\n - S8024511, PR3020: Crash during color profile destruction\n\n - S8025429, PR3020: [parfait] warnings from b107 for sun.java2d.cmm: JNI exception pending\n\n - S8026702, PR3020: Fix for 8025429 breaks jdk build on windows\n\n - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for Java_awt test suit\n\n - S8047066, PR3020: Test test/sun/awt/image/bug8038000.java fails with ClassCastException\n\n - S8069181, PR3012, RH1015612: java.lang.AssertionError when compiling JDK 1.4 code in JDK 8\n\n - S8158260, PR2992, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651)\n\n - S8159244, PR3075: Partially initialized string object created by C2's string concat optimization may escape\n\n - Bug fixes\n\n - PR2799, RH1195203: Files are missing from resources.jar\n\n - PR2900: Don't use WithSeed versions of NSS functions as they don't fully process the seed\n\n - PR3091: SystemTap is heavily confused by multiple JDKs\n\n - PR3102: Extend 8022594 to AixPollPort\n\n - PR3103: Handle case in clean-fonts where linux.fontconfig.Gentoo.properties.old has not been created\n\n - PR3111: Provide option to disable SystemTap tests\n\n - PR3114: Don't assume system mime.types supports text/x-java-source\n\n - PR3115: Add check for elliptic curve cryptography implementation\n\n - PR3116: Add tests for Java debug info and source files\n\n - PR3118: Path to agpl-3.0.txt not updated\n\n - PR3119: Makefile handles cacerts as a symlink, but the configure check doesn't\n\n - AArch64 port\n\n - S8148328, PR3100: aarch64: redundant lsr instructions in stub code.\n\n - S8148783, PR3100: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3100: aarch64: generate_copy_longs calls align() incorrectly\n\n - S8150045, PR3100: arraycopy causes segfaults in SATB during garbage collection\n\n - S8154537, PR3100: AArch64: some integer rotate instructions are never emitted\n\n - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess loads in wrong mode\n\n - S8157906, PR3100: aarch64: some more integer rotate instructions are never emitted\n\n - Enable SunEC for SLE12 and Leap (bsc#982366)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684)\n\nThis update was imported from the SUSE:SLE-12:Update update project.", "cvss3": {}, "published": "2016-08-16T00:00:00", "type": "nessus", "title": "openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-977)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:java-1_7_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2016-977.NASL", "href": "https://www.tenable.com/plugins/nessus/92978", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-977.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92978);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-977)\");\n script_summary(english:\"Check for the openSUSE-2016-977 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for java-1_7_0-openjdk fixes the following issues :\n\n - Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (bsc#989734)\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - Import of OpenJDK 7 u111 build 0\n\n - S6953295: Move few sun.security.(util, x509, pkcs)\n classes used by keytool/jarsigner to another package\n\n - S7060849: Eliminate pack200 build warnings\n\n - S7064075: Security libraries don't build with javac\n -Xlint:all,-deprecation -Werror\n\n - S7069870: Parts of the JDK erroneously rely on generic\n array initializers with diamond\n\n - S7102686: Restructure timestamp code so that jars and\n modules can more easily share the same code\n\n - S7105780: Add SSLSocket client/SSLEngine server to\n templates directory\n\n - S7142339: PKCS7.java is needlessly creating SHA1PRNG\n SecureRandom instances when timestamping is not done\n\n - S7152582: PKCS11 tests should use the NSS libraries\n available in the OS\n\n - S7192202: Make sure keytool prints both unknown and\n unparseable extensions\n\n - S7194449: String resources for Key Tool and Policy Tool\n should be in their respective packages\n\n - S7196855: autotest.sh fails on ubuntu because\n libsoftokn.so not found\n\n - S7200682: TEST_BUG: keytool/autotest.sh still has\n problems with libsoftokn.so\n\n - S8002306: (se) Selector.open fails if invoked with\n thread interrupt status set [win]\n\n - S8009636: JARSigner including TimeStamp PolicyID\n (TSAPolicyID) as defined in RFC3161\n\n - S8019341: Update CookieHttpsClientTest to use the newer\n framework.\n\n - S8022228: Intermittent test failures in\n sun/security/ssl/javax/net/ssl/NewAPIs\n\n - S8022439: Fix lint warnings in sun.security.ec\n\n - S8022594: Potential deadlock in <clinit> of\n sun.nio.ch.Util/IOUtil\n\n - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails\n intermittently\n\n - S8036612: [parfait] JNI exception pending in\n jdk/src/windows/native/sun/security/mscapi/security.cpp\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying\n timestamp hash algorithm\n\n - S8079410: Hotspot version to share the same update and\n build version from JDK\n\n - S8130735: javax.swing.TimerQueue: timer fires late when\n another timer starts\n\n - S8139436: sun.security.mscapi.KeyStore might load\n incomplete data\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket\n accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory\n regression tests fail after JDK-8138811\n\n - S8147857: [TEST] RMIConnector logs attribute names\n incorrectly\n\n - S8151841, PR3098: Build needs additional flags to\n compile with GCC 6\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8157077: 8u101 L10n resource file updates\n\n - S8161262: Fix jdk build with gcc 4.1.2:\n -fno-strict-overflow not known.\n\n - Import of OpenJDK 7 u111 build 1\n\n - S7081817:\n test/sun/security/provider/certpath/X509CertPath/Illegal\n Certificates.java failing\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8145017: Add support for 3 digit hotspot minor version\n numbers\n\n - S8162344: The API changes made by CR 7064075 need to be\n reverted\n\n - Backports\n\n - S2178143, PR2958: JVM crashes if the number of bound\n CPUs changed during runtime\n\n - S4900206, PR3101: Include worst-case rounding tests for\n Math library functions\n\n - S6260348, PR3067: GTK+ L&F JTextComponent not respecting\n desktop caret blink rate\n\n - S6934604, PR3075: enable parts of EliminateAutoBox by\n default\n\n - S7043064, PR3020: sun/java2d/cmm/ tests failed against\n RI b141 & b138-nightly\n\n - S7051394, PR3020: NullPointerException when running\n regression tests LoadProfileTest by using openjdk-7-b144\n\n - S7086015, PR3013: fix\n test/tools/javac/parser/netbeans/JavacParserTest.java\n\n - S7119487, PR3013: JavacParserTest.java test fails on\n Windows platforms\n\n - S7124245, PR3020: [lcms] ColorConvertOp to color space\n CS_GRAY apparently converts orange to 244,244,0\n\n - S7159445, PR3013: (javac) emits inaccurate diagnostics\n for enhanced for-loops\n\n - S7175845, PR1437, RH1207129: 'jar uf' changes file\n permissions unexpectedly\n\n - S8005402, PR3020: Need to provide benchmarks for color\n management\n\n - S8005530, PR3020: [lcms] Improve performance of\n ColorConverOp for default destinations\n\n - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel\n is not transferred from source to destination.\n\n - S8013430, PR3020: REGRESSION:\n closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadPr\n ofileTest.java fails with\n java.io.StreamCorruptedException: invalid type code: EE\n since 8b87\n\n - S8014286, PR3075: failed java/lang/Math/DivModTests.java\n after 6934604 changes\n\n - S8014959, PR3075:\n assert(Compile::current()->live_nodes() <\n (uint)MaxNodeLimit) failed: Live Node limit exceeded\n limit\n\n - S8019247, PR3075: SIGSEGV in compiled method\n c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object\n\n - S8024511, PR3020: Crash during color profile destruction\n\n - S8025429, PR3020: [parfait] warnings from b107 for\n sun.java2d.cmm: JNI exception pending\n\n - S8026702, PR3020: Fix for 8025429 breaks jdk build on\n windows\n\n - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for\n Java_awt test suit\n\n - S8047066, PR3020: Test\n test/sun/awt/image/bug8038000.java fails with\n ClassCastException\n\n - S8069181, PR3012, RH1015612: java.lang.AssertionError\n when compiling JDK 1.4 code in JDK 8\n\n - S8158260, PR2992, RH1341258: PPC64: unaligned\n Unsafe.getInt can lead to the generation of illegal\n instructions (bsc#988651)\n\n - S8159244, PR3075: Partially initialized string object\n created by C2's string concat optimization may escape\n\n - Bug fixes\n\n - PR2799, RH1195203: Files are missing from resources.jar\n\n - PR2900: Don't use WithSeed versions of NSS functions as\n they don't fully process the seed\n\n - PR3091: SystemTap is heavily confused by multiple JDKs\n\n - PR3102: Extend 8022594 to AixPollPort\n\n - PR3103: Handle case in clean-fonts where\n linux.fontconfig.Gentoo.properties.old has not been\n created\n\n - PR3111: Provide option to disable SystemTap tests\n\n - PR3114: Don't assume system mime.types supports\n text/x-java-source\n\n - PR3115: Add check for elliptic curve cryptography\n implementation\n\n - PR3116: Add tests for Java debug info and source files\n\n - PR3118: Path to agpl-3.0.txt not updated\n\n - PR3119: Makefile handles cacerts as a symlink, but the\n configure check doesn't\n\n - AArch64 port\n\n - S8148328, PR3100: aarch64: redundant lsr instructions in\n stub code.\n\n - S8148783, PR3100: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3100: aarch64: generate_copy_longs calls\n align() incorrectly\n\n - S8150045, PR3100: arraycopy causes segfaults in SATB\n during garbage collection\n\n - S8154537, PR3100: AArch64: some integer rotate\n instructions are never emitted\n\n - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess\n loads in wrong mode\n\n - S8157906, PR3100: aarch64: some more integer rotate\n instructions are never emitted\n\n - Enable SunEC for SLE12 and Leap (bsc#982366)\n\n - Fix aarch64 running with 48 bits va space (bsc#984684)\n\nThis update was imported from the SUSE:SLE-12:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982366\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=984684\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1_7_0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-accessibility-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-devel-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-headless-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-demo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-devel-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-headless-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-javadoc-1.7.0.111-34.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-src-1.7.0.111-34.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk-bootstrap / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:21", "description": "The version of MySQL running on the remote host is 5.6.x prior to 5.6.31. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the EVP_EncodeUpdate() function within file crypto/evp/encode.c that is triggered when handling a large amount of input data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2105)\n\n - An unspecified flaw exists in the Security: Encryption subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3459)\n\n - An unspecified flaw exists in the Options subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3471)\n\n - An unspecified flaw exists in the Parser subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3501)\n\n - An unspecified flaw exists in the Types subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3614)\n\n - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Privileges subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Connection subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple overflow conditions exist due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser structure that is triggered during the validation of stored procedure names. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB memcached plugin due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when invoking Enterprise Encryption functions in multiple threads simultaneously or after creating and dropping them. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when handling a 'SELECT ... GROUP BY ... FOR UPDATE' query executed with a loose index scan. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2016-07-11T00:00:00", "type": "nessus", "title": "Oracle MySQL 5.6.x < 5.6.31 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-2105", "CVE-2016-3452", "CVE-2016-3459", "CVE-2016-3471", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3521", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5439", "CVE-2016-5440", "CVE-2016-5444", "CVE-2016-8288"], "modified": "2020-06-03T00:00:00", "cpe": ["cpe:/a:oracle:mysql", "p-cpe:/a:amazon:linux:mysql", "p-cpe:/a:centos:centos:mysql", "p-cpe:/a:fedoraproject:fedora:mysql", "p-cpe:/a:fermilab:scientific_linux:mysql", "p-cpe:/a:novell:opensuse:mysql", "p-cpe:/a:novell:suse_linux:mysql", "p-cpe:/a:oracle:linux:mysql", "p-cpe:/a:redhat:enterprise_linux:mysql"], "id": "MYSQL_5_6_31_RPM.NASL", "href": "https://www.tenable.com/plugins/nessus/91996", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91996);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/03\");\n\n script_cve_id(\n \"CVE-2016-2105\",\n \"CVE-2016-3452\",\n \"CVE-2016-3459\",\n \"CVE-2016-3471\",\n \"CVE-2016-3477\",\n \"CVE-2016-3486\",\n \"CVE-2016-3501\",\n \"CVE-2016-3521\",\n \"CVE-2016-3614\",\n \"CVE-2016-3615\",\n \"CVE-2016-5439\",\n \"CVE-2016-5440\",\n \"CVE-2016-5444\",\n \"CVE-2016-8288\"\n );\n script_bugtraq_id(\n 89757,\n 91902,\n 91913,\n 91932,\n 91943,\n 91949,\n 91953,\n 91960,\n 91969,\n 91980,\n 91987,\n 91992,\n 91999,\n 93740\n );\n\n script_name(english:\"Oracle MySQL 5.6.x < 5.6.31 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of MySQL running on the remote host is 5.6.x prior to\n5.6.31. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the\n EVP_EncodeUpdate() function within file\n crypto/evp/encode.c that is triggered when handling\n a large amount of input data. An unauthenticated, remote\n attacker can exploit this to cause a denial of service\n condition. (CVE-2016-2105)\n\n - An unspecified flaw exists in the Security: Encryption\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - An unspecified flaw exists in the InnoDB subcomponent\n that allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3459)\n\n - An unspecified flaw exists in the Options subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3471)\n\n - An unspecified flaw exists in the Parser subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Optimizer subcomponent\n that allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3501)\n\n - An unspecified flaw exists in the Types subcomponent\n that allows an authenticated, remote attacker to cause\n a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the Security: Encryption\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3614)\n\n - An unspecified flaw exists in the DML subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Privileges\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Connection\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin\n subcomponent that allows an authenticated, remote\n attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple overflow conditions exist due to improper\n validation of user-supplied input. An authenticated,\n remote attacker can exploit these issues to cause a\n denial of service condition or the execution of\n arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser\n structure that is triggered during the validation of\n stored procedure names. An authenticated, remote\n attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB\n memcached plugin due to improper validation of\n user-supplied input. An authenticated, remote attacker\n can exploit these issues to cause a denial of service\n condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when\n invoking Enterprise Encryption functions in multiple\n threads simultaneously or after creating and dropping\n them. An authenticated, remote attacker can exploit this\n to crash the database, resulting in a denial of service\n condition.\n\n - An unspecified flaw exists that is triggered when\n handling a 'SELECT ... GROUP BY ... FOR UPDATE' query\n executed with a loose index scan. An authenticated,\n remote attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead\nrelied only on the application's self-reported version number.\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n # http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bac902d5\");\n script_set_attribute(attribute:\"see_also\", value:\"https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html\");\n # http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3089849.xml\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?42cde00c\");\n # https://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3235388.xml\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453a538d\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.oracle.com/rs?type=doc&id=2157431.1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to MySQL version 5.6.31 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-3471\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/11\");\n\n script_set_attribute(attribute:\"agent\", value:\"unix\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:mysql\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\");\n script_require_ports(\"Host/RedHat/release\", \"Host/AmazonLinux/release\", \"Host/SuSE/release\", \"Host/CentOS/release\");\n\n exit(0);\n}\n\ninclude(\"mysql_version.inc\");\n\nfix_version = \"5.6.31\";\nexists_version = \"5.6\";\n\nmysql_check_rpms(mysql_packages:default_mysql_rpm_list_server_only, fix_ver:fix_version, exists_ver:exists_version, rhel_os_list:default_mysql_rhel_os_list, centos_os_list:default_mysql_centos_os_list, suse_os_list:default_mysql_suse_os_list, ala_os_list:default_mysql_ala_os_list, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:41", "description": "The version of MySQL running on the remote host is 5.6.x prior to 5.6.31. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the EVP_EncodeUpdate() function within file crypto/evp/encode.c that is triggered when handling a large amount of input data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2105)\n\n - An unspecified flaw exists in the Security: Encryption subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3459)\n\n - An unspecified flaw exists in the Options subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3471)\n\n - An unspecified flaw exists in the Parser subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3501)\n\n - An unspecified flaw exists in the Types subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3614)\n\n - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Privileges subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Connection subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple overflow conditions exist due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser structure that is triggered during the validation of stored procedure names. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB memcached plugin due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when invoking Enterprise Encryption functions in multiple threads simultaneously or after creating and dropping them. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\n - An unspecified flaw exists that is triggered when handling a 'SELECT ... GROUP BY ... FOR UPDATE' query executed with a loose index scan. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2016-07-20T00:00:00", "type": "nessus", "title": "MySQL 5.6.x < 5.6.31 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-2105", "CVE-2016-3452", "CVE-2016-3459", "CVE-2016-3471", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3521", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5439", "CVE-2016-5440", "CVE-2016-5444", "CVE-2016-8288"], "modified": "2019-11-14T00:00:00", "cpe": ["cpe:/a:oracle:mysql"], "id": "MYSQL_5_6_31.NASL", "href": "https://www.tenable.com/plugins/nessus/91995", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91995);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2019/11/14\");\n\n script_cve_id(\n \"CVE-2016-2105\",\n \"CVE-2016-3452\",\n \"CVE-2016-3459\",\n \"CVE-2016-3471\",\n \"CVE-2016-3477\",\n \"CVE-2016-3486\",\n \"CVE-2016-3501\",\n \"CVE-2016-3521\",\n \"CVE-2016-3614\",\n \"CVE-2016-3615\",\n \"CVE-2016-5439\",\n \"CVE-2016-5440\",\n \"CVE-2016-5444\",\n \"CVE-2016-8288\"\n );\n script_bugtraq_id(\n 89757,\n 91902,\n 91913,\n 91932,\n 91943,\n 91949,\n 91953,\n 91960,\n 91969,\n 91980,\n 91987,\n 91992,\n 91999,\n 93740\n );\n\n script_name(english:\"MySQL 5.6.x < 5.6.31 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of MySQL server.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of MySQL running on the remote host is 5.6.x prior to\n5.6.31. It is, therefore, affected by multiple vulnerabilities :\n\n - A heap buffer overflow condition exists in the\n EVP_EncodeUpdate() function within file\n crypto/evp/encode.c that is triggered when handling\n a large amount of input data. An unauthenticated, remote\n attacker can exploit this to cause a denial of service\n condition. (CVE-2016-2105)\n\n - An unspecified flaw exists in the Security: Encryption\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-3452)\n\n - An unspecified flaw exists in the InnoDB subcomponent\n that allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3459)\n\n - An unspecified flaw exists in the Options subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3471)\n\n - An unspecified flaw exists in the Parser subcomponent\n that allows a local attacker to gain elevated\n privileges. (CVE-2016-3477)\n\n - An unspecified flaw exists in the FTS subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3486)\n\n - An unspecified flaw exists in the Optimizer subcomponent\n that allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3501)\n\n - An unspecified flaw exists in the Types subcomponent\n that allows an authenticated, remote attacker to cause\n a denial of service condition. (CVE-2016-3521)\n\n - An unspecified flaw exists in the Security: Encryption\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3614)\n\n - An unspecified flaw exists in the DML subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-3615)\n\n - An unspecified flaw exists in the Privileges\n subcomponent that allows an authenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-5439)\n\n - An unspecified flaw exists in the RBR subcomponent that\n allows an authenticated, remote attacker to cause a\n denial of service condition. (CVE-2016-5440)\n\n - An unspecified flaw exists in the Connection\n subcomponent that allows an unauthenticated, remote\n attacker to disclose sensitive information.\n (CVE-2016-5444)\n\n - An unspecified flaw exists in the InnoDB Plugin\n subcomponent that allows an authenticated, remote\n attacker to impact integrity. (CVE-2016-8288)\n\n - Multiple overflow conditions exist due to improper\n validation of user-supplied input. An authenticated,\n remote attacker can exploit these issues to cause a\n denial of service condition or the execution of\n arbitrary code.\n\n - A NULL pointer dereference flaw exists in a parser\n structure that is triggered during the validation of\n stored procedure names. An authenticated, remote\n attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\n - Multiple overflow conditions exist in the InnoDB\n memcached plugin due to improper validation of\n user-supplied input. An authenticated, remote attacker\n can exploit these issues to cause a denial of service\n condition or the execution of arbitrary code.\n\n - An unspecified flaw exists that is triggered when\n invoking Enterprise Encryption functions in multiple\n threads simultaneously or after creating and dropping\n them. An authenticated, remote attacker can exploit this\n to crash the database, resulting in a denial of service\n condition.\n\n - An unspecified flaw exists that is triggered when\n handling a 'SELECT ... GROUP BY ... FOR UPDATE' query\n executed with a loose index scan. An authenticated,\n remote attacker can exploit this to crash the database,\n resulting in a denial of service condition.\n\nNote that Nessus has not tested for these issues but has instead\nrelied only on the application's self-reported version number.\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n # http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bac902d5\");\n script_set_attribute(attribute:\"see_also\", value:\"https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to MySQL version 5.6.31 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-3471\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/20\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:mysql\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mysql_version.nasl\", \"mysql_login.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/mysql\", 3306);\n\n exit(0);\n}\n\ninclude(\"mysql_version.inc\");\n\nmysql_check_version(fixed:'5.6.31', min:'5.6', severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-25T15:02:23", "description": "Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)", "cvss3": {}, "published": "2016-08-17T00:00:00", "type": "nessus", "title": "openSUSE Security Update : OpenJDK7 (openSUSE-2016-982)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:java-1_7_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src", "cpe:/o:novell:opensuse:13.1"], "id": "OPENSUSE-2016-982.NASL", "href": "https://www.tenable.com/plugins/nessus/92992", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-982.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92992);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"openSUSE Security Update : OpenJDK7 (openSUSE-2016-982)\");\n script_summary(english:\"Check for the openSUSE-2016-982 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (bsc#989734)\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected OpenJDK7 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-accessibility-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-demo-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-devel-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-headless-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-javadoc-1.7.0.111-24.39.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"java-1_7_0-openjdk-src-1.7.0.111-24.39.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk / java-1_7_0-openjdk-accessibility / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-25T15:01:24", "description": "This update for java-1_7_0-openjdk fixes the following issues :\n\n - Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734)\n\n - S8147771: Construction of static protection domains under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - Import of OpenJDK 7 u111 build 0\n\n - S6953295: Move few sun.security.(util, x509, pkcs) classes used by keytool/jarsigner to another package\n\n - S7060849: Eliminate pack200 build warnings\n\n - S7064075: Security libraries don't build with javac\n -Xlint:all,-deprecation -Werror\n\n - S7069870: Parts of the JDK erroneously rely on generic array initializers with diamond\n\n - S7102686: Restructure timestamp code so that jars and modules can more easily share the same code\n\n - S7105780: Add SSLSocket client/SSLEngine server to templates directory\n\n - S7142339: PKCS7.java is needlessly creating SHA1PRNG SecureRandom instances when timestamping is not done\n\n - S7152582: PKCS11 tests should use the NSS libraries available in the OS\n\n - S7192202: Make sure keytool prints both unknown and unparseable extensions\n\n - S7194449: String resources for Key Tool and Policy Tool should be in their respective packages\n\n - S7196855: autotest.sh fails on ubuntu because libsoftokn.so not found\n\n - S7200682: TEST_BUG: keytool/autotest.sh still has problems with libsoftokn.so\n\n - S8002306: (se) Selector.open fails if invoked with thread interrupt status set [win]\n\n - S8009636: JARSigner including TimeStamp PolicyID (TSAPolicyID) as defined in RFC3161\n\n - S8019341: Update CookieHttpsClientTest to use the newer framework.\n\n - S8022228: Intermittent test failures in sun/security/ssl/javax/net/ssl/NewAPIs\n\n - S8022439: Fix lint warnings in sun.security.ec\n\n - S8022594: Potential deadlock in <clinit> of sun.nio.ch.Util/IOUtil\n\n - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently\n\n - S8036612: [parfait] JNI exception pending in jdk/src/windows/native/sun/security/mscapi/security.cpp\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying timestamp hash algorithm\n\n - S8079410: Hotspot version to share the same update and build version from JDK\n\n - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts\n\n - S8139436: sun.security.mscapi.KeyStore might load incomplete data\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811\n\n - S8147857: [TEST] RMIConnector logs attribute names incorrectly\n\n - S8151841, PR3098: Build needs additional flags to compile with GCC 6\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8157077: 8u101 L10n resource file updates\n\n - S8161262: Fix jdk build with gcc 4.1.2:\n -fno-strict-overflow not known.\n\n - Import of OpenJDK 7 u111 build 1\n\n - S7081817:\n test/sun/security/provider/certpath/X509CertPath/Illegal Certificates.java failing\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8145017: Add support for 3 digit hotspot minor version numbers\n\n - S8162344: The API changes made by CR 7064075 need to be reverted\n\n - Backports\n\n - S2178143, PR2958: JVM crashes if the number of bound CPUs changed during runtime\n\n - S4900206, PR3101: Include worst-case rounding tests for Math library functions\n\n - S6260348, PR3067: GTK+ L&F JTextComponent not respecting desktop caret blink rate\n\n - S6934604, PR3075: enable parts of EliminateAutoBox by default\n\n - S7043064, PR3020: sun/java2d/cmm/ tests failed against RI b141 & b138-nightly\n\n - S7051394, PR3020: NullPointerException when running regression tests LoadProfileTest by using openjdk-7-b144\n\n - S7086015, PR3013: fix test/tools/javac/parser/netbeans/JavacParserTest.java\n\n - S7119487, PR3013: JavacParserTest.java test fails on Windows platforms\n\n - S7124245, PR3020: [lcms] ColorConvertOp to color space CS_GRAY apparently converts orange to 244,244,0\n\n - S7159445, PR3013: (javac) emits inaccurate diagnostics for enhanced for-loops\n\n - S7175845, PR1437, RH1207129: 'jar uf' changes file permissions unexpectedly\n\n - S8005402, PR3020: Need to provide benchmarks for color management\n\n - S8005530, PR3020: [lcms] Improve performance of ColorConverOp for default destinations\n\n - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel is not transferred from source to destination.\n\n - S8013430, PR3020: REGRESSION:\n closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadPr ofileTest.java fails with java.io.StreamCorruptedException: invalid type code: EE since 8b87\n\n - S8014286, PR3075: failed java/lang/Math/DivModTests.java after 6934604 changes\n\n - S8014959, PR3075:\n assert(Compile::current()->live_nodes() < (uint)MaxNodeLimit) failed: Live Node limit exceeded limit\n\n - S8019247, PR3075: SIGSEGV in compiled method c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object\n\n - S8024511, PR3020: Crash during color profile destruction\n\n - S8025429, PR3020: [parfait] warnings from b107 for sun.java2d.cmm: JNI exception pending\n\n - S8026702, PR3020: Fix for 8025429 breaks jdk build on windows\n\n - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for Java_awt test suit\n\n - S8047066, PR3020: Test test/sun/awt/image/bug8038000.java fails with ClassCastException\n\n - S8069181, PR3012, RH1015612: java.lang.AssertionError when compiling JDK 1.4 code in JDK 8\n\n - S8158260, PR2992, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651)\n\n - S8159244, PR3075: Partially initialized string object created by C2's string concat optimization may escape\n\n - Bug fixes\n\n - PR2799, RH1195203: Files are missing from resources.jar\n\n - PR2900: Don't use WithSeed versions of NSS functions as they don't fully process the seed\n\n - PR3091: SystemTap is heavily confused by multiple JDKs\n\n - PR3102: Extend 8022594 to AixPollPort\n\n - PR3103: Handle case in clean-fonts where linux.fontconfig.Gentoo.properties.old has not been created\n\n - PR3111: Provide option to disable SystemTap tests\n\n - PR3114: Don't assume system mime.types supports text/x-java-source\n\n - PR3115: Add check for elliptic curve cryptography implementation\n\n - PR3116: Add tests for Java debug info and source files\n\n - PR3118: Path to agpl-3.0.txt not updated\n\n - PR3119: Makefile handles cacerts as a symlink, but the configure check doesn't\n\n - AArch64 port\n\n - S8148328, PR3100: aarch64: redundant lsr instructions in stub code.\n\n - S8148783, PR3100: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3100: aarch64: generate_copy_longs calls align() incorrectly\n\n - S8150045, PR3100: arraycopy causes segfaults in SATB during garbage collection\n\n - S8154537, PR3100: AArch64: some integer rotate instructions are never emitted\n\n - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess loads in wrong mode\n\n - S8157906, PR3100: aarch64: some more integer rotate instructions are never emitted", "cvss3": {}, "published": "2016-08-12T00:00:00", "type": "nessus", "title": "openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-976)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3485", "CVE-2016-3498", "CVE-2016-3500", "CVE-2016-3503", "CVE-2016-3508", "CVE-2016-3511", "CVE-2016-3550", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:java-1_7_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2016-976.NASL", "href": "https://www.tenable.com/plugins/nessus/92932", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-976.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92932);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-3458\", \"CVE-2016-3485\", \"CVE-2016-3498\", \"CVE-2016-3500\", \"CVE-2016-3503\", \"CVE-2016-3508\", \"CVE-2016-3511\", \"CVE-2016-3550\", \"CVE-2016-3598\", \"CVE-2016-3606\", \"CVE-2016-3610\");\n\n script_name(english:\"openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-976)\");\n script_summary(english:\"Check for the openSUSE-2016-976 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for java-1_7_0-openjdk fixes the following issues :\n\n - Update to 2.6.7 - OpenJDK 7u111\n\n - Security fixes\n\n - S8079718, CVE-2016-3458: IIOP Input Stream Hooking\n (bsc#989732)\n\n - S8145446, CVE-2016-3485: Perfect pipe placement (Windows\n only) (bsc#989734)\n\n - S8147771: Construction of static protection domains\n under Javax custom policy\n\n - S8148872, CVE-2016-3500: Complete name checking\n (bsc#989730)\n\n - S8149962, CVE-2016-3508: Better delineation of XML\n processing (bsc#989731)\n\n - S8150752: Share Class Data\n\n - S8151925: Font reference improvements\n\n - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733)\n\n - S8155981, CVE-2016-3606: Bolster bytecode verification\n (bsc#989722)\n\n - S8155985, CVE-2016-3598: Persistent Parameter Processing\n (bsc#989723)\n\n - S8158571, CVE-2016-3610: Additional method handle\n validation (bsc#989725)\n\n - CVE-2016-3511 (bsc#989727)\n\n - CVE-2016-3503 (bsc#989728)\n\n - CVE-2016-3498 (bsc#989729)\n\n - Import of OpenJDK 7 u111 build 0\n\n - S6953295: Move few sun.security.(util, x509, pkcs)\n classes used by keytool/jarsigner to another package\n\n - S7060849: Eliminate pack200 build warnings\n\n - S7064075: Security libraries don't build with javac\n -Xlint:all,-deprecation -Werror\n\n - S7069870: Parts of the JDK erroneously rely on generic\n array initializers with diamond\n\n - S7102686: Restructure timestamp code so that jars and\n modules can more easily share the same code\n\n - S7105780: Add SSLSocket client/SSLEngine server to\n templates directory\n\n - S7142339: PKCS7.java is needlessly creating SHA1PRNG\n SecureRandom instances when timestamping is not done\n\n - S7152582: PKCS11 tests should use the NSS libraries\n available in the OS\n\n - S7192202: Make sure keytool prints both unknown and\n unparseable extensions\n\n - S7194449: String resources for Key Tool and Policy Tool\n should be in their respective packages\n\n - S7196855: autotest.sh fails on ubuntu because\n libsoftokn.so not found\n\n - S7200682: TEST_BUG: keytool/autotest.sh still has\n problems with libsoftokn.so\n\n - S8002306: (se) Selector.open fails if invoked with\n thread interrupt status set [win]\n\n - S8009636: JARSigner including TimeStamp PolicyID\n (TSAPolicyID) as defined in RFC3161\n\n - S8019341: Update CookieHttpsClientTest to use the newer\n framework.\n\n - S8022228: Intermittent test failures in\n sun/security/ssl/javax/net/ssl/NewAPIs\n\n - S8022439: Fix lint warnings in sun.security.ec\n\n - S8022594: Potential deadlock in <clinit> of\n sun.nio.ch.Util/IOUtil\n\n - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails\n intermittently\n\n - S8036612: [parfait] JNI exception pending in\n jdk/src/windows/native/sun/security/mscapi/security.cpp\n\n - S8037557: test SessionCacheSizeTests.java timeout\n\n - S8038837: Add support to jarsigner for specifying\n timestamp hash algorithm\n\n - S8079410: Hotspot version to share the same update and\n build version from JDK\n\n - S8130735: javax.swing.TimerQueue: timer fires late when\n another timer starts\n\n - S8139436: sun.security.mscapi.KeyStore might load\n incomplete data\n\n - S8144313: Test SessionTimeOutTests can be timeout\n\n - S8146387: Test SSLSession/SessionCacheSizeTests socket\n accept timed out\n\n - S8146669: Test SessionTimeOutTests fails intermittently\n\n - S8146993: Several javax/management/remote/mandatory\n regression tests fail after JDK-8138811\n\n - S8147857: [TEST] RMIConnector logs attribute names\n incorrectly\n\n - S8151841, PR3098: Build needs additional flags to\n compile with GCC 6\n\n - S8151876: (tz) Support tzdata2016d\n\n - S8157077: 8u101 L10n resource file updates\n\n - S8161262: Fix jdk build with gcc 4.1.2:\n -fno-strict-overflow not known.\n\n - Import of OpenJDK 7 u111 build 1\n\n - S7081817:\n test/sun/security/provider/certpath/X509CertPath/Illegal\n Certificates.java failing\n\n - S8140344: add support for 3 digit update release numbers\n\n - S8145017: Add support for 3 digit hotspot minor version\n numbers\n\n - S8162344: The API changes made by CR 7064075 need to be\n reverted\n\n - Backports\n\n - S2178143, PR2958: JVM crashes if the number of bound\n CPUs changed during runtime\n\n - S4900206, PR3101: Include worst-case rounding tests for\n Math library functions\n\n - S6260348, PR3067: GTK+ L&F JTextComponent not respecting\n desktop caret blink rate\n\n - S6934604, PR3075: enable parts of EliminateAutoBox by\n default\n\n - S7043064, PR3020: sun/java2d/cmm/ tests failed against\n RI b141 & b138-nightly\n\n - S7051394, PR3020: NullPointerException when running\n regression tests LoadProfileTest by using openjdk-7-b144\n\n - S7086015, PR3013: fix\n test/tools/javac/parser/netbeans/JavacParserTest.java\n\n - S7119487, PR3013: JavacParserTest.java test fails on\n Windows platforms\n\n - S7124245, PR3020: [lcms] ColorConvertOp to color space\n CS_GRAY apparently converts orange to 244,244,0\n\n - S7159445, PR3013: (javac) emits inaccurate diagnostics\n for enhanced for-loops\n\n - S7175845, PR1437, RH1207129: 'jar uf' changes file\n permissions unexpectedly\n\n - S8005402, PR3020: Need to provide benchmarks for color\n management\n\n - S8005530, PR3020: [lcms] Improve performance of\n ColorConverOp for default destinations\n\n - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel\n is not transferred from source to destination.\n\n - S8013430, PR3020: REGRESSION:\n closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadPr\n ofileTest.java fails with\n java.io.StreamCorruptedException: invalid type code: EE\n since 8b87\n\n - S8014286, PR3075: failed java/lang/Math/DivModTests.java\n after 6934604 changes\n\n - S8014959, PR3075:\n assert(Compile::current()->live_nodes() <\n (uint)MaxNodeLimit) failed: Live Node limit exceeded\n limit\n\n - S8019247, PR3075: SIGSEGV in compiled method\n c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object\n\n - S8024511, PR3020: Crash during color profile destruction\n\n - S8025429, PR3020: [parfait] warnings from b107 for\n sun.java2d.cmm: JNI exception pending\n\n - S8026702, PR3020: Fix for 8025429 breaks jdk build on\n windows\n\n - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for\n Java_awt test suit\n\n - S8047066, PR3020: Test\n test/sun/awt/image/bug8038000.java fails with\n ClassCastException\n\n - S8069181, PR3012, RH1015612: java.lang.AssertionError\n when compiling JDK 1.4 code in JDK 8\n\n - S8158260, PR2992, RH1341258: PPC64: unaligned\n Unsafe.getInt can lead to the generation of illegal\n instructions (bsc#988651)\n\n - S8159244, PR3075: Partially initialized string object\n created by C2's string concat optimization may escape\n\n - Bug fixes\n\n - PR2799, RH1195203: Files are missing from resources.jar\n\n - PR2900: Don't use WithSeed versions of NSS functions as\n they don't fully process the seed\n\n - PR3091: SystemTap is heavily confused by multiple JDKs\n\n - PR3102: Extend 8022594 to AixPollPort\n\n - PR3103: Handle case in clean-fonts where\n linux.fontconfig.Gentoo.properties.old has not been\n created\n\n - PR3111: Provide option to disable SystemTap tests\n\n - PR3114: Don't assume system mime.types supports\n text/x-java-source\n\n - PR3115: Add check for elliptic curve cryptography\n implementation\n\n - PR3116: Add tests for Java debug info and source files\n\n - PR3118: Path to agpl-3.0.txt not updated\n\n - PR3119: Makefile handles cacerts as a symlink, but the\n configure check doesn't\n\n - AArch64 port\n\n - S8148328, PR3100: aarch64: redundant lsr instructions in\n stub code.\n\n - S8148783, PR3100: aarch64: SEGV running SpecJBB2013\n\n - S8148948, PR3100: aarch64: generate_copy_longs calls\n align() incorrectly\n\n - S8150045, PR3100: arraycopy causes segfaults in SATB\n during garbage collection\n\n - S8154537, PR3100: AArch64: some integer rotate\n instructions are never emitted\n\n - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess\n loads in wrong mode\n\n - S8157906, PR3100: aarch64: some more integer rotate\n instructions are never emitted\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989727\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989730\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989734\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1_7_0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-accessibility-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-devel-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-headless-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-demo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-devel-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-headless-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-javadoc-1.7.0.111-25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"java-1_7_0-openjdk-src-1.7.0.111-25.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk-bootstrap / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:27:25", "description": "The remote Microsoft Exchange Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :\n\n - Multiple remote code execution vulnerabilities exist in the Oracle Outside In libraries. An unauthenticated, remote attacker can exploit these, via a specially crafted email, to execute arbitrary code.\n (CVE-2015-6014, CVE-2016-3575, CVE-2016-3581, CVE-2016-3582, CVE-2016-3583, CVE-2016-3591, CVE-2016-3592, CVE-2016-3593, CVE-2016-3594, CVE-2016-3595, CVE-2016-3596)\n\n - An unspecified information disclosure vulnerability exists in the Oracle Outside In libraries that allows an attacker to disclose sensitive information.\n (CVE-2016-3574)\n\n - Multiple denial of service vulnerabilities exists in the Oracle Outside In libraries. (CVE-2016-3576, CVE-2016-3577, CVE-2016-3578, CVE-2016-3579, CVE-2016-3580, CVE-2016-3590)\n\n - An information disclosure vulnerability exists due to improper parsing of certain unstructured file formats.\n An unauthenticated, remote attacker can exploit this, via a crafted email using 'send as' rights, to disclose confidential user information. (CVE-2016-0138)\n\n - An open redirect vulnerability exists due to improper handling of open redirect requests. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to redirect the user to a malicious website that spoofs a legitimate one.\n (CVE-2016-3378)\n\n - An elevation of privilege vulnerability exists due to improper handling of meeting invitation requests. An unauthenticated, remote attacker can exploit this, via a specially crafted Outlook meeting invitation request, to gain elevated privileges. (CVE-2016-3379)", "cvss3": {}, "published": "2016-09-13T00:00:00", "type": "nessus", "title": "MS16-108: Security Update for Microsoft Exchange Server (3185883)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-6014", "CVE-2016-0138", "CVE-2016-3378", "CVE-2016-3379", "CVE-2016-3574", "CVE-2016-3575", "CVE-2016-3576", "CVE-2016-3577", "CVE-2016-3578", "CVE-2016-3579", "CVE-2016-3580", "CVE-2016-3581", "CVE-2016-3582", "CVE-2016-3583", "CVE-2016-3590", "CVE-2016-3591", "CVE-2016-3592", "CVE-2016-3593", "CVE-2016-3594", "CVE-2016-3595", "CVE-2016-3596"], "modified": "2021-04-20T00:00:00", "cpe": ["cpe:/a:microsoft:exchange_server"], "id": "SMB_NT_MS16-108.NASL", "href": "https://www.tenable.com/plugins/nessus/93467", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93467);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/04/20\");\n\n script_cve_id(\n \"CVE-2015-6014\",\n \"CVE-2016-0138\",\n \"CVE-2016-3378\",\n \"CVE-2016-3379\",\n \"CVE-2016-3574\",\n \"CVE-2016-3575\",\n \"CVE-2016-3576\",\n \"CVE-2016-3577\",\n \"CVE-2016-3578\",\n \"CVE-2016-3579\",\n \"CVE-2016-3580\",\n \"CVE-2016-3581\",\n \"CVE-2016-3582\",\n \"CVE-2016-3583\",\n \"CVE-2016-3590\",\n \"CVE-2016-3591\",\n \"CVE-2016-3592\",\n \"CVE-2016-3593\",\n \"CVE-2016-3594\",\n \"CVE-2016-3595\",\n \"CVE-2016-3596\"\n );\n script_bugtraq_id(\n 81233,\n 91908,\n 91914,\n 91921,\n 91923,\n 91924,\n 91925,\n 91927,\n 91929,\n 91931,\n 91933,\n 91934,\n 91935,\n 91936,\n 91937,\n 91939,\n 91940,\n 91942,\n 92806,\n 92833,\n 92836\n );\n script_xref(name:\"MSFT\", value:\"MS16-108\");\n script_xref(name:\"MSKB\", value:\"3184711\");\n script_xref(name:\"MSKB\", value:\"3184728\");\n script_xref(name:\"MSKB\", value:\"3184736\");\n\n script_name(english:\"MS16-108: Security Update for Microsoft Exchange Server (3185883)\");\n script_summary(english:\"Checks the version of ExSetup.exe.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Microsoft Exchange Server is affected by multiple\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Microsoft Exchange Server is missing a security update. It\nis, therefore, affected by multiple vulnerabilities :\n\n - Multiple remote code execution vulnerabilities exist in\n the Oracle Outside In libraries. An unauthenticated,\n remote attacker can exploit these, via a specially\n crafted email, to execute arbitrary code.\n (CVE-2015-6014, CVE-2016-3575, CVE-2016-3581,\n CVE-2016-3582, CVE-2016-3583, CVE-2016-3591,\n CVE-2016-3592, CVE-2016-3593, CVE-2016-3594,\n CVE-2016-3595, CVE-2016-3596)\n\n - An unspecified information disclosure vulnerability\n exists in the Oracle Outside In libraries that allows an\n attacker to disclose sensitive information.\n (CVE-2016-3574)\n\n - Multiple denial of service vulnerabilities exists in the\n Oracle Outside In libraries. (CVE-2016-3576,\n CVE-2016-3577, CVE-2016-3578, CVE-2016-3579,\n CVE-2016-3580, CVE-2016-3590)\n\n - An information disclosure vulnerability exists due to\n improper parsing of certain unstructured file formats.\n An unauthenticated, remote attacker can exploit this,\n via a crafted email using 'send as' rights, to disclose\n confidential user information. (CVE-2016-0138)\n\n - An open redirect vulnerability exists due to improper\n handling of open redirect requests. An unauthenticated,\n remote attacker can exploit this, by convincing a user\n to click a specially crafted URL, to redirect the user\n to a malicious website that spoofs a legitimate one.\n (CVE-2016-3378)\n\n - An elevation of privilege vulnerability exists due to\n improper handling of meeting invitation requests. An\n unauthenticated, remote attacker can exploit this, via a\n specially crafted Outlook meeting invitation request,\n to gain elevated privileges. (CVE-2016-3379)\");\n # https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2016/ms16-108\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9e520324\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released a set of patches for Exchange Server 2007,\n2010, 2013, and 2016.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-6014\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/07/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:exchange_server\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ms_bulletin_checks_possible.nasl\", \"microsoft_exchange_installed.nbin\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"install_func.inc\");\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nexit_if_productname_not_server();\n\nbulletin = 'MS16-108';\nkbs = make_list(\"3184711\", \"3184728\", \"3184736\");\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\ninstall = get_single_install(app_name:\"Microsoft Exchange\");\n\npath = install[\"path\"];\nversion = install[\"version\"];\nrelease = install[\"RELEASE\"];\nif (release != 80 && release != 140 && release != 150 && release != 151)\n audit(AUDIT_INST_VER_NOT_VULN, 'Exchange', version);\n\nif (!empty_or_null(install[\"SP\"]))\n sp = install[\"SP\"];\nif (!empty_or_null(install[\"CU\"]))\n cu = install[\"CU\"];\n\nif (((release == 150 || release == 151) && isnull(cu)) ||\n (release == 150 && cu != 4 && cu != 12 && cu != 13) ||\n (release == 151 && cu != 1 && cu != 2))\n audit(AUDIT_INST_VER_NOT_VULN, 'Exchange', version);\n\nif (release == 80)\n{\n kb = \"3184711\";\n if (!empty_or_null(sp) && sp == 3)\n fixedver = \"8.3.485.1\";\n}\nelse if (release == 140)\n{\n kb = \"3184728\";\n if (!empty_or_null(sp) && sp == 3)\n fixedver = \"14.3.319.2\";\n}\nelse if (release == 150) # 2013 SP1 AKA CU4\n{\n kb = \"3184736\";\n if (cu == 4)\n fixedver = \"15.0.847.50\";\n else if (cu == 12)\n fixedver = \"15.0.1178.9\";\n else if (cu == 13)\n fixedver = \"15.0.1210.6\";\n}\nelse if (release == 151) # Exchange Server 2016\n{\n kb = \"3184736\";\n if (cu == 1)\n fixedver = \"15.1.396.37\";\n else if (cu == 2)\n fixedver = \"15.1.466.37\";\n}\n\nif (fixedver && hotfix_is_vulnerable(path:hotfix_append_path(path:path, value:\"Bin\"), file:\"ExSetup.exe\", version:fixedver, bulletin:bulletin, kb:kb))\n{\n set_kb_item(name:'SMB/Missing/' + bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:17", "description": "The remote Oracle Database Server is missing the July 2016 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists in the RDBMS HTTPS Listener package due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0204)\n\n - An unspecified vulnerability exists in the Application Express component that allows an unauthenticated, remote attacker to impact confidentiality and integrity.\n (CVE-2016-3448)\n\n - An unspecified vulnerability exists in the Application Express component that allows an unauthenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3467)\n\n - An unspecified vulnerability exists in the Portable Clusterware component that allows an unauthenticated, remote attacker to cause a denial of service condition.\n (CVE-2016-3479)\n\n - An unspecified vulnerability exists in the Database Vault component that allows a local attacker to impact confidentiality and integrity. (CVE-2016-3484)\n\n - An unspecified vulnerability exists in the DB Sharding component that allows a local attacker to impact integrity. (CVE-2016-3488)\n\n - An unspecified vulnerability exists in the Data Pump Import component that allows a local attacker to to gain elevated privileges. (CVE-2016-3489)\n\n - An unspecified vulnerability exists in the JDBC component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-3506)\n\n - An unspecified vulnerability exists in the OJVM component that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2016-3609)", "cvss3": {}, "published": "2016-07-22T00:00:00", "type": "nessus", "title": "Oracle Database Multiple Vulnerabilities (July 2016 CPU) (FREAK)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-0204", "CVE-2016-3448", "CVE-2016-3467", "CVE-2016-3479", "CVE-2016-3484", "CVE-2016-3488", "CVE-2016-3489", "CVE-2016-3506", "CVE-2016-3609"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:oracle:database_server"], "id": "ORACLE_RDBMS_CPU_JUL_2016.NASL", "href": "https://www.tenable.com/plugins/nessus/92522", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92522);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2015-0204\",\n \"CVE-2016-3448\",\n \"CVE-2016-3467\",\n \"CVE-2016-3479\",\n \"CVE-2016-3484\",\n \"CVE-2016-3488\",\n \"CVE-2016-3489\",\n \"CVE-2016-3506\",\n \"CVE-2016-3609\"\n );\n script_bugtraq_id(\n 71936,\n 91842,\n 91867,\n 91874,\n 91885,\n 91890,\n 91894,\n 91898,\n 91905\n );\n script_xref(name:\"CERT\", value:\"243585\");\n\n script_name(english:\"Oracle Database Multiple Vulnerabilities (July 2016 CPU) (FREAK)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Database Server is missing the July 2016 Critical\nPatch Update (CPU). It is, therefore, affected by multiple\nvulnerabilities :\n\n - A security feature bypass vulnerability, known as FREAK\n (Factoring attack on RSA-EXPORT Keys), exists in the\n RDBMS HTTPS Listener package due to the support of weak\n EXPORT_RSA cipher suites with keys less than or equal to\n 512 bits. A man-in-the-middle attacker may be able to\n downgrade the SSL/TLS connection to use EXPORT_RSA\n cipher suites which can be factored in a short amount of\n time, allowing the attacker to intercept and decrypt the\n traffic. (CVE-2015-0204)\n\n - An unspecified vulnerability exists in the Application\n Express component that allows an unauthenticated, remote\n attacker to impact confidentiality and integrity.\n (CVE-2016-3448)\n\n - An unspecified vulnerability exists in the Application\n Express component that allows an unauthenticated, remote\n attacker to cause a denial of service condition.\n (CVE-2016-3467)\n\n - An unspecified vulnerability exists in the Portable\n Clusterware component that allows an unauthenticated,\n remote attacker to cause a denial of service condition.\n (CVE-2016-3479)\n\n - An unspecified vulnerability exists in the Database\n Vault component that allows a local attacker to impact\n confidentiality and integrity. (CVE-2016-3484)\n\n - An unspecified vulnerability exists in the DB Sharding\n component that allows a local attacker to impact\n integrity. (CVE-2016-3488)\n\n - An unspecified vulnerability exists in the Data Pump\n Import component that allows a local attacker to to gain\n elevated privileges. (CVE-2016-3489)\n\n - An unspecified vulnerability exists in the JDBC\n component that allows an unauthenticated, remote\n attacker to execute arbitrary code. (CVE-2016-3506)\n\n - An unspecified vulnerability exists in the OJVM\n component that allows an authenticated, remote attacker\n to execute arbitrary code. (CVE-2016-3609)\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.smacktls.com/#freak\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the appropriate patch according to the July 2016 Oracle\nCritical Patch Update advisory.\");\n script_set_attribute(attribute:\"agent\", value:\"all\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/01/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:database_server\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"oracle_rdbms_query_patch_info.nbin\", \"oracle_rdbms_patch_info.nbin\");\n\n exit(0);\n}\n\ninclude(\"oracle_rdbms_cpu_func.inc\");\n\n################################################################################\n# JUL2016\npatches = make_nested_array();\n\n# RDBMS 12.1.0.2\npatches[\"12.1.0.2\"][\"db\"][\"nix\"] = make_array(\"patch_level\", \"12.1.0.2.160719\", \"CPU\", \"23054246, 23144544\");\npatches[\"12.1.0.2\"][\"db\"][\"win\"] = make_array(\"patch_level\", \"12.1.0.2.160719\", \"CPU\", \"23530387\");\n# RDBMS 12.1.0.1 #\npatches[\"12.1.0.1\"][\"db\"][\"nix\"] = make_array(\"patch_level\", \"12.1.0.1.160719\", \"CPU\", \"23054354\");\npatches[\"12.1.0.1\"][\"db\"][\"win\"] = make_array(\"patch_level\", \"12.1.0.1.160719\", \"CPU\", \"23530410\");\n# RDBMS 11.2.0.4 #\npatches[\"11.2.0.4\"][\"db\"][\"nix\"] = make_array(\"patch_level\", \"11.2.0.4.160719\", \"CPU\", \"23177648, 23054359\");\npatches[\"11.2.0.4\"][\"db\"][\"win\"] = make_array(\"patch_level\", \"11.2.0.4.160719\", \"CPU\", \"23530402\");\n\n# JVM 12.1.0.2\npatches[\"12.1.0.2\"][\"ojvm\"][\"nix\"] = make_array(\"patch_level\", \"12.1.0.2.160719\", \"CPU\", \"23177536\");\npatches[\"12.1.0.2\"][\"ojvm\"][\"win\"] = make_array(\"patch_level\", \"12.1.0.2.160719\", \"CPU\", \"23515290\");\n# JVM 12.1.0.1\npatches[\"12.1.0.1\"][\"ojvm\"][\"nix\"] = make_array(\"patch_level\", \"12.1.0.1.160719\", \"CPU\", \"23177541\");\npatches[\"12.1.0.1\"][\"ojvm\"][\"win\"] = make_array(\"patch_level\", \"12.1.0.1.160719\", \"CPU\", \"23515285\");\n# JVM 11.2.0.4\npatches[\"11.2.0.4\"][\"ojvm\"][\"nix\"] = make_array(\"patch_level\", \"11.2.0.4.160719\", \"CPU\", \"23177551\");\npatches[\"11.2.0.4\"][\"ojvm\"][\"win\"] = make_array(\"patch_level\", \"11.2.0.4.160719\", \"CPU\", \"23515277\");\n\ncheck_oracle_database(patches:patches, high_risk:TRUE);\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:26:24", "description": "Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote administrators to affect availability via vectors related to Server: RBR. (CVE-2016-5440)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB. (CVE-2016-3459)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote administrators to affect availability via vectors related to Server: Privileges. (CVE-2016-5439)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. (CVE-2016-3477)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote authenticated users to affect availability via vectors related to Server: Security: Encryption. (CVE-2016-3614)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote authenticated users to affect availability via vectors related to Server: DML. (CVE-2016-3615)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. (CVE-2016-3521)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote authenticated users to affect availability via vectors related to Server: FTS. (CVE-2016-3486)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer. (CVE-2016-3501)", "cvss3": {}, "published": "2016-08-18T00:00:00", "type": "nessus", "title": "Amazon Linux AMI : mysql56 (ALAS-2016-737)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3459", "CVE-2016-3477", "CVE-2016-3486", "CVE-2016-3501", "CVE-2016-3521", "CVE-2016-3614", "CVE-2016-3615", "CVE-2016-5439", "CVE-2016-5440"], "modified": "2018-04-18T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:mysql56", "p-cpe:/a:amazon:linux:mysql56-bench", "p-cpe:/a:amazon:linux:mysql56-common", "p-cpe:/a:amazon:linux:mysql56-debuginfo", "p-cpe:/a:amazon:linux:mysql56-devel", "p-cpe:/a:amazon:linux:mysql56-embedded", "p-cpe:/a:amazon:linux:mysql56-embedded-devel", "p-cpe:/a:amazon:linux:mysql56-errmsg", "p-cpe:/a:amazon:linux:mysql56-libs", "p-cpe:/a:amazon:linux:mysql56-server", "p-cpe:/a:amazon:linux:mysql56-test", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2016-737.NASL", "href": "https://www.tenable.com/plugins/nessus/93015", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2016-737.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93015);\n script_version(\"2.4\");\n script_cvs_date(\"Date: 2018/04/18 15:09:36\");\n\n script_cve_id(\"CVE-2016-3459\", \"CVE-2016-3477\", \"CVE-2016-3486\", \"CVE-2016-3501\", \"CVE-2016-3521\", \"CVE-2016-3614\", \"CVE-2016-3615\", \"CVE-2016-5439\", \"CVE-2016-5440\");\n script_xref(name:\"ALAS\", value:\"2016-737\");\n\n script_name(english:\"Amazon Linux AMI : mysql56 (ALAS-2016-737)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote administrators to affect availability via vectors related to\nServer: RBR. (CVE-2016-5440)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote administrators to affect availability via vectors related to\nServer: InnoDB. (CVE-2016-3459)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote administrators to affect availability via vectors related to\nServer: Privileges. (CVE-2016-5439)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nlocal users to affect confidentiality, integrity, and availability via\nvectors related to Server: Parser. (CVE-2016-3477)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote authenticated users to affect availability via vectors related\nto Server: Security: Encryption. (CVE-2016-3614)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote authenticated users to affect availability via vectors related\nto Server: DML. (CVE-2016-3615)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote authenticated users to affect availability via vectors related\nto Server: Types. (CVE-2016-3521)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote authenticated users to affect availability via vectors related\nto Server: FTS. (CVE-2016-3486)\n\nUnspecified vulnerability in Oracle MySQL 5.6.30 and earlier allows\nremote authenticated users to affect availability via vectors related\nto Server: Optimizer. (CVE-2016-3501)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2016-737.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update mysql56' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-bench\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-embedded\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-embedded-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-errmsg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mysql56-test\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-bench-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-common-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-debuginfo-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-devel-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-embedded-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-embedded-devel-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-errmsg-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-libs-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-server-5.6.32-1.16.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"mysql56-test-5.6.32-1.16.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mysql56 / mysql56-bench / mysql56-common / mysql56-debuginfo / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:23:53", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - fix CVE-2016-2105 - possible overflow in base64 encoding\n\n - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate\n\n - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC\n\n - fix CVE-2016-2108 - memory corruption in ASN.1 encoder\n\n - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO\n\n - fix CVE-2016-0799 - memory issues in BIO_printf\n\n - fix CVE-2016-0702 - side channel attack on modular exponentiation\n\n - fix CVE-2016-0705 - double-free in DSA private key parsing\n\n - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn\n\n - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement\n\n - disable SSLv2 in the generic TLS method\n\n - fix 1-byte memory leak in pkcs12 parse (#1229871)\n\n - document some options of the speed command (#1197095)\n\n - fix high-precision timestamps in timestamping authority\n\n - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2\n\n - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter\n\n - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak\n\n - fix CVE-2015-3196 - race condition when handling PSK identity hint", "cvss3": {}, "published": "2016-05-16T00:00:00", "type": "nessus", "title": "OracleVM 3.3 / 3.4 : openssl (OVMSA-2016-0049) (SLOTH)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-3194", "CVE-2015-3195", "CVE-2015-3196", "CVE-2015-3197", "CVE-2015-7575", "CVE-2016-0702", "CVE-2016-0705", "CVE-2016-0797", "CVE-2016-0799", "CVE-2016-2105", "CVE-2016-2106", "CVE-2016-2107", "CVE-2016-2108", "CVE-2016-2109"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:openssl", "cpe:/o:oracle:vm_server:3.3", "cpe:/o:oracle:vm_server:3.4"], "id": "ORACLEVM_OVMSA-2016-0049.NASL", "href": "https://www.tenable.com/plugins/nessus/91154", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2016-0049.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91154);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2015-3194\", \"CVE-2015-3195\", \"CVE-2015-3196\", \"CVE-2015-3197\", \"CVE-2015-7575\", \"CVE-2016-0702\", \"CVE-2016-0705\", \"CVE-2016-0797\", \"CVE-2016-0799\", \"CVE-2016-2105\", \"CVE-2016-2106\", \"CVE-2016-2107\", \"CVE-2016-2108\", \"CVE-2016-2109\");\n\n script_name(english:\"OracleVM 3.3 / 3.4 : openssl (OVMSA-2016-0049) (SLOTH)\");\n script_summary(english:\"Checks the RPM output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - fix CVE-2016-2105 - possible overflow in base64 encoding\n\n - fix CVE-2016-2106 - possible overflow in\n EVP_EncryptUpdate\n\n - fix CVE-2016-2107 - padding oracle in stitched AES-NI\n CBC-MAC\n\n - fix CVE-2016-2108 - memory corruption in ASN.1 encoder\n\n - fix CVE-2016-2109 - possible DoS when reading ASN.1 data\n from BIO\n\n - fix CVE-2016-0799 - memory issues in BIO_printf\n\n - fix CVE-2016-0702 - side channel attack on modular\n exponentiation\n\n - fix CVE-2016-0705 - double-free in DSA private key\n parsing\n\n - fix CVE-2016-0797 - heap corruption in BN_hex2bn and\n BN_dec2bn\n\n - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement\n\n - disable SSLv2 in the generic TLS method\n\n - fix 1-byte memory leak in pkcs12 parse (#1229871)\n\n - document some options of the speed command (#1197095)\n\n - fix high-precision timestamps in timestamping authority\n\n - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2\n\n - fix CVE-2015-3194 - certificate verify crash with\n missing PSS parameter\n\n - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak\n\n - fix CVE-2015-3196 - race condition when handling PSK\n identity hint\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2016-May/000463.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2016-May/000459.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected openssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/16\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"(3\\.3|3\\.4)\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.3 / 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.3\", reference:\"openssl-1.0.1e-48.el6_8.1\")) flag++;\n\nif (rpm_check(release:\"OVS3.4\", reference:\"openssl-1.0.1e-48.el6_8.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:28", "description": "The version of Oracle Secure Global Desktop installed on the remote host is 4.63, 4.71, or 5.2 and is missing a security patch from the July 2016 Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities :\n\n - An integer overflow condition exists in the X Server subcomponent in the read_packet() function due to improper validation of user-supplied input when calculating the amount of memory required to handle returned data. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. Note that this vulnerability only affects versions 4.71 and 5.2. (CVE-2013-2064)\n\n - A carry propagating flaw exists in the OpenSSL subcomponent in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An attacker can exploit this to obtain sensitive information regarding private keys. (CVE-2015-3193)\n\n - A NULL pointer dereference flaw exists in the OpenSSL subcomponent in file rsa_ameth.c when handling ASN.1 signatures that use the RSA PSS algorithm but are missing a mask generation function parameter. A remote attacker can exploit this to cause the signature verification routine to crash, leading to a denial of service. (CVE-2015-3194)\n\n - A key disclosure vulnerability exists in the OpenSSL subcomponent due to improper handling of cache-bank conflicts on the Intel Sandy-bridge microarchitecture.\n An attacker can exploit this to gain access to RSA key information. (CVE-2016-0702)\n\n - A NULL pointer dereference flaw exists in the OpenSSL subcomponent in the BN_hex2bn() and BN_dec2bn() functions. A remote attacker can exploit this to trigger a heap corruption, resulting in the execution of arbitrary code. (CVE-2016-0797)\n\n - Multiple memory corruption issues exist in the OpenSSL subcomponent that allow a remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-0799)\n\n - A heap buffer overflow condition exists in the OpenSSL subcomponent in the EVP_EncodeUpdate() function within file crypto/evp/encode.c that is triggered when handling a large amount of input data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2105)\n\n - Multiple flaws exist in the OpenSSL subcomponent in the aesni_cbc_hmac_sha1_cipher() function in file crypto/evp/e_aes_cbc_hmac_sha1.c and the aesni_cbc_hmac_sha256_cipher() function in file crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered when the connection uses an AES-CBC cipher and AES-NI is supported by the server. A man-in-the-middle attacker can exploit these to conduct a padding oracle attack, resulting in the ability to decrypt the network traffic.\n (CVE-2016-2107)\n\n - An unspecified flaw exists in the OpenSSL subcomponent that allows a remote attacker to execute arbitrary code. (CVE-2016-3613)", "cvss3": {}, "published": "2016-07-25T00:00:00", "type": "nessus", "title": "Oracle Secure Global Desktop Multiple Vulnerabilities (July 2016 CPU)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-2064", "CVE-2015-3193", "CVE-2015-3194", "CVE-2016-0702", "CVE-2016-0797", "CVE-2016-0799", "CVE-2016-2105", "CVE-2016-2107", "CVE-2016-3613"], "modified": "2021-10-25T00:00:00", "cpe": ["cpe:/a:oracle:virtualization_secure_global_desktop"], "id": "ORACLE_SECURE_GLOBAL_DESKTOP_JUL_2016_CPU.NASL", "href": "https://www.tenable.com/plugins/nessus/92543", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(92543);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/10/25\");\n\n script_cve_id(\n \"CVE-2013-2064\",\n \"CVE-2015-3193\",\n \"CVE-2015-3194\",\n \"CVE-2016-0702\",\n \"CVE-2016-0797\",\n \"CVE-2016-0799\",\n \"CVE-2016-2105\",\n \"CVE-2016-2107\",\n \"CVE-2016-3613\"\n );\n script_bugtraq_id(\n 60148,\n 78623,\n 83755,\n 83763,\n 89757,\n 89760,\n 91856\n );\n script_xref(name:\"EDB-ID\", value:\"39768\");\n\n script_name(english:\"Oracle Secure Global Desktop Multiple Vulnerabilities (July 2016 CPU)\");\n script_summary(english:\"Checks the version of Oracle Secure Global Desktop.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"An application installed on the remote host is affected by multiple\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Oracle Secure Global Desktop installed on the remote\nhost is 4.63, 4.71, or 5.2 and is missing a security patch from the\nJuly 2016 Critical Patch Update (CPU). It is, therefore, affected by\nthe following vulnerabilities :\n\n - An integer overflow condition exists in the X Server\n subcomponent in the read_packet() function due to\n improper validation of user-supplied input when\n calculating the amount of memory required to handle\n returned data. A remote attacker can exploit this to\n cause a denial of service condition or the execution of\n arbitrary code. Note that this vulnerability only\n affects versions 4.71 and 5.2. (CVE-2013-2064)\n\n - A carry propagating flaw exists in the OpenSSL\n subcomponent in the x86_64 Montgomery squaring\n implementation that may cause the BN_mod_exp() function\n to produce incorrect results. An attacker can exploit\n this to obtain sensitive information regarding private\n keys. (CVE-2015-3193)\n\n - A NULL pointer dereference flaw exists in the OpenSSL\n subcomponent in file rsa_ameth.c when handling ASN.1\n signatures that use the RSA PSS algorithm but are\n missing a mask generation function parameter. A remote\n attacker can exploit this to cause the signature\n verification routine to crash, leading to a denial of\n service. (CVE-2015-3194)\n\n - A key disclosure vulnerability exists in the OpenSSL\n subcomponent due to improper handling of cache-bank\n conflicts on the Intel Sandy-bridge microarchitecture.\n An attacker can exploit this to gain access to RSA key\n information. (CVE-2016-0702)\n\n - A NULL pointer dereference flaw exists in the OpenSSL\n subcomponent in the BN_hex2bn() and BN_dec2bn()\n functions. A remote attacker can exploit this to trigger\n a heap corruption, resulting in the execution of\n arbitrary code. (CVE-2016-0797)\n\n - Multiple memory corruption issues exist in the OpenSSL\n subcomponent that allow a remote attacker to cause a\n denial of service condition or the execution of\n arbitrary code. (CVE-2016-0799)\n\n - A heap buffer overflow condition exists in the OpenSSL\n subcomponent in the EVP_EncodeUpdate() function within\n file crypto/evp/encode.c that is triggered when handling\n a large amount of input data. An unauthenticated, remote\n attacker can exploit this to cause a denial of service\n condition. (CVE-2016-2105)\n\n - Multiple flaws exist in the OpenSSL subcomponent in the\n aesni_cbc_hmac_sha1_cipher() function in file\n crypto/evp/e_aes_cbc_hmac_sha1.c and the\n aesni_cbc_hmac_sha256_cipher() function in file\n crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered\n when the connection uses an AES-CBC cipher and AES-NI\n is supported by the server. A man-in-the-middle attacker\n can exploit these to conduct a padding oracle attack,\n resulting in the ability to decrypt the network traffic.\n (CVE-2016-2107)\n\n - An unspecified flaw exists in the OpenSSL subcomponent\n that allows a remote attacker to execute arbitrary\n code. (CVE-2016-3613)\");\n # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?453b5f8c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the appropriate patch according to the July 2016 Oracle\nCritical Patch Update advisory.\");\n script_set_attribute(attribute:\"agent\", value:\"all\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-3613\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/05/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:oracle:virtualization_secure_global_desktop\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"oracle_secure_global_desktop_installed.nbin\");\n script_require_keys(\"Host/Oracle_Secure_Global_Desktop/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\napp = \"Oracle Secure Global Desktop\";\nversion = get_kb_item_or_exit(\"Host/Oracle_Secure_Global_Desktop/Version\");\n\n# this check is for Oracle Secure Global Desktop packages built for Linux platform\nuname = get_kb_item_or_exit(\"Host/uname\");\nif (\"Linux\" >!< uname) audit(AUDIT_OS_NOT, \"Linux\");\n\nfix_required = NULL;\n\nif (version =~ \"^5\\.20($|\\.)\") fix_required = 'Patch_52p6';\nelse if (version =~ \"^4\\.71($|\\.)\") fix_required = 'Patch_471p9';\nelse if (version =~ \"^4\\.63($|\\.)\") fix_required = 'Patch_463p9';\n\nif (isnull(fix_required)) audit(AUDIT_INST_VER_NOT_VULN, \"Oracle Secure Global Desktop\", version);\n\npatches = get_kb_list(\"Host/Oracle_Secure_Global_Desktop/Patches\");\n\npatched = FALSE;\nforeach patch (patches)\n{\n if (patch == fix_required)\n {\n patched = TRUE;\n break;\n }\n}\n\nif (patched) audit(AUDIT_INST_VER_NOT_VULN, app, version + ' (with ' + fix_required + ')');\n\nreport = '\\n Installed version : ' + version +\n '\\n Patch required : ' + fix_required +\n '\\n';\nsecurity_report_v4(port:0, extra:report, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:10:58", "description": "The remote host has a version of McAfee Firewall Enterprise installed that is affected by multiple vulnerabilities in the OpenSSL library :\n\n - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received. This allows a remote attacker, using an unexpected handshake, to crash the daemon, resulting in a denial of service. (CVE-2014-3569)\n\n - The BIGNUM squaring (BN_sqr) implementation does not properly calculate the square of a BIGNUM value. This allows a remote attacker to defeat cryptographic protection mechanisms. (CVE-2014-3570)\n\n - A NULL pointer dereference flaw exists with dtls1_get_record() when handling DTLS messages. A remote attacker, using a specially crafted DTLS message, can cause a denial of service. (CVE-2014-3571)\n\n - A flaw exists with ECDH handshakes when using an ECDSA certificate without a ServerKeyExchange message. This allows a remote attacker to trigger a loss of forward secrecy from the ciphersuite. (CVE-2014-3572)\n\n - A flaw exists when accepting non-DER variations of certificate signature algorithms and signature encodings due to a lack of enforcement of matches between signed and unsigned portions. A remote attacker, by including crafted data within a certificate's unsigned portion, can bypass fingerprint-based certificate-blacklist protection mechanisms. (CVE-2014-8275)\n\n - A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0204)\n\n - A flaw exists when accepting DH certificates for client authentication without the CertificateVerify message.\n This allows a remote attacker to authenticate to the service without a private key. (CVE-2015-0205)\n\n - A memory leak occurs in dtls1_buffer_record() when handling a saturation of DTLS records containing the same number sequence but for the next epoch. This allows a remote attacker to cause a denial of service.\n (CVE-2015-0206)", "cvss3": {}, "published": "2015-03-13T00:00:00", "type": "nessus", "title": "McAfee Firewall Enterprise OpenSSL Multiple Vulnerabilities (SB10102) (FREAK)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3569", "CVE-2014-3570", "CVE-2014-3571", "CVE-2014-3572", "CVE-2014-8275", "CVE-2015-0204", "CVE-2015-0205", "CVE-2015-0206"], "modified": "2019-11-22T00:00:00", "cpe": ["x-cpe:/a:mcafee:firewall_enterprise"], "id": "MCAFEE_FIREWALL_ENTERPRISE_SB10102.NASL", "href": "https://www.tenable.com/plugins/nessus/81815", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81815);\n script_version(\"1.17\");\n script_cvs_date(\"Date: 2019/11/22\");\n\n script_cve_id(\n \"CVE-2014-3569\",\n \"CVE-2014-3570\",\n \"CVE-2014-3571\",\n \"CVE-2014-3572\",\n \"CVE-2014-8275\",\n \"CVE-2015-0204\",\n \"CVE-2015-0205\",\n \"CVE-2015-0206\"\n );\n script_bugtraq_id(\n 71934,\n 71935,\n 71936,\n 71937,\n 71939,\n 71940,\n 71941,\n 71942\n );\n script_xref(name:\"CERT\", value:\"243585\");\n script_xref(name:\"MCAFEE-SB\", value:\"SB10102\");\n\n script_name(english:\"McAfee Firewall Enterprise OpenSSL Multiple Vulnerabilities (SB10102) (FREAK)\");\n script_summary(english:\"Checks the version of MFE.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host has a version of McAfee Firewall Enterprise installed\nthat is affected by multiple vulnerabilities in the OpenSSL library :\n\n - A NULL pointer dereference flaw exists when the SSLv3\n option isn't enabled and an SSLv3 ClientHello is\n received. This allows a remote attacker, using an\n unexpected handshake, to crash the daemon, resulting in\n a denial of service. (CVE-2014-3569)\n\n - The BIGNUM squaring (BN_sqr) implementation does not\n properly calculate the square of a BIGNUM value. This\n allows a remote attacker to defeat cryptographic\n protection mechanisms. (CVE-2014-3570)\n\n - A NULL pointer dereference flaw exists with\n dtls1_get_record() when handling DTLS messages. A remote\n attacker, using a specially crafted DTLS message, can\n cause a denial of service. (CVE-2014-3571)\n\n - A flaw exists with ECDH handshakes when using an ECDSA\n certificate without a ServerKeyExchange message. This\n allows a remote attacker to trigger a loss of forward\n secrecy from the ciphersuite. (CVE-2014-3572)\n\n - A flaw exists when accepting non-DER variations of\n certificate signature algorithms and signature encodings\n due to a lack of enforcement of matches between signed\n and unsigned portions. A remote attacker, by including\n crafted data within a certificate's unsigned portion,\n can bypass fingerprint-based certificate-blacklist\n protection mechanisms. (CVE-2014-8275)\n\n - A security feature bypass vulnerability, known as FREAK\n (Factoring attack on RSA-EXPORT Keys), exists due to the\n support of weak EXPORT_RSA cipher suites with keys less\n than or equal to 512 bits. A man-in-the-middle attacker\n may be able to downgrade the SSL/TLS connection to use\n EXPORT_RSA cipher suites which can be factored in a\n short amount of time, allowing the attacker to intercept\n and decrypt the traffic. (CVE-2015-0204)\n\n - A flaw exists when accepting DH certificates for client\n authentication without the CertificateVerify message.\n This allows a remote attacker to authenticate to the\n service without a private key. (CVE-2015-0205)\n\n - A memory leak occurs in dtls1_buffer_record()\n when handling a saturation of DTLS records containing\n the same number sequence but for the next epoch. This\n allows a remote attacker to cause a denial of service.\n (CVE-2015-0206)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://kc.mcafee.com/corporate/index?page=content&id=SB10102\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.smacktls.com/#freak\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the appropriate patch referenced in the vendor security\nadvisory.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-0205\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/a:mcafee:firewall_enterprise\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Firewalls\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mcafee_firewall_enterprise_version.nbin\");\n script_require_keys(\"Host/McAfeeFE/version\", \"Host/McAfeeFE/version_display\", \"Host/McAfeeFE/installed_patches\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\napp_name = \"McAfee Firewall Enterprise\";\nversion = get_kb_item_or_exit(\"Host/McAfeeFE/version\");\nversion_display = get_kb_item_or_exit(\"Host/McAfeeFE/version_display\");\ninstalled_patches = get_kb_item_or_exit(\"Host/McAfeeFE/installed_patches\");\n\nhotfixmap = make_array(\n \"^7\\.\" , \"70103E65\" ,\n \"^8\\.2\\.1(\\.|$)\" , \"8.2.1E133\" ,\n \"^8\\.3\\.1(\\.|$)\" , \"8.3.1E68\" ,\n \"^8\\.3\\.2(\\.|$)\" , \"8.3.2E37\"\n);\n\ndisp_name = make_array(\n \"70103E65\" , \"7.0.1.03 ePatch 65\",\n \"8.2.1E133\" , \"8.2.1 ePatch 133\",\n \"8.3.1E68\" , \"8.3.1 ePatch 68\",\n \"8.3.2E37\" , \"8.3.2 ePatch 37\"\n);\n\nhotfix = NULL;\nname = NULL;\n\nforeach vergx (keys(hotfixmap))\n{\n if(version =~ vergx)\n {\n hotfix = hotfixmap[vergx ];\n name = disp_name[hotfix];\n break;\n }\n}\n\nif(isnull(hotfix) || (hotfix =~ \"(^|,)[\\d\\.]+?E\\d+?($|,)\" && installed_patches !~ \"(^|,)[\\d\\.]+?E\\d+?($|,)\"))\n audit(AUDIT_INST_VER_NOT_VULN, version_display);\n\nif (hotfix >!< installed_patches)\n{\n port = 0;\n\n if (report_verbosity > 0)\n {\n report = \n '\\n Installed Version : ' + version_display +\n '\\n Patched Version : ' + name +\n '\\n';\n security_warning(extra:report, port:port);\n }\n else security_warning(port);\n exit(0);\n}\nelse audit(AUDIT_PATCH_INSTALLED, name, app_name);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:09:14", "description": "New openssl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.", "cvss3": {}, "published": "2015-01-12T00:00:00", "type": "nessus", "title": "Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : openssl (SSA:2015-009-01) (FREAK)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3569", "CVE-2014-3570", "CVE-2014-3571", "CVE-2014-3572", "CVE-2014-8275", "CVE-2015-0204", "CVE-2015-0205", "CVE-2015-0206"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:slackware:slackware_linux:openssl", "p-cpe:/a:slackware:slackware_linux:openssl-solibs", "cpe:/o:slackware:slackware_linux", "cpe:/o:slackware:slackware_linux:13.0", "cpe:/o:slackware:slackware_linux:13.1", "cpe:/o:slackware:slackware_linux:13.37", "cpe:/o:slackware:slackware_linux:14.0", "cpe:/o:slackware:slackware_linux:14.1"], "id": "SLACKWARE_SSA_2015-009-01.NASL", "href": "https://www.tenable.com/plugins/nessus/80443", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2015-009-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80443);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2014-3569\", \"CVE-2014-3570\", \"CVE-2014-3571\", \"CVE-2014-3572\", \"CVE-2014-8275\", \"CVE-2015-0204\", \"CVE-2015-0205\", \"CVE-2015-0206\");\n script_xref(name:\"SSA\", value:\"2015-009-01\");\n\n script_name(english:\"Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : openssl (SSA:2015-009-01) (FREAK)\");\n script_summary(english:\"Checks for updated packages in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New openssl packages are available for Slackware 13.0, 13.1, 13.37,\n14.0, 14.1, and -current to fix security issues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.782231\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0defa4b8\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected openssl and / or openssl-solibs packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:openssl-solibs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.37\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/09\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"13.0\", pkgname:\"openssl\", pkgver:\"0.9.8zd\", pkgarch:\"i486\", pkgnum:\"1_slack13.0\")) flag++;\nif (slackware_check(osver:\"13.0\", pkgname:\"openssl-solibs\", pkgver:\"0.9.8zd\", pkgarch:\"i486\", pkgnum:\"1_slack13.0\")) flag++;\nif (slackware_check(osver:\"13.0\", arch:\"x86_64\", pkgname:\"openssl\", pkgver:\"0.9.8zd\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.0\")) flag++;\nif (slackware_check(osver:\"13.0\", arch:\"x86_64\", pkgname:\"openssl-solibs\", pkgver:\"0.9.8zd\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.0\")) flag++;\n\nif (slackware_check(osver:\"13.1\", pkgname:\"openssl\", pkgver:\"0.9.8zd\", pkgarch:\"i486\", pkgnum:\"1_slack13.1\")) flag++;\nif (slackware_check(osver:\"13.1\", pkgname:\"openssl-solibs\", pkgver:\"0.9.8zd\", pkgarch:\"i486\", pkgnum:\"1_slack13.1\")) flag++;\nif (slackware_check(osver:\"13.1\", arch:\"x86_64\", pkgname:\"openssl\", pkgver:\"0.9.8zd\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.1\")) flag++;\nif (slackware_check(osver:\"13.1\", arch:\"x86_64\", pkgname:\"openssl-solibs\", pkgver:\"0.9.8zd\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.1\")) flag++;\n\nif (slackware_check(osver:\"13.37\", pkgname:\"openssl\", pkgver:\"0.9.8zd\", pkgarch:\"i486\", pkgnum:\"1_slack13.37\")) flag++;\nif (slackware_check(osver:\"13.37\", pkgname:\"openssl-solibs\", pkgver:\"0.9.8zd\", pkgarch:\"i486\", pkgnum:\"1_slack13.37\")) flag++;\nif (slackware_check(osver:\"13.37\", arch:\"x86_64\", pkgname:\"openssl\", pkgver:\"0.9.8zd\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.37\")) flag++;\nif (slackware_check(osver:\"13.37\", arch:\"x86_64\", pkgname:\"openssl-solibs\", pkgver:\"0.9.8zd\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.37\")) flag++;\n\nif (slackware_check(osver:\"14.0\", pkgname:\"openssl\", pkgver:\"1.0.1k\", pkgarch:\"i486\", pkgnum:\"1_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", pkgname:\"openssl-solibs\", pkgver:\"1.0.1k\", pkgarch:\"i486\", pkgnum:\"1_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", arch:\"x86_64\", pkgname:\"openssl\", pkgver:\"1.0.1k\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", arch:\"x86_64\", pkgname:\"openssl-solibs\", pkgver:\"1.0.1k\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.0\")) flag++;\n\nif (slackware_check(osver:\"14.1\", pkgname:\"openssl\", pkgver:\"1.0.1k\", pkgarch:\"i486\", pkgnum:\"1_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", pkgname:\"openssl-solibs\", pkgver:\"1.0.1k\", pkgarch:\"i486\", pkgnum:\"1_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"openssl\", pkgver:\"1.0.1k\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"openssl-solibs\", pkgver:\"1.0.1k\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.1\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"openssl\", pkgver:\"1.0.1k\", pkgarch:\"i486\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", pkgname:\"openssl-solibs\", pkgver:\"1.0.1k\", pkgarch:\"i486\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"openssl\", pkgver:\"1.0.1k\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"openssl-solibs\", pkgver:\"1.0.1k\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-23T14:17:00", "description": "Security Fix(es) :\n\n - Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions.\n (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610)\n\n - Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed.\n (CVE-2016-3500, CVE-2016-3508)\n\n - Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)\n\nNote: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.", "cvss3": {}, "published": "2016-07-21T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x, SL7.x i386/x86_64 (20160720)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-3458", "CVE-2016-3500", "CVE-2016-3508", "CVE-2016-3550", "CVE-2016-3587", "CVE-2016-3598", "CVE-2016-3606", "CVE-2016-3610"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:java-1.8.0-openjdk", "p-cpe:/a:fermilab:scientific_linux:java-1.8.0-openjdk-accessibility", "p-cpe:/a:fermilab:scientific_linux:java-1.8.0-openjdk-accessibility-debug", "p-cpe:/a:fermilab:scientific_linux:java-1.8.0-openjdk-debug", "p-cpe:/a:fermilab:scientific_linux:java-1.8.0-openjdk-debuginfo", "p-cpe:/a:fermilab:scientific_linux:java-1.8.0-openjdk-demo", "p-cpe:/a:fermilab:scientific_linux:java-1.8.0
Oracle Critical Patch Update - July 2016
