ID RHSA-2015:1919 Type redhat Reporter RedHat Modified 2018-06-06T20:24:23
Description
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime
Environment and the OpenJDK 8 Java Software Development Kit.
Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,
and 2D components in OpenJDK. An untrusted Java application or applet could
use these flaws to completely bypass Java sandbox restrictions.
(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,
CVE-2015-4805, CVE-2015-4844)
Multiple denial of service flaws were found in the JAXP component in
OpenJDK. A specially crafted XML file could cause a Java application using
JAXP to consume an excessive amount of CPU and memory when parsed.
(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)
A flaw was found in the way the Libraries component in OpenJDK handled
certificate revocation lists (CRL). In certain cases, CRL checking code
could fail to report a revoked certificate, causing the application to
accept it as trusted. (CVE-2015-4868)
It was discovered that the Security component in OpenJDK failed to properly
check if a certificate satisfied all defined constraints. In certain cases,
this could cause a Java application to accept an X.509 certificate which
does not meet requirements of the defined policy. (CVE-2015-4872)
Multiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI
components in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,
CVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)
Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the
CVE-2015-4806 issue.
All users of java-1.8.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.
{"amazon": [{"lastseen": "2021-07-25T19:29:13", "description": "**Issue Overview:**\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly check if a certificate satisfied all defined constraints. In certain cases, this could cause a Java application to accept an X.509 certificate which does not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\n \n**Affected Packages:** \n\n\njava-1.7.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.7.0-openjdk_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.63.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.2.63.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-1.7.0.91-2.6.2.2.63.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.63.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.63.amzn1.i686 \n \n noarch: \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.2.63.amzn1.noarch \n \n src: \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-1.7.0.91-2.6.2.2.63.amzn1.src \n \n x86_64: \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-1.7.0.91-2.6.2.2.63.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.63.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.2.63.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.63.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.63.amzn1.x86_64 \n \n \n", "edition": 2, "published": "2015-10-27T13:52:00", "type": "amazon", "title": "Critical: java-1.7.0-openjdk", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2015-10-27T14:14:00", "id": "ALAS-2015-605", "href": "https://alas.aws.amazon.com/ALAS-2015-605.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-25T19:29:12", "description": "**Issue Overview:**\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nA flaw was found in the way the Libraries component in OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report a revoked certificate, causing the application to accept it as trusted. (CVE-2015-4868)\n\nIt was discovered that the Security component in OpenJDK failed to properly check if a certificate satisfied all defined constraints. In certain cases, this could cause a Java application to accept an X.509 certificate which does not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\n \n**Affected Packages:** \n\n\njava-1.8.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.8.0-openjdk_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-demo-1.8.0.65-2.b17.7.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-debuginfo-1.8.0.65-2.b17.7.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-headless-1.8.0.65-2.b17.7.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-src-1.8.0.65-2.b17.7.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-1.8.0.65-2.b17.7.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-devel-1.8.0.65-2.b17.7.amzn1.i686 \n \n noarch: \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-javadoc-1.8.0.65-2.b17.7.amzn1.noarch \n \n src: \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-1.8.0.65-2.b17.7.amzn1.src \n \n x86_64: \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-debuginfo-1.8.0.65-2.b17.7.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-devel-1.8.0.65-2.b17.7.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-src-1.8.0.65-2.b17.7.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-demo-1.8.0.65-2.b17.7.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-headless-1.8.0.65-2.b17.7.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.8.0-openjdk-1.8.0.65-2.b17.7.amzn1.x86_64 \n \n \n", "edition": 2, "cvss3": {}, "published": "2015-10-27T16:39:00", "type": "amazon", "title": "Important: java-1.8.0-openjdk", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4868", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2015-10-27T16:51:00", "id": "ALAS-2015-606", "href": "https://alas.aws.amazon.com/ALAS-2015-606.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-25T19:29:07", "description": "**Issue Overview:**\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly check if a certificate satisfied all defined constraints. In certain cases, this could cause a Java application to accept an X.509 certificate which does not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, CORBA, JAXP, JGSS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\n \n**Affected Packages:** \n\n\njava-1.6.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.6.0-openjdk_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-demo-1.6.0.37-1.13.9.4.72.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-src-1.6.0.37-1.13.9.4.72.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-devel-1.6.0.37-1.13.9.4.72.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-1.6.0.37-1.13.9.4.72.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-javadoc-1.6.0.37-1.13.9.4.72.amzn1.i686 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-debuginfo-1.6.0.37-1.13.9.4.72.amzn1.i686 \n \n src: \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-1.6.0.37-1.13.9.4.72.amzn1.src \n \n x86_64: \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-1.6.0.37-1.13.9.4.72.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-javadoc-1.6.0.37-1.13.9.4.72.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-debuginfo-1.6.0.37-1.13.9.4.72.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-demo-1.6.0.37-1.13.9.4.72.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-devel-1.6.0.37-1.13.9.4.72.amzn1.x86_64 \n \u00a0\u00a0\u00a0 java-1.6.0-openjdk-src-1.6.0.37-1.13.9.4.72.amzn1.x86_64 \n \n \n", "edition": 2, "cvss3": {}, "published": "2015-12-14T10:00:00", "type": "amazon", "title": "Important: java-1.6.0-openjdk", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2015-12-13T14:17:00", "id": "ALAS-2015-616", "href": "https://alas.aws.amazon.com/ALAS-2015-616.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "centos": [{"lastseen": "2019-12-20T18:28:51", "description": "**CentOS Errata and Security Advisory** CESA-2015:1920\n\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-October/033475.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-October/033477.html\n\n**Affected packages:**\njava-1.7.0-openjdk\njava-1.7.0-openjdk-accessibility\njava-1.7.0-openjdk-demo\njava-1.7.0-openjdk-devel\njava-1.7.0-openjdk-headless\njava-1.7.0-openjdk-javadoc\njava-1.7.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-1920.html", "edition": 4, "published": "2015-10-21T23:14:14", "title": "java security update", "type": "centos", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-22T00:07:57", "href": "http://lists.centos.org/pipermail/centos-announce/2015-October/033475.html", "id": "CESA-2015:1920", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-20T18:28:51", "description": "**CentOS Errata and Security Advisory** CESA-2015:1921\n\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-October/033476.html\n\n**Affected packages:**\njava-1.7.0-openjdk\njava-1.7.0-openjdk-demo\njava-1.7.0-openjdk-devel\njava-1.7.0-openjdk-javadoc\njava-1.7.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-1921.html", "edition": 4, "published": "2015-10-21T23:24:30", "title": "java security update", "type": "centos", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-21T23:24:30", "href": "http://lists.centos.org/pipermail/centos-announce/2015-October/033476.html", "id": "CESA-2015:1921", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-20T18:25:43", "description": "**CentOS Errata and Security Advisory** CESA-2015:1919\n\n\nThe java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime\nEnvironment and the OpenJDK 8 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nA flaw was found in the way the Libraries component in OpenJDK handled\ncertificate revocation lists (CRL). In certain cases, CRL checking code\ncould fail to report a revoked certificate, causing the application to\naccept it as trusted. (CVE-2015-4868)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.8.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-October/033474.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-October/033478.html\n\n**Affected packages:**\njava-1.8.0-openjdk\njava-1.8.0-openjdk-accessibility\njava-1.8.0-openjdk-debug\njava-1.8.0-openjdk-demo\njava-1.8.0-openjdk-demo-debug\njava-1.8.0-openjdk-devel\njava-1.8.0-openjdk-devel-debug\njava-1.8.0-openjdk-headless\njava-1.8.0-openjdk-headless-debug\njava-1.8.0-openjdk-javadoc\njava-1.8.0-openjdk-javadoc-debug\njava-1.8.0-openjdk-src\njava-1.8.0-openjdk-src-debug\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-1919.html", "edition": 4, "cvss3": {}, "published": "2015-10-21T23:13:49", "title": "java security update", "type": "centos", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4868", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-22T00:08:18", "href": "http://lists.centos.org/pipermail/centos-announce/2015-October/033474.html", "id": "CESA-2015:1919", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-20T18:25:54", "description": "**CentOS Errata and Security Advisory** CESA-2015:2086\n\n\nThe java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime\nEnvironment and the OpenJDK 6 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-November/033543.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-November/033544.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-November/033545.html\n\n**Affected packages:**\njava-1.6.0-openjdk\njava-1.6.0-openjdk-demo\njava-1.6.0-openjdk-devel\njava-1.6.0-openjdk-javadoc\njava-1.6.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-2086.html", "edition": 4, "cvss3": {}, "published": "2015-11-18T19:46:16", "title": "java security update", "type": "centos", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4893"], "modified": "2015-11-18T20:38:46", "href": "http://lists.centos.org/pipermail/centos-announce/2015-November/033543.html", "id": "CESA-2015:2086", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2021-07-28T14:36:57", "description": "The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "cvss3": {}, "published": "2015-10-21T04:00:00", "type": "redhat", "title": "(RHSA-2015:1920) Critical: java-1.7.0-openjdk security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2018-06-06T20:24:16", "id": "RHSA-2015:1920", "href": "https://access.redhat.com/errata/RHSA-2015:1920", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:37:23", "description": "The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "cvss3": {}, "published": "2015-10-21T04:00:00", "type": "redhat", "title": "(RHSA-2015:1921) Important: java-1.7.0-openjdk security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2017-09-08T12:08:43", "id": "RHSA-2015:1921", "href": "https://access.redhat.com/errata/RHSA-2015:1921", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:36:01", "description": "The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime\nEnvironment and the OpenJDK 6 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "cvss3": {}, "published": "2015-11-18T05:00:00", "type": "redhat", "title": "(RHSA-2015:2086) Important: java-1.6.0-openjdk security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2018-06-06T20:24:16", "id": "RHSA-2015:2086", "href": "https://access.redhat.com/errata/RHSA-2015:2086", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:36:15", "description": "Oracle Java SE version 6 includes the Oracle Java Runtime Environment and\nthe Oracle Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the Oracle Java Runtime\nEnvironment and the Oracle Java Software Development Kit. Further\ninformation about these flaws can be found on the Oracle Java SE Critical\nPatch Update Advisory page, listed in the References section.\n(CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4835,\nCVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4872,\nCVE-2015-4881, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902,\nCVE-2015-4903, CVE-2015-4911)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.6.0-sun are advised to upgrade to these updated\npackages, which provide Oracle Java 6 Update 105 and resolve these issues.\nAll running instances of Oracle Java must be restarted for the update to\ntake effect.", "cvss3": {}, "published": "2015-10-22T22:21:17", "type": "redhat", "title": "(RHSA-2015:1928) Important: java-1.6.0-sun security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4902", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2018-06-07T18:20:30", "id": "RHSA-2015:1928", "href": "https://access.redhat.com/errata/RHSA-2015:1928", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:37:07", "description": "Oracle Java SE version 7 includes the Oracle Java Runtime Environment and\nthe Oracle Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the Oracle Java Runtime\nEnvironment and the Oracle Java Software Development Kit. Further\ninformation about these flaws can be found on the Oracle Java SE Critical\nPatch Update Advisory page, listed in the References section.\n(CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4810,\nCVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844,\nCVE-2015-4860, CVE-2015-4871, CVE-2015-4872, CVE-2015-4881, CVE-2015-4882,\nCVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903, CVE-2015-4911)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.7.0-oracle are advised to upgrade to these updated\npackages, which provide Oracle Java 7 Update 91 and resolve these issues.\nAll running instances of Oracle Java must be restarted for the update to\ntake effect.", "cvss3": {}, "published": "2015-10-22T22:20:48", "type": "redhat", "title": "(RHSA-2015:1927) Critical: java-1.7.0-oracle security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4810", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4871", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4902", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2018-06-07T18:20:34", "id": "RHSA-2015:1927", "href": "https://access.redhat.com/errata/RHSA-2015:1927", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:36:23", "description": "IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Further information\nabout these flaws can be found on the IBM Java Security alerts page, listed\nin the References section. (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805,\nCVE-2015-4806, CVE-2015-4835, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844,\nCVE-2015-4860, CVE-2015-4872, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893,\nCVE-2015-4902, CVE-2015-4903, CVE-2015-5006)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.6.0-ibm are advised to upgrade to these updated\npackages, containing the IBM Java SE 6 SR16-FP15 release. All running\ninstances of IBM Java must be restarted for the update to take effect.\n", "cvss3": {}, "published": "2015-11-23T05:00:00", "type": "redhat", "title": "(RHSA-2015:2508) Critical: java-1.6.0-ibm security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4902", "CVE-2015-4903", "CVE-2015-5006"], "modified": "2018-06-07T09:04:28", "id": "RHSA-2015:2508", "href": "https://access.redhat.com/errata/RHSA-2015:2508", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2016-09-04T11:49:41", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-02T16:34:56", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-02T16:34:56", "id": "SUSE-SU-2015:1874-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:50:21", "description": "java-1_7_0-openjdk was updated to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-04T17:12:29", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-04T17:12:29", "id": "OPENSUSE-SU-2015:1906-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00010.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:21:58", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-02T17:11:26", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-02T17:11:26", "id": "SUSE-SU-2015:1874-2", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00003.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:36:29", "description": "java-1_7_0-openjdk was updated to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-04T16:14:26", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-04T16:14:26", "id": "OPENSUSE-SU-2015:1902-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00008.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:22:46", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-12T14:18:13", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-12T14:18:13", "id": "OPENSUSE-SU-2015:1971-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00019.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:49:41", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-02T16:35:18", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-02T16:35:18", "id": "SUSE-SU-2015:1875-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00001.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:19:41", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376).\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JGSS (bsc#951376).\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality and integrity via unknown vectors related to Libraries\n (bsc#951376).\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376).\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to RMI (bsc#951376).\n\n", "cvss3": {}, "published": "2015-11-02T17:11:48", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-02T17:11:48", "id": "SUSE-SU-2015:1875-2", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00004.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "oraclelinux": [{"lastseen": "2021-06-04T20:21:21", "bulletinFamily": "unix", "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "description": "[1:1.7.0.91-2.6.2.1.0.1]\n- Add oracle-enterprise.patch\n- Fix DISTRO_NAME to 'Oracle Linux'\n[1:1.7.0.91-2.6.2.1]\n- added and applied patch500 8072932or8074489.patch to fix tck failure\n- Resolves: rhbz#1271918\n[1:1.7.0.91-2.6.2.0]\n- Drop patch for PR2521/RH1242587 now resolved upstream.\n- Resolves: rhbz#1271918\n[1:1.7.0.91-2.6.2.0]\n- Bump to 2.6.2 and u91b00.\n- Resolves: rhbz#1271918", "modified": "2015-10-21T00:00:00", "published": "2015-10-21T00:00:00", "id": "ELSA-2015-1921", "href": "http://linux.oracle.com/errata/ELSA-2015-1921.html", "type": "oraclelinux", "title": "java-1.7.0-openjdk security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-04T20:20:35", "bulletinFamily": "unix", "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "description": "[1:1.7.0.91-2.6.2.2.0.1]\n- Update DISTRO_NAME in specfile\n[1:1.7.0.91-2.6.2.2]\n- added and applied patch500 8072932or8074489.patch to fix tck failure\n- Resolves: rhbz#1271919\n[1:1.7.0.91-2.6.2.1]\n- Bump to 2.6.2 and u91b00.\n- Resolves: rhbz#1271919", "modified": "2015-10-21T00:00:00", "published": "2015-10-21T00:00:00", "id": "ELSA-2015-1920", "href": "http://linux.oracle.com/errata/ELSA-2015-1920.html", "type": "oraclelinux", "title": "java-1.7.0-openjdk security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-04T20:20:35", "description": "[1:1.8.0.65-0.b17]\n- October 2015 security update to u65b17.\n- Add script for generating OpenJDK tarballs from a local Mercurial tree.\n- Update RH1191652 patch to build against current AArch64 tree.\n- Use appropriate source ID to avoid unpacking both tarballs on AArch64.\n- Fix library removal script so jpeg, giflib and png sources are removed.\n- Update system-lcms.patch to regenerated upstream (8042159) version.\n- Drop LCMS update from rhel6-built.patch\n- Resolves: rhbz#1257654\n[1:1.8.0.51-4.b16]\n- bumped release to do an build, so test whether 1251560 was really fixed\n- Resolves: rhbz#1254197\n[1:1.8.0.60-4.b27]\n- updated to u60 (1255352)\n- Resolves: rhbz#1257654", "cvss3": {}, "published": "2015-10-21T00:00:00", "type": "oraclelinux", "title": "java-1.8.0-openjdk security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4868", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2015-10-21T00:00:00", "id": "ELSA-2015-1919", "href": "http://linux.oracle.com/errata/ELSA-2015-1919.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-04T20:20:56", "description": "[1:1.6.0.35-1.13.9.4.0.1.el5_11]\n- Add oracle-enterprise.patch\n[1:1.6.0.37-1.13.9.4]\n- Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.\n- Resolves: rhbz#1271926\n[1:1.6.0.37-1.13.9.3]\n- Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.\n- Resolves: rhbz#1271926\n[1:1.6.0.37-1.13.9.2]\n- Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.\n- Resolves: rhbz#1271926\n[1:1.6.0.37-1.13.9.1]\n- Update with newer tarball, including 6763122 fix for TCK regression.\n- Resolves: rhbz#1271926\n[1:1.6.0.37-1.13.9.1]\n- Drop java-1.6.0-openjdk-pstack.patch. 6310967, the upstream version, is applied in OpenJDK 6.\n- Resolves: rhbz#1271926\n[1:1.6.0.37-1.13.9.0]\n- Update to IcedTea 1.13.9\n- Resolves: rhbz#1271926", "cvss3": {}, "published": "2015-11-18T00:00:00", "type": "oraclelinux", "title": "java-1.6.0-openjdk security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4842", "CVE-2015-4843", "CVE-2015-4844", "CVE-2015-4860", "CVE-2015-4872", "CVE-2015-4881", "CVE-2015-4882", "CVE-2015-4883", "CVE-2015-4893", "CVE-2015-4903", "CVE-2015-4911"], "modified": "2015-11-18T00:00:00", "id": "ELSA-2015-2086", "href": "http://linux.oracle.com/errata/ELSA-2015-2086.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:36:52", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "openvas", "title": "RedHat Update for java-1.7.0-openjdk RHSA-2015:1920-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2018-11-23T00:00:00", "id": "OPENVAS:1361412562310871462", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871462", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for java-1.7.0-openjdk RHSA-2015:1920-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871462\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-22 07:22:41 +0200 (Thu, 22 Oct 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for java-1.7.0-openjdk RHSA-2015:1920-01\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1.7.0-openjdk'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\");\n script_tag(name:\"affected\", value:\"java-1.7.0-openjdk on Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Server (v. 7),\n Red Hat Enterprise Linux Workstation (v. 6)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_xref(name:\"RHSA\", value:\"2015:1920-01\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2015-October/msg00028.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_(7|6)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.1.el7_1\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-debuginfo\", rpm:\"java-1.7.0-openjdk-debuginfo~1.7.0.91~2.6.2.1.el7_1\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.1.el7_1\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-headless\", rpm:\"java-1.7.0-openjdk-headless~1.7.0.91~2.6.2.1.el7_1\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.2.el6_7\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-debuginfo\", rpm:\"java-1.7.0-openjdk-debuginfo~1.7.0.91~2.6.2.2.el6_7\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.2.el6_7\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:50", "description": "Check the version of java", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "openvas", "title": "CentOS Update for java CESA-2015:1920 centos7", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2019-03-08T00:00:00", "id": "OPENVAS:1361412562310882301", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882301", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for java CESA-2015:1920 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882301\");\n script_version(\"$Revision: 14058 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-22 07:25:11 +0200 (Thu, 22 Oct 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\",\n \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\",\n \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\",\n \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"CentOS Update for java CESA-2015:1920 centos7\");\n script_tag(name:\"summary\", value:\"Check the version of java\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\");\n script_tag(name:\"affected\", value:\"java on CentOS 7\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_xref(name:\"CESA\", value:\"2015:1920\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2015-October/021439.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-accessibility\", rpm:\"java-1.7.0-openjdk-accessibility~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-demo\", rpm:\"java-1.7.0-openjdk-demo~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-headless\", rpm:\"java-1.7.0-openjdk-headless~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-javadoc\", rpm:\"java-1.7.0-openjdk-javadoc~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-src\", rpm:\"java-1.7.0-openjdk-src~1.7.0.91~2.6.2.1.el7_1\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:33", "description": "Oracle Linux Local Security Checks ELSA-2015-1921", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2015-1921", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2018-09-28T00:00:00", "id": "OPENVAS:1361412562310122718", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122718", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2015-1921.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122718\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-22 08:30:59 +0300 (Thu, 22 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2015-1921\");\n script_tag(name:\"insight\", value:\"ELSA-2015-1921 - java-1.7.0-openjdk security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2015-1921\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2015-1921.html\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.1.0.1.el5_11\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-demo\", rpm:\"java-1.7.0-openjdk-demo~1.7.0.91~2.6.2.1.0.1.el5_11\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.1.0.1.el5_11\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-javadoc\", rpm:\"java-1.7.0-openjdk-javadoc~1.7.0.91~2.6.2.1.0.1.el5_11\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-src\", rpm:\"java-1.7.0-openjdk-src~1.7.0.91~2.6.2.1.0.1.el5_11\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-17T22:58:35", "description": "The remote host is missing an update announced via the referenced Security Advisory.", "cvss3": {}, "published": "2015-11-08T00:00:00", "type": "openvas", "title": "Amazon Linux: Security Advisory (ALAS-2015-605)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2020-03-13T00:00:00", "id": "OPENVAS:1361412562310120595", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120595", "sourceData": "# Copyright (C) 2015 Eero Volotinen\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.120595\");\n script_version(\"2020-03-13T13:19:50+0000\");\n script_tag(name:\"creation_date\", value:\"2015-11-08 13:10:58 +0200 (Sun, 08 Nov 2015)\");\n script_tag(name:\"last_modification\", value:\"2020-03-13 13:19:50 +0000 (Fri, 13 Mar 2020)\");\n script_name(\"Amazon Linux: Security Advisory (ALAS-2015-605)\");\n script_tag(name:\"insight\", value:\"Multiple flaws were found in OpenJDK. Please see the references for more information.\");\n script_tag(name:\"solution\", value:\"Run yum update java-1.7.0-openjdk to update your system.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://alas.aws.amazon.com/ALAS-2015-605.html\");\n script_cve_id(\"CVE-2015-4843\", \"CVE-2015-4842\", \"CVE-2015-4840\", \"CVE-2015-4872\", \"CVE-2015-4860\", \"CVE-2015-4844\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4911\", \"CVE-2015-4734\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4903\", \"CVE-2015-4806\", \"CVE-2015-4805\", \"CVE-2015-4803\", \"CVE-2015-4835\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"The remote host is missing an update announced via the referenced Security Advisory.\");\n script_copyright(\"Copyright (C) 2015 Eero Volotinen\");\n script_family(\"Amazon Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"AMAZON\") {\n if(!isnull(res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.2.63.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1.7.0-openjdk-debuginfo\", rpm:\"java-1.7.0-openjdk-debuginfo~1.7.0.91~2.6.2.2.63.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.2.63.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1.7.0-openjdk-demo\", rpm:\"java-1.7.0-openjdk-demo~1.7.0.91~2.6.2.2.63.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1.7.0-openjdk-src\", rpm:\"java-1.7.0-openjdk-src~1.7.0.91~2.6.2.2.63.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1.7.0-openjdk-javadoc\", rpm:\"java-1.7.0-openjdk-javadoc~1.7.0.91~2.6.2.2.63.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T18:37:21", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-11-05T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for java-1_7_0-openjdk (openSUSE-SU-2015:1902-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851128", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851128", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851128\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-11-05 06:19:59 +0100 (Thu, 05 Nov 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for java-1_7_0-openjdk (openSUSE-SU-2015:1902-1)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1_7_0-openjdk'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"java-1_7_0-openjdk was updated to fix 17 security issues.\n\n These security issues were fixed:\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4 ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n\n script_tag(name:\"affected\", value:\"java-1_7_0-openjdk on openSUSE 13.2\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"openSUSE-SU\", value:\"2015:1902-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.2\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSE13.2\") {\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk\", rpm:\"java-1_7_0-openjdk~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-accessibility\", rpm:\"java-1_7_0-openjdk-accessibility~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap\", rpm:\"java-1_7_0-openjdk-bootstrap~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-debuginfo\", rpm:\"java-1_7_0-openjdk-bootstrap-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-debugsource\", rpm:\"java-1_7_0-openjdk-bootstrap-debugsource~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-devel\", rpm:\"java-1_7_0-openjdk-bootstrap-devel~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo\", rpm:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-headless\", rpm:\"java-1_7_0-openjdk-bootstrap-headless~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo\", rpm:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debuginfo\", rpm:\"java-1_7_0-openjdk-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debugsource\", rpm:\"java-1_7_0-openjdk-debugsource~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo\", rpm:\"java-1_7_0-openjdk-demo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo-debuginfo\", rpm:\"java-1_7_0-openjdk-demo-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel\", rpm:\"java-1_7_0-openjdk-devel~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel-debuginfo\", rpm:\"java-1_7_0-openjdk-devel-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless\", rpm:\"java-1_7_0-openjdk-headless~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless-debuginfo\", rpm:\"java-1_7_0-openjdk-headless-debuginfo~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-src\", rpm:\"java-1_7_0-openjdk-src~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-javadoc\", rpm:\"java-1_7_0-openjdk-javadoc~1.7.0.91~13.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T18:38:37", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-11-05T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for java-1_7_0-openjdk (openSUSE-SU-2015:1906-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851126", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851126", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851126\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-11-05 06:19:37 +0100 (Thu, 05 Nov 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for java-1_7_0-openjdk (openSUSE-SU-2015:1906-1)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1_7_0-openjdk'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"java-1_7_0-openjdk was updated to fix 17 security issues.\n\n These security issues were fixed:\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4 ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n\n script_tag(name:\"affected\", value:\"java-1_7_0-openjdk on openSUSE 13.1\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"openSUSE-SU\", value:\"2015:1906-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSE13.1\") {\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk\", rpm:\"java-1_7_0-openjdk~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-accessibility\", rpm:\"java-1_7_0-openjdk-accessibility~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debuginfo\", rpm:\"java-1_7_0-openjdk-debuginfo~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debugsource\", rpm:\"java-1_7_0-openjdk-debugsource~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo\", rpm:\"java-1_7_0-openjdk-demo~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo-debuginfo\", rpm:\"java-1_7_0-openjdk-demo-debuginfo~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel\", rpm:\"java-1_7_0-openjdk-devel~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel-debuginfo\", rpm:\"java-1_7_0-openjdk-devel-debuginfo~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless\", rpm:\"java-1_7_0-openjdk-headless~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless-debuginfo\", rpm:\"java-1_7_0-openjdk-headless-debuginfo~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-src\", rpm:\"java-1_7_0-openjdk-src~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-javadoc\", rpm:\"java-1_7_0-openjdk-javadoc~1.7.0.91~24.24.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T18:38:45", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-11-03T00:00:00", "type": "openvas", "title": "SUSE: Security Advisory for java-1_7_0-openjdk (SUSE-SU-2015:1874-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851123", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851123", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851123\");\n script_version(\"2020-01-31T07:58:03+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 07:58:03 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-11-03 06:08:11 +0100 (Tue, 03 Nov 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SUSE: Security Advisory for java-1_7_0-openjdk (SUSE-SU-2015:1874-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1_7_0-openjdk'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n\n script_tag(name:\"affected\", value:\"java-1_7_0-openjdk on SUSE Linux Enterprise Server 12\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"SUSE-SU\", value:\"2015:1874-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=SLES12\\.0SP0\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"SLES12.0SP0\") {\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk\", rpm:\"java-1_7_0-openjdk~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debuginfo\", rpm:\"java-1_7_0-openjdk-debuginfo~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debugsource\", rpm:\"java-1_7_0-openjdk-debugsource~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo\", rpm:\"java-1_7_0-openjdk-demo~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo-debuginfo\", rpm:\"java-1_7_0-openjdk-demo-debuginfo~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel\", rpm:\"java-1_7_0-openjdk-devel~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel-debuginfo\", rpm:\"java-1_7_0-openjdk-devel-debuginfo~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless\", rpm:\"java-1_7_0-openjdk-headless~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless-debuginfo\", rpm:\"java-1_7_0-openjdk-headless-debuginfo~1.7.0.91~21.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:54", "description": "Check the version of java", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "openvas", "title": "CentOS Update for java CESA-2015:1920 centos6", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2019-03-08T00:00:00", "id": "OPENVAS:1361412562310882302", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882302", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for java CESA-2015:1920 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882302\");\n script_version(\"$Revision: 14058 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-22 07:25:33 +0200 (Thu, 22 Oct 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"CentOS Update for java CESA-2015:1920 centos6\");\n script_tag(name:\"summary\", value:\"Check the version of java\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\");\n script_tag(name:\"affected\", value:\"java on CentOS 6\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_xref(name:\"CESA\", value:\"2015:1920\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2015-October/021437.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS6\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.2.el6_7\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-demo\", rpm:\"java-1.7.0-openjdk-demo~1.7.0.91~2.6.2.2.el6_7\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.2.el6_7\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-javadoc\", rpm:\"java-1.7.0-openjdk-javadoc~1.7.0.91~2.6.2.2.el6_7\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-src\", rpm:\"java-1.7.0-openjdk-src~1.7.0.91~2.6.2.2.el6_7\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:16", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "openvas", "title": "RedHat Update for java-1.7.0-openjdk RHSA-2015:1921-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2018-11-23T00:00:00", "id": "OPENVAS:1361412562310871463", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871463", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for java-1.7.0-openjdk RHSA-2015:1921-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871463\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-22 07:23:03 +0200 (Thu, 22 Oct 2015)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for java-1.7.0-openjdk RHSA-2015:1921-01\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1.7.0-openjdk'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,\nand 2D components in OpenJDK. An untrusted Java application or applet could\nuse these flaws to completely bypass Java sandbox restrictions.\n(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,\nCVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application using\nJAXP to consume an excessive amount of CPU and memory when parsed.\n(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to properly\ncheck if a certificate satisfied all defined constraints. In certain cases,\nthis could cause a Java application to accept an X.509 certificate which\ndoes not meet requirements of the defined policy. (CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI\ncomponents in OpenJDK. An untrusted Java application or applet could use\nthese flaws to bypass certain Java sandbox restrictions. (CVE-2015-4806,\nCVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\");\n script_tag(name:\"affected\", value:\"java-1.7.0-openjdk on Red Hat Enterprise Linux (v. 5 server)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_xref(name:\"RHSA\", value:\"2015:1921-01\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2015-October/msg00029.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_5\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk\", rpm:\"java-1.7.0-openjdk~1.7.0.91~2.6.2.1.el5_11\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-debuginfo\", rpm:\"java-1.7.0-openjdk-debuginfo~1.7.0.91~2.6.2.1.el5_11\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-demo\", rpm:\"java-1.7.0-openjdk-demo~1.7.0.91~2.6.2.1.el5_11\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-devel\", rpm:\"java-1.7.0-openjdk-devel~1.7.0.91~2.6.2.1.el5_11\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-javadoc\", rpm:\"java-1.7.0-openjdk-javadoc~1.7.0.91~2.6.2.1.el5_11\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"java-1.7.0-openjdk-src\", rpm:\"java-1.7.0-openjdk-src~1.7.0.91~2.6.2.1.el5_11\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T18:34:16", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-02-02T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for java-1_7_0-openjdk (openSUSE-SU-2015:1971-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851182", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851182", "sourceData": "# Copyright (C) 2016 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851182\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2016-02-02 17:15:47 +0100 (Tue, 02 Feb 2016)\");\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\",\n \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\",\n \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\",\n \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\",\n \"CVE-2015-4911\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for java-1_7_0-openjdk (openSUSE-SU-2015:1971-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'java-1_7_0-openjdk'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"java-1_7_0-openjdk was updated to version 7u91 to fix 17 security issues.\n\n These security issues were fixed:\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and\n 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality via unknown vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883 (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n confidentiality, integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860 (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60 Java SE Embedded 8u51 and JRockit R28.3.7 allowed remote\n attackers to affect availability via vectors related to JAXP, a\n different vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85,\n and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect\n availability via vectors related to CORBA (bsc#95 ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n\n script_tag(name:\"affected\", value:\"java-1_7_0-openjdk on openSUSE Leap 42.1\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2015:1971-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.1\") {\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk\", rpm:\"java-1_7_0-openjdk~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-accessibility\", rpm:\"java-1_7_0-openjdk-accessibility~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap\", rpm:\"java-1_7_0-openjdk-bootstrap~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-debuginfo\", rpm:\"java-1_7_0-openjdk-bootstrap-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-debugsource\", rpm:\"java-1_7_0-openjdk-bootstrap-debugsource~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-devel\", rpm:\"java-1_7_0-openjdk-bootstrap-devel~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo\", rpm:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-headless\", rpm:\"java-1_7_0-openjdk-bootstrap-headless~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo\", rpm:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debuginfo\", rpm:\"java-1_7_0-openjdk-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-debugsource\", rpm:\"java-1_7_0-openjdk-debugsource~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo\", rpm:\"java-1_7_0-openjdk-demo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-demo-debuginfo\", rpm:\"java-1_7_0-openjdk-demo-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel\", rpm:\"java-1_7_0-openjdk-devel~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-devel-debuginfo\", rpm:\"java-1_7_0-openjdk-devel-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless\", rpm:\"java-1_7_0-openjdk-headless~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-headless-debuginfo\", rpm:\"java-1_7_0-openjdk-headless-debuginfo~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-src\", rpm:\"java-1_7_0-openjdk-src~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"java-1_7_0-openjdk-javadoc\", rpm:\"java-1_7_0-openjdk-javadoc~1.7.0.91~22.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-08-01T11:20:12", "description": "Updated java-1.7.0-openjdk packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting\nthe CVE-2015-4806 issue.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "nessus", "title": "RHEL 5 : java-1.7.0-openjdk (RHSA-2015:1921)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2021-08-02T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-devel", "cpe:/o:redhat:enterprise_linux:5", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-src", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-demo", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-debuginfo", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-javadoc"], "id": "REDHAT-RHSA-2015-1921.NASL", "href": "https://www.tenable.com/plugins/nessus/86526", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:1921. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86526);\n script_version(\"2.10\");\n script_cvs_date(\"Date: 2019/10/24 15:35:40\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_xref(name:\"RHSA\", value:\"2015:1921\");\n\n script_name(english:\"RHEL 5 : java-1.7.0-openjdk (RHSA-2015:1921)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated java-1.7.0-openjdk packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting\nthe CVE-2015-4806 issue.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2015:1921\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4843\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4842\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4840\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4844\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4911\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4883\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4734\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4881\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4882\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4903\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4806\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4803\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4835\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:1921\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el5_11\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk / java-1.7.0-openjdk-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-29T04:18:45", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "cvss3": {}, "published": "2015-11-03T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1874-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-03T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo-debuginfo"], "id": "SUSE_SU-2015-1874-1.NASL", "href": "https://www.tenable.com/plugins/nessus/86705", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2015:1874-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86705);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n\n script_name(english:\"SUSE SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1874-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=951376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4803/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4805/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4806/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4835/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4840/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4842/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4843/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4844/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4860/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4872/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4881/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4882/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4883/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4893/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4903/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4911/\"\n );\n # https://www.suse.com/support/update/announcement/2015/suse-su-20151874-1.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c36d2eb9\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-2015-781=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/11/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"s390x\") audit(AUDIT_ARCH_NOT, \"s390x\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-demo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-devel-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-headless-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-21.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T23:07:28", "description": "Several vulnerabilities have been discovered in OpenJDK, an\nimplementation of the Oracle Java platform, resulting in the execution\nof arbitrary code, breakouts of the Java sandbox, information\ndisclosure, or denial of service.", "cvss3": {}, "published": "2015-10-29T00:00:00", "type": "nessus", "title": "Debian DSA-3381-1 : openjdk-7 - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-29T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:openjdk-7", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-3381.NASL", "href": "https://www.tenable.com/plugins/nessus/86642", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3381. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86642);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_xref(name:\"DSA\", value:\"3381\");\n\n script_name(english:\"Debian DSA-3381-1 : openjdk-7 - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in OpenJDK, an\nimplementation of the Oracle Java platform, resulting in the execution\nof arbitrary code, breakouts of the Java sandbox, information\ndisclosure, or denial of service.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/openjdk-7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/openjdk-7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2015/dsa-3381\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the openjdk-7 packages.\n\nFor the oldstable distribution (wheezy), these problems have been\nfixed in version 7u85-2.6.1-6~deb7u1.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 7u85-2.6.1-5~deb8u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:openjdk-7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"icedtea-7-jre-cacao\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"icedtea-7-jre-jamvm\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-dbg\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-demo\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-doc\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-jdk\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-jre\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-jre-headless\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-jre-lib\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-jre-zero\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"openjdk-7-source\", reference:\"7u85-2.6.1-6~deb7u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"icedtea-7-jre-jamvm\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-dbg\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-demo\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-doc\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-jdk\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-jre\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-jre-headless\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-jre-lib\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-jre-zero\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"openjdk-7-source\", reference:\"7u85-2.6.1-5~deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-01T06:34:28", "description": "Multiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 ,\nCVE-2015-4883 , CVE-2015-4860 , CVE-2015-4805 , CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803 , CVE-2015-4893 , CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806 , CVE-2015-4840 , CVE-2015-4882 , CVE-2015-4842 ,\nCVE-2015-4734 , CVE-2015-4903)", "cvss3": {}, "published": "2015-10-29T00:00:00", "type": "nessus", "title": "Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-605)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2021-08-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:java-1.7.0-openjdk", "p-cpe:/a:amazon:linux:java-1.7.0-openjdk-javadoc", "p-cpe:/a:amazon:linux:java-1.7.0-openjdk-debuginfo", "p-cpe:/a:amazon:linux:java-1.7.0-openjdk-demo", "p-cpe:/a:amazon:linux:java-1.7.0-openjdk-src", "p-cpe:/a:amazon:linux:java-1.7.0-openjdk-devel", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2015-605.NASL", "href": "https://www.tenable.com/plugins/nessus/86636", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2015-605.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86636);\n script_version(\"2.3\");\n script_cvs_date(\"Date: 2019/07/10 16:04:12\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_xref(name:\"ALAS\", value:\"2015-605\");\n script_xref(name:\"RHSA\", value:\"2015:1920\");\n\n script_name(english:\"Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-605)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 ,\nCVE-2015-4883 , CVE-2015-4860 , CVE-2015-4805 , CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803 , CVE-2015-4893 , CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806 , CVE-2015-4840 , CVE-2015-4882 , CVE-2015-4842 ,\nCVE-2015-4734 , CVE-2015-4903)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2015-605.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update java-1.7.0-openjdk' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:java-1.7.0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:java-1.7.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:java-1.7.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:java-1.7.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:java-1.7.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.2.63.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.2.63.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.63.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.63.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.2.63.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.63.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk / java-1.7.0-openjdk-debuginfo / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-01T11:20:12", "description": "Updated java-1.7.0-openjdk packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting\nthe CVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "nessus", "title": "RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2015:1920)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2021-08-02T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:6.7", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-devel", "cpe:/o:redhat:enterprise_linux:7.4", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-accessibility", "cpe:/o:redhat:enterprise_linux:7.1", "cpe:/o:redhat:enterprise_linux:7.7", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-src", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-demo", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.2", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-debuginfo", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-headless", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-javadoc"], "id": "REDHAT-RHSA-2015-1920.NASL", "href": "https://www.tenable.com/plugins/nessus/86525", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:1920. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86525);\n script_version(\"2.14\");\n script_cvs_date(\"Date: 2019/10/24 15:35:40\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_xref(name:\"RHSA\", value:\"2015:1920\");\n\n script_name(english:\"RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2015:1920)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated java-1.7.0-openjdk packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting\nthe CVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2015:1920\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4843\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4842\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4840\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4844\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4911\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4883\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4734\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4881\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4882\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4903\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4806\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4803\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-4835\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x / 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:1920\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-accessibility-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-accessibility-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk / java-1.7.0-openjdk-accessibility / etc\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T14:23:07", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "cvss3": {}, "published": "2015-11-03T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1874-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-03T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo-debuginfo"], "id": "SUSE_SU-2015-1874-2.NASL", "href": "https://www.tenable.com/plugins/nessus/86706", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2015:1874-2.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86706);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1874-2)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=951376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4803/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4805/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4806/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4835/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4840/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4842/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4843/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4844/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4860/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4872/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4881/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4882/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4883/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4893/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4903/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4911/\"\n );\n # https://www.suse.com/support/update/announcement/2015/suse-su-20151874-2.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?63d26515\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-2015-781=1\n\nSUSE Linux Enterprise Desktop 12 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-2015-781=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/11/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-demo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-devel-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-headless-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-headless-1.7.0.91-21.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-21.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-29T01:48:02", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).", "cvss3": {}, "published": "2015-11-20T00:00:00", "type": "nessus", "title": "openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2015-736)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-20T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debuginfo", "cpe:/o:novell:opensuse:42.1", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debugsource", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel", "p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel-debuginfo"], "id": "OPENSUSE-2015-736.NASL", "href": "https://www.tenable.com/plugins/nessus/86962", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2015-736.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86962);\n script_version(\"2.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n\n script_name(english:\"openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2015-736)\");\n script_summary(english:\"Check for the openSUSE-2015-736 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=951376\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1_7_0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-bootstrap-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_7_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/11/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-accessibility-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-devel-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-headless-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-debugsource-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-demo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-devel-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-headless-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-javadoc-1.7.0.91-22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"java-1_7_0-openjdk-src-1.7.0.91-22.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk-bootstrap / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-29T04:18:45", "description": "java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "cvss3": {}, "published": "2015-11-03T00:00:00", "type": "nessus", "title": "SUSE SLED11 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1875-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-03T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo", "cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk", "p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel"], "id": "SUSE_SU-2015-1875-2.NASL", "href": "https://www.tenable.com/plugins/nessus/86708", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2015:1875-2.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86708);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n\n script_name(english:\"SUSE SLED11 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1875-2)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"java-1_7_0-openjdk was updated to version 7u91 to fix 17 security\nissues.\n\nThese security issues were fixed :\n\n - CVE-2015-4843: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Libraries (bsc#951376).\n\n - CVE-2015-4842: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JAXP (bsc#951376).\n\n - CVE-2015-4840: Unspecified vulnerability in Oracle Java\n SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed\n remote attackers to affect confidentiality via unknown\n vectors related to 2D (bsc#951376).\n\n - CVE-2015-4872: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n integrity via unknown vectors related to Security\n (bsc#951376).\n\n - CVE-2015-4860: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4883\n (bsc#951376).\n\n - CVE-2015-4844: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to 2D (bsc#951376).\n\n - CVE-2015-4883: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI,\n a different vulnerability than CVE-2015-4860\n (bsc#951376).\n\n - CVE-2015-4893: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4911: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4803 and CVE-2015-4893\n (bsc#951376).\n\n - CVE-2015-4882: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect availability via\n vectors related to CORBA (bsc#951376).\n\n - CVE-2015-4881: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4835\n (bsc#951376).\n\n - CVE-2015-4734: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to JGSS (bsc#951376).\n\n - CVE-2015-4806: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality and\n integrity via unknown vectors related to Libraries\n (bsc#951376).\n\n - CVE-2015-4805: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related\n to Serialization (bsc#951376).\n\n - CVE-2015-4803: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and\n JRockit R28.3.7 allowed remote attackers to affect\n availability via vectors related to JAXP, a different\n vulnerability than CVE-2015-4893 and CVE-2015-4911\n (bsc#951376).\n\n - CVE-2015-4835: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to\n CORBA, a different vulnerability than CVE-2015-4881\n (bsc#951376).\n\n - CVE-2015-4903: Unspecified vulnerability in Oracle Java\n SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51,\n allowed remote attackers to affect confidentiality via\n vectors related to RMI (bsc#951376).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=951376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4803/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4805/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4806/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4835/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4840/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4842/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4843/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4844/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4860/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4872/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4881/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4882/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4883/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4893/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4903/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-4911/\"\n );\n # https://www.suse.com/support/update/announcement/2015/suse-su-20151875-2.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a4d96524\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Desktop 11-SP4 :\n\nzypper in -t patch sledsp4-java-1_7_0-openjdk-12179=1\n\nSUSE Linux Enterprise Desktop 11-SP3 :\n\nzypper in -t patch sledsp3-java-1_7_0-openjdk-12179=1\n\nSUSE Linux Enterprise Debuginfo 11-SP4 :\n\nzypper in -t patch dbgsp4-java-1_7_0-openjdk-12179=1\n\nSUSE Linux Enterprise Debuginfo 11-SP3 :\n\nzypper in -t patch dbgsp3-java-1_7_0-openjdk-12179=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/11/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLED11\" && (! preg(pattern:\"^(3|4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED11 SP3/4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-1.7.0.91-0.14.2\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-demo-1.7.0.91-0.14.2\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-devel-1.7.0.91-0.14.2\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-1.7.0.91-0.14.2\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-demo-1.7.0.91-0.14.2\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_7_0-openjdk-devel-1.7.0.91-0.14.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_0-openjdk\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T13:49:00", "description": "Multiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nAll running instances of OpenJDK Java must be restarted for the update\nto take effect.", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/x86_64 (20151021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-22T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-src", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-devel", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-headless", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-demo", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-javadoc", "x-cpe:/o:fermilab:scientific_linux", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-debuginfo", "p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-accessibility"], "id": "SL_20151021_JAVA_1_7_0_OPENJDK_ON_SL6_X.NASL", "href": "https://www.tenable.com/plugins/nessus/86528", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86528);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n\n script_name(english:\"Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/x86_64 (20151021)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nAll running instances of OpenJDK Java must be restarted for the update\nto take effect.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1510&L=scientific-linux-errata&F=&S=&P=3884\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8c6c2388\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:java-1.7.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL6\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.2.el6_7\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.2.el6_7\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.el6_7\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.el6_7\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.2.el6_7\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.el6_7\")) flag++;\n\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-accessibility-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-debuginfo-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.el7_1\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.el7_1\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk / java-1.7.0-openjdk-accessibility / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-29T02:29:16", "description": "From Red Hat Security Advisory 2015:1920 :\n\nUpdated java-1.7.0-openjdk packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting\nthe CVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.", "cvss3": {}, "published": "2015-10-22T00:00:00", "type": "nessus", "title": "Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2015-1920)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-22T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk-headless", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk-devel", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk-accessibility", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk-javadoc", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk-src", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk-demo", "p-cpe:/a:oracle:linux:java-1.7.0-openjdk", "cpe:/o:oracle:linux:7"], "id": "ORACLELINUX_ELSA-2015-1920.NASL", "href": "https://www.tenable.com/plugins/nessus/86521", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2015:1920 and \n# Oracle Linux Security Advisory ELSA-2015-1920 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86521);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2015-4734\", \"CVE-2015-4803\", \"CVE-2015-4805\", \"CVE-2015-4806\", \"CVE-2015-4835\", \"CVE-2015-4840\", \"CVE-2015-4842\", \"CVE-2015-4843\", \"CVE-2015-4844\", \"CVE-2015-4860\", \"CVE-2015-4872\", \"CVE-2015-4881\", \"CVE-2015-4882\", \"CVE-2015-4883\", \"CVE-2015-4893\", \"CVE-2015-4903\", \"CVE-2015-4911\");\n script_xref(name:\"RHSA\", value:\"2015:1920\");\n\n script_name(english:\"Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2015-1920)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2015:1920 :\n\nUpdated java-1.7.0-openjdk packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nMultiple flaws were discovered in the CORBA, Libraries, RMI,\nSerialization, and 2D components in OpenJDK. An untrusted Java\napplication or applet could use these flaws to completely bypass Java\nsandbox restrictions. (CVE-2015-4835, CVE-2015-4881, CVE-2015-4843,\nCVE-2015-4883, CVE-2015-4860, CVE-2015-4805, CVE-2015-4844)\n\nMultiple denial of service flaws were found in the JAXP component in\nOpenJDK. A specially crafted XML file could cause a Java application\nusing JAXP to consume an excessive amount of CPU and memory when\nparsed. (CVE-2015-4803, CVE-2015-4893, CVE-2015-4911)\n\nIt was discovered that the Security component in OpenJDK failed to\nproperly check if a certificate satisfied all defined constraints. In\ncertain cases, this could cause a Java application to accept an X.509\ncertificate which does not meet requirements of the defined policy.\n(CVE-2015-4872)\n\nMultiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and\nRMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass certain Java sandbox restrictions.\n(CVE-2015-4806, CVE-2015-4840, CVE-2015-4882, CVE-2015-4842,\nCVE-2015-4734, CVE-2015-4903)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting\nthe CVE-2015-4806 issue.\n\nNote: If the web browser plug-in provided by the icedtea-web package\nwas installed, the issues exposed via Java applets could have been\nexploited without user interaction if a user visited a malicious\nwebsite.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these\nupdated packages, which resolve these issues. All running instances of\nOpenJDK Java must be restarted for the update to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2015-October/005464.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2015-October/005465.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected java-1.7.0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:java-1.7.0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6 / 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.2.0.1.el6_7\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.2.0.1.el6_7\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.2.0.1.el6_7\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.2.0.1.el6_7\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.2.0.1.el6_7\")) flag++;\n\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-accessibility-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-demo-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-devel-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-javadoc-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"java-1.7.0-openjdk-src-1.7.0.91-2.6.2.1.0.1.el7_1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.7.0-openjdk / java-1.7.0-openjdk-accessibility / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2021-08-04T17:47:53", "description": "Multiple vulnerabilities were discovered in the OpenJDK JRE related to \ninformation disclosure, data integrity and availability. An attacker \ncould exploit these to cause a denial of service or expose sensitive \ndata over the network. ([CVE-2015-4805](/security/CVE-2015-4805),\n[CVE-2015-4835](/security/CVE-2015-4835),\n[CVE-2015-4843](/security/CVE-2015-4843), \n[CVE-2015-4844](/security/CVE-2015-4844),\n[CVE-2015-4860](/security/CVE-2015-4860),\n[CVE-2015-4868](/security/CVE-2015-4868),\n[CVE-2015-4881](/security/CVE-2015-4881), \n[CVE-2015-4883](/security/CVE-2015-4883))\n\nA vulnerability was discovered in the OpenJDK JRE related to \ninformation disclosure and data integrity. An attacker could exploit \nthis to expose sensitive data over the network.\n([CVE-2015-4806](/security/CVE-2015-4806))\n\nA vulnerability was discovered in the OpenJDK JRE related to data \nintegrity. An attacker could exploit this expose sensitive data over \nthe network. ([CVE-2015-4872](/security/CVE-2015-4872))\n\nMultiple vulnerabilities were discovered in the OpenJDK JRE related \nto information disclosure. An attacker could exploit these to expose \nsensitive data over the network. ([CVE-2015-4734](/security/CVE-2015-4734),\n[CVE-2015-4840](/security/CVE-2015-4840), \n[CVE-2015-4842](/security/CVE-2015-4842),\n[CVE-2015-4903](/security/CVE-2015-4903))\n\nMultiple vulnerabilities were discovered in the OpenJDK JRE related \nto availability. An attacker could exploit these to cause a denial of \nservice. ([CVE-2015-4803](/security/CVE-2015-4803),\n[CVE-2015-4882](/security/CVE-2015-4882),\n[CVE-2015-4893](/security/CVE-2015-4893),\n[CVE-2015-4911](/security/CVE-2015-4911))\n\n", "cvss3": {}, "published": "2015-10-28T00:00:00", "type": "ubuntu", "title": "OpenJDK 7 vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4893", "CVE-2015-4881", "CVE-2015-4843", "CVE-2015-4840", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4868", "CVE-2015-4911", "CVE-2015-4882", "CVE-2015-4903", "CVE-2015-4883", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4844", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4860"], "modified": "2015-10-28T00:00:00", "id": "USN-2784-1", "href": "https://ubuntu.com/security/notices/USN-2784-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-04T17:47:47", "description": "Multiple vulnerabilities were discovered in the OpenJDK JRE related to \ninformation disclosure, data integrity and availability. An attacker \ncould exploit these to cause a denial of service or expose sensitive \ndata over the network. ([CVE-2015-4805](/security/CVE-2015-4805),\n[CVE-2015-4835](/security/CVE-2015-4835),\n[CVE-2015-4843](/security/CVE-2015-4843), \n[CVE-2015-4844](/security/CVE-2015-4844),\n[CVE-2015-4860](/security/CVE-2015-4860),\n[CVE-2015-4881](/security/CVE-2015-4881),\n[CVE-2015-4883](/security/CVE-2015-4883))\n\nA vulnerability was discovered in the OpenJDK JRE related to \ninformation disclosure and data integrity. An attacker could exploit \nthis to expose sensitive data over the network.\n([CVE-2015-4806](/security/CVE-2015-4806))\n\nA vulnerability was discovered in the OpenJDK JRE related to data \nintegrity. An attacker could exploit this expose sensitive data over \nthe network. ([CVE-2015-4872](/security/CVE-2015-4872))\n\nMultiple vulnerabilities were discovered in the OpenJDK JRE related \nto information disclosure. An attacker could exploit these to expose \nsensitive data over the network. ([CVE-2015-4734](/security/CVE-2015-4734),\n[CVE-2015-4842](/security/CVE-2015-4842), \n[CVE-2015-4903](/security/CVE-2015-4903))\n\nMultiple vulnerabilities were discovered in the OpenJDK JRE related \nto availability. An attacker could exploit these to cause a denial of \nservice. ([CVE-2015-4803](/security/CVE-2015-4803),\n[CVE-2015-4893](/security/CVE-2015-4893),\n[CVE-2015-4911](/security/CVE-2015-4911))\n\n", "cvss3": {}, "published": "2015-12-03T00:00:00", "type": "ubuntu", "title": "OpenJDK 6 vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4734", "CVE-2015-4893", "CVE-2015-4881", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4911", "CVE-2015-4882", "CVE-2015-4903", "CVE-2015-4883", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4844", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4860"], "modified": "2015-12-03T00:00:00", "id": "USN-2827-1", "href": "https://ubuntu.com/security/notices/USN-2827-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2021-08-03T10:31:55", "description": "Package : openjdk-6\nVersion : 6b37-1.13.9-1~deb6u1\nCVE ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806\n CVE-2015-4835 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844\n CVE-2015-4860 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882\n CVE-2015-4883 CVE-2015-4893 CVE-2015-4903 CVE-2015-4911\n\nSeveral vulnerabilities have been discovered in OpenJDK, an implementation of\nthe Oracle Java platform. These vulnerabilities relate to execution of\narbitrary code, breakouts of the Java sandbox, information disclosure and\ndenial of service.\n\nFor Debian 6 "Squeeze", these problems have been fixed in openjdk-6\nversion 6b37-1.13.9-1~deb6u1.\n\nWe recommend you to upgrade your openjdk-6 packages.\n\nLearn more about the Debian Long Term Support (LTS) Project and how to\napply these updates at: https://wiki.debian.org/LTS/\n", "edition": 14, "cvss3": {}, "published": "2015-11-24T08:57:17", "title": "[SECURITY] [DLA 346-1] openjdk-6 security update", "type": "debian", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4893"], "modified": "2015-11-24T08:57:17", "id": "DEBIAN:DLA-346-1:13970", "href": "https://lists.debian.org/debian-lts-announce/2015/debian-lts-announce-201511/msg00007.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-30T02:21:28", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3381-2 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nNovember 1, 2015 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : openjdk-7\nCVE ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 \n CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843\n CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872\n CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893\n CVE-2015-4903 CVE-2015-4911\n\nSeveral vulnerabilities have been discovered in OpenJDK, an\nimplementation of the Oracle Java platform, resulting in the execution\nof arbitrary code, breakouts of the Java sandbox, information disclosure,\nor denial of service.\n\nThe jessie update in DSA 3381 was built incorrectly, we apologise for\nthe inconvenience. In addition the version number in jessie-security\nwas lower than in wheezy-security which could result in upgrade problems\nduring distribution updates. This has been fixed in 7u85-2.6.1-6~deb8u1.\n\nWe recommend that you upgrade your openjdk-7 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 3, "published": "2015-11-01T22:22:16", "title": "[SECURITY] [DSA 3381-2] openjdk-7 security update", "type": "debian", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4871", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-11-01T22:22:16", "id": "DEBIAN:DSA-3381-2:F5B92", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2015/msg00289.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-03T10:20:18", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3381-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nOctober 27, 2015 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : openjdk-7\nCVE ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 \n CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843\n CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872\n CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893\n CVE-2015-4903 CVE-2015-4911\n\nSeveral vulnerabilities have been discovered in OpenJDK, an\nimplementation of the Oracle Java platform, resulting in the execution\nof arbitrary code, breakouts of the Java sandbox, information disclosure,\nor denial of service.\n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 7u85-2.6.1-6~deb7u1.\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 7u85-2.6.1-5~deb8u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 7u85-2.6.1-5.\n\nWe recommend that you upgrade your openjdk-7 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 16, "cvss3": {}, "published": "2015-10-27T21:21:47", "title": "[SECURITY] [DSA 3381-1] openjdk-7 security update", "type": "debian", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4871", "CVE-2015-4803", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-27T21:21:47", "id": "DEBIAN:DSA-3381-1:4656D", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2015/msg00280.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:47", "description": "- CVE-2015-4734 (information disclosure)\n\nIt was discovered that the JGSS component of OpenJDK did not properly\nhide Kerberos realm information from all error exceptions when running\nunder Security Manager. An untrusted Java application or applet could\nuse this flaw to obtain certain information about the Kerberos\nconfiguration on the host where they were executed, bypassing certain\nJava sandbox restrictions.\n\n- CVE-2015-4803 (denial of service)\n\nIt was discovered that the JAXP component of OpenJDK did not use\nefficient data structures to store data from parsed XML documents. A\nspecially-crafted XML input could cause a Java application using JAXP to\nuse an excessive amount of CPU time by e.g. triggering hash collisions.\n\n- CVE-2015-4805 (arbitrary code execution)\n\nIt was discovered that the ObjectStreamClass in the Serialization\ncomponent of OpenJDK failed to ensure that the object is fully\ninitialized before allowing calls of certain methods. An untrusted Java\napplication or applet could use this flaw to bypass Java sandbox\nrestrictions to execute code.\n\n- CVE-2015-4806 (improper input validation)\n\nA vulnerability has been discovered leading to HttpURLConnection header\nrestriction bypass, allowing remote attackers to affect confidentiality\nand integrity via unknown vectors related to Libraries.\n\n- CVE-2015-4810 (arbitrary code execution)\n\nAn unspecified vulnerability has been discovered that allows local users\nto affect confidentiality, integrity, and availability via unknown\nvectors related to Deployment.\n\n- CVE-2015-4835 (arbitrary code execution)\n\nIt was discovered that the StubGenerator class in the CORBA component of\nOpenJDK failed to generate code with all needed permission checks\nrelated to object (de-)serialization. An untursted Java application or\napplet could use this flaw to bypass Java sandbox restrictions and\nexecute arbitrary code.\n\n- CVE-2015-4840 (information disclosure)\n\nIt was discovered that the 2D component of OpenJDK could perform out of\nbounds access and possibly disclose portions of the Java Virtual Machine\nmemory when processing specially crafted color profiles. The issue was\ncaused by having bundled lcms2 code use fast floor() implementation. An\nuntrusted Java application or applet could use this flaw to bypass\ncertain Java sandbox restrictions.\n\n- CVE-2015-4842 (information disclosure)\n\nAn information disclosure flaw was found in the JAXP component of\nOpenJDK. An untrusted Java application or applet could use this flaw to\nget information about user home directory location (the content of the\n"user.dir" system property), hence bypassing certain Java sandbox\nrestrictions.\n\n- CVE-2015-4843 (arbitrary code execution)\n\nMultiple integer overflow issues were found in the implementation of\nBuffers in the java.nio (Non-blocking I/O) packages in the Libraries\ncomponent of OpenJDK. These could lead to out of bounds buffer access\nand Java Virtual Machine memory corruption. An untursted Java\napplication or applet could use these flaws to run arbitrary code with\nthe Java Virtual Machine privileges or bypass Java sandbox restrictions.\n\n- CVE-2015-4844 (arbitrary code execution)\n\nIt was discovered that ICU Layout Engine was missing multiple boundary\nand error return checks. These could lead to buffer overflows and memory\ncorruption. A specially crafted font file could cause an application\nusing ICU to parse untrusted fonts to crash and, possibly, execute\narbitrary code.\n\n- CVE-2015-4860 (sandbox bypass)\n\nIt was discovered that the DGCImpl (for RMI distributed\ngarbage-collection - DGC) class in the RMI component of OpenJDK failed\nto use restricted access control context when processing untrusted\ninput. An untrusted Java application or applet could use this flaw to\nbypass Java sandbox restrictions.\n\n- CVE-2015-4871 (unknown)\n\nAn unspecified vulnerability has been discovered that allows remote\nattackers to affect confidentiality and integrity via unknown vectors\nrelated to Libraries.\n\n- CVE-2015-4872 (security policy bypass)\n\nIt was discovered that the AlgorithmChecker class in the Security\ncomponent of OpenJDK failed to properly check if a certificate satisfies\nall defined constraints in certain cases. This could cause a Java\napplication to accept an X.509 certificate which does not meet\nrequirements of the policy defined in the java.security file.\n\n- CVE-2015-4881 (sandbox bypass)\n\nIt was discovered that the IIOPInputStream class in the CORBA component\nof OpenJDK failed to properly check object and field types during object\ndeserialization. An untrusted Java application or applet could use this\nflaw to bypass Java sandbox restrictions.\n\n- CVE-2015-4882 (denial of service)\n\nA flaw was found in the way the IIOPInputStream class in the CORBA\ncomponent of OpenJDK performed deserialization of String objects. An\nuntrusted Java application or applet could use this flaw to crash the\nJava Virtual Machine.\n\n- CVE-2015-4883 (sandbox bypass)\n\nIt was discovered that the DGCClient (for RMI distributed\ngarbage-collection - DGC) class in the RMI component of OpenJDK failed\nto use restricted access control context when handling JRMP (Java Remote\nMethod Protocol) messages. An untrusted Java application or applet could\nuse this flaw to bypass Java sandbox restrictions.\n\n- CVE-2015-4893 (denial of service)\n\nIt was discovered that the JAXP component of OpenJDK did not enforce the\nmaximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files.\nA specially crafted XML document could cause a Java application using\nJAXP to consume an excessive amount of memory and CPU time when parsed.\n\n- CVE-2015-4902 (unknown)\n\nAn unspecified vulnerability has been discovered that allows remote\nattackers to affect integrity via unknown vectors related to Deployment.\n\n- CVE-2015-4903 (sandbox bypass)\n\nIt was discovered that the RemoteObjectInvocationHandler class in the\nRMI component of OpenJDK did not check if object proxy is an instance of\na proxy class and that it uses correct invocation handler. An untrusted\nJava application or applet could use this flaw to bypass certain Java\nsandbox restrictions by gaining access to data that should by protected\nby the sandbox.\n\n- CVE-2015-4911 (denial of service)\n\nIt was discovered that the StAX XML parser in the JAXP component of\nOpenJDK could do certain DTD processing even when DTD support was\ndisabled via the javax.xml.stream.supportDTD system property. A\nspecially crafted XML document could cause a Java application using JAXP\nto consume an excessive amount of memory and CPU time when parsed.", "edition": 2, "cvss3": {}, "published": "2015-10-23T00:00:00", "type": "archlinux", "title": "jdk7-openjdk: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4871", "CVE-2015-4803", "CVE-2015-4902", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4810", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-23T00:00:00", "id": "ASA-201510-15", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-October/000417.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-02T18:44:46", "description": "- CVE-2015-4734 (information disclosure)\n\nIt was discovered that the JGSS component of OpenJDK did not properly\nhide Kerberos realm information from all error exceptions when running\nunder Security Manager. An untrusted Java application or applet could\nuse this flaw to obtain certain information about the Kerberos\nconfiguration on the host where they were executed, bypassing certain\nJava sandbox restrictions.\n\n- CVE-2015-4803 (denial of service)\n\nIt was discovered that the JAXP component of OpenJDK did not use\nefficient data structures to store data from parsed XML documents. A\nspecially-crafted XML input could cause a Java application using JAXP to\nuse an excessive amount of CPU time by e.g. triggering hash collisions.\n\n- CVE-2015-4805 (arbitrary code execution)\n\nIt was discovered that the ObjectStreamClass in the Serialization\ncomponent of OpenJDK failed to ensure that the object is fully\ninitialized before allowing calls of certain methods. An untrusted Java\napplication or applet could use this flaw to bypass Java sandbox\nrestrictions to execute code.\n\n- CVE-2015-4806 (improper input validation)\n\nA vulnerability has been discovered leading to HttpURLConnection header\nrestriction bypass, allowing remote attackers to affect confidentiality\nand integrity via unknown vectors related to Libraries.\n\n- CVE-2015-4810 (arbitrary code execution)\n\nAn unspecified vulnerability has been discovered that allows local users\nto affect confidentiality, integrity, and availability via unknown\nvectors related to Deployment.\n\n- CVE-2015-4835 (arbitrary code execution)\n\nIt was discovered that the StubGenerator class in the CORBA component of\nOpenJDK failed to generate code with all needed permission checks\nrelated to object (de-)serialization. An untursted Java application or\napplet could use this flaw to bypass Java sandbox restrictions and\nexecute arbitrary code.\n\n- CVE-2015-4840 (information disclosure)\n\nIt was discovered that the 2D component of OpenJDK could perform out of\nbounds access and possibly disclose portions of the Java Virtual Machine\nmemory when processing specially crafted color profiles. The issue was\ncaused by having bundled lcms2 code use fast floor() implementation. An\nuntrusted Java application or applet could use this flaw to bypass\ncertain Java sandbox restrictions.\n\n- CVE-2015-4842 (information disclosure)\n\nAn information disclosure flaw was found in the JAXP component of\nOpenJDK. An untrusted Java application or applet could use this flaw to\nget information about user home directory location (the content of the\n"user.dir" system property), hence bypassing certain Java sandbox\nrestrictions.\n\n- CVE-2015-4843 (arbitrary code execution)\n\nMultiple integer overflow issues were found in the implementation of\nBuffers in the java.nio (Non-blocking I/O) packages in the Libraries\ncomponent of OpenJDK. These could lead to out of bounds buffer access\nand Java Virtual Machine memory corruption. An untursted Java\napplication or applet could use these flaws to run arbitrary code with\nthe Java Virtual Machine privileges or bypass Java sandbox restrictions.\n\n- CVE-2015-4844 (arbitrary code execution)\n\nIt was discovered that ICU Layout Engine was missing multiple boundary\nand error return checks. These could lead to buffer overflows and memory\ncorruption. A specially crafted font file could cause an application\nusing ICU to parse untrusted fonts to crash and, possibly, execute\narbitrary code.\n\n- CVE-2015-4860 (sandbox bypass)\n\nIt was discovered that the DGCImpl (for RMI distributed\ngarbage-collection - DGC) class in the RMI component of OpenJDK failed\nto use restricted access control context when processing untrusted\ninput. An untrusted Java application or applet could use this flaw to\nbypass Java sandbox restrictions.\n\n- CVE-2015-4871 (unknown)\n\nAn unspecified vulnerability has been discovered that allows remote\nattackers to affect confidentiality and integrity via unknown vectors\nrelated to Libraries.\n\n- CVE-2015-4872 (security policy bypass)\n\nIt was discovered that the AlgorithmChecker class in the Security\ncomponent of OpenJDK failed to properly check if a certificate satisfies\nall defined constraints in certain cases. This could cause a Java\napplication to accept an X.509 certificate which does not meet\nrequirements of the policy defined in the java.security file.\n\n- CVE-2015-4881 (sandbox bypass)\n\nIt was discovered that the IIOPInputStream class in the CORBA component\nof OpenJDK failed to properly check object and field types during object\ndeserialization. An untrusted Java application or applet could use this\nflaw to bypass Java sandbox restrictions.\n\n- CVE-2015-4882 (denial of service)\n\nA flaw was found in the way the IIOPInputStream class in the CORBA\ncomponent of OpenJDK performed deserialization of String objects. An\nuntrusted Java application or applet could use this flaw to crash the\nJava Virtual Machine.\n\n- CVE-2015-4883 (sandbox bypass)\n\nIt was discovered that the DGCClient (for RMI distributed\ngarbage-collection - DGC) class in the RMI component of OpenJDK failed\nto use restricted access control context when handling JRMP (Java Remote\nMethod Protocol) messages. An untrusted Java application or applet could\nuse this flaw to bypass Java sandbox restrictions.\n\n- CVE-2015-4893 (denial of service)\n\nIt was discovered that the JAXP component of OpenJDK did not enforce the\nmaximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files.\nA specially crafted XML document could cause a Java application using\nJAXP to consume an excessive amount of memory and CPU time when parsed.\n\n- CVE-2015-4902 (unknown)\n\nAn unspecified vulnerability has been discovered that allows remote\nattackers to affect integrity via unknown vectors related to Deployment.\n\n- CVE-2015-4903 (sandbox bypass)\n\nIt was discovered that the RemoteObjectInvocationHandler class in the\nRMI component of OpenJDK did not check if object proxy is an instance of\na proxy class and that it uses correct invocation handler. An untrusted\nJava application or applet could use this flaw to bypass certain Java\nsandbox restrictions by gaining access to data that should by protected\nby the sandbox.\n\n- CVE-2015-4911 (denial of service)\n\nIt was discovered that the StAX XML parser in the JAXP component of\nOpenJDK could do certain DTD processing even when DTD support was\ndisabled via the javax.xml.stream.supportDTD system property. A\nspecially crafted XML document could cause a Java application using JAXP\nto consume an excessive amount of memory and CPU time when parsed.", "edition": 2, "cvss3": {}, "published": "2015-10-23T00:00:00", "type": "archlinux", "title": "jre7-openjdk-headless: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4871", "CVE-2015-4803", "CVE-2015-4902", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4810", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-23T00:00:00", "id": "ASA-201510-17", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-October/000419.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-02T18:44:44", "description": "- CVE-2015-4734 (information disclosure)\n\nIt was discovered that the JGSS component of OpenJDK did not properly\nhide Kerberos realm information from all error exceptions when running\nunder Security Manager. An untrusted Java application or applet could\nuse this flaw to obtain certain information about the Kerberos\nconfiguration on the host where they were executed, bypassing certain\nJava sandbox restrictions.\n\n- CVE-2015-4803 (denial of service)\n\nIt was discovered that the JAXP component of OpenJDK did not use\nefficient data structures to store data from parsed XML documents. A\nspecially-crafted XML input could cause a Java application using JAXP to\nuse an excessive amount of CPU time by e.g. triggering hash collisions.\n\n- CVE-2015-4805 (arbitrary code execution)\n\nIt was discovered that the ObjectStreamClass in the Serialization\ncomponent of OpenJDK failed to ensure that the object is fully\ninitialized before allowing calls of certain methods. An untrusted Java\napplication or applet could use this flaw to bypass Java sandbox\nrestrictions to execute code.\n\n- CVE-2015-4806 (improper input validation)\n\nA vulnerability has been discovered leading to HttpURLConnection header\nrestriction bypass, allowing remote attackers to affect confidentiality\nand integrity via unknown vectors related to Libraries.\n\n- CVE-2015-4810 (arbitrary code execution)\n\nAn unspecified vulnerability has been discovered that allows local users\nto affect confidentiality, integrity, and availability via unknown\nvectors related to Deployment.\n\n- CVE-2015-4835 (arbitrary code execution)\n\nIt was discovered that the StubGenerator class in the CORBA component of\nOpenJDK failed to generate code with all needed permission checks\nrelated to object (de-)serialization. An untursted Java application or\napplet could use this flaw to bypass Java sandbox restrictions and\nexecute arbitrary code.\n\n- CVE-2015-4840 (information disclosure)\n\nIt was discovered that the 2D component of OpenJDK could perform out of\nbounds access and possibly disclose portions of the Java Virtual Machine\nmemory when processing specially crafted color profiles. The issue was\ncaused by having bundled lcms2 code use fast floor() implementation. An\nuntrusted Java application or applet could use this flaw to bypass\ncertain Java sandbox restrictions.\n\n- CVE-2015-4842 (information disclosure)\n\nAn information disclosure flaw was found in the JAXP component of\nOpenJDK. An untrusted Java application or applet could use this flaw to\nget information about user home directory location (the content of the\n"user.dir" system property), hence bypassing certain Java sandbox\nrestrictions.\n\n- CVE-2015-4843 (arbitrary code execution)\n\nMultiple integer overflow issues were found in the implementation of\nBuffers in the java.nio (Non-blocking I/O) packages in the Libraries\ncomponent of OpenJDK. These could lead to out of bounds buffer access\nand Java Virtual Machine memory corruption. An untursted Java\napplication or applet could use these flaws to run arbitrary code with\nthe Java Virtual Machine privileges or bypass Java sandbox restrictions.\n\n- CVE-2015-4844 (arbitrary code execution)\n\nIt was discovered that ICU Layout Engine was missing multiple boundary\nand error return checks. These could lead to buffer overflows and memory\ncorruption. A specially crafted font file could cause an application\nusing ICU to parse untrusted fonts to crash and, possibly, execute\narbitrary code.\n\n- CVE-2015-4860 (sandbox bypass)\n\nIt was discovered that the DGCImpl (for RMI distributed\ngarbage-collection - DGC) class in the RMI component of OpenJDK failed\nto use restricted access control context when processing untrusted\ninput. An untrusted Java application or applet could use this flaw to\nbypass Java sandbox restrictions.\n\n- CVE-2015-4871 (unknown)\n\nAn unspecified vulnerability has been discovered that allows remote\nattackers to affect confidentiality and integrity via unknown vectors\nrelated to Libraries.\n\n- CVE-2015-4872 (security policy bypass)\n\nIt was discovered that the AlgorithmChecker class in the Security\ncomponent of OpenJDK failed to properly check if a certificate satisfies\nall defined constraints in certain cases. This could cause a Java\napplication to accept an X.509 certificate which does not meet\nrequirements of the policy defined in the java.security file.\n\n- CVE-2015-4881 (sandbox bypass)\n\nIt was discovered that the IIOPInputStream class in the CORBA component\nof OpenJDK failed to properly check object and field types during object\ndeserialization. An untrusted Java application or applet could use this\nflaw to bypass Java sandbox restrictions.\n\n- CVE-2015-4882 (denial of service)\n\nA flaw was found in the way the IIOPInputStream class in the CORBA\ncomponent of OpenJDK performed deserialization of String objects. An\nuntrusted Java application or applet could use this flaw to crash the\nJava Virtual Machine.\n\n- CVE-2015-4883 (sandbox bypass)\n\nIt was discovered that the DGCClient (for RMI distributed\ngarbage-collection - DGC) class in the RMI component of OpenJDK failed\nto use restricted access control context when handling JRMP (Java Remote\nMethod Protocol) messages. An untrusted Java application or applet could\nuse this flaw to bypass Java sandbox restrictions.\n\n- CVE-2015-4893 (denial of service)\n\nIt was discovered that the JAXP component of OpenJDK did not enforce the\nmaximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files.\nA specially crafted XML document could cause a Java application using\nJAXP to consume an excessive amount of memory and CPU time when parsed.\n\n- CVE-2015-4902 (unknown)\n\nAn unspecified vulnerability has been discovered that allows remote\nattackers to affect integrity via unknown vectors related to Deployment.\n\n- CVE-2015-4903 (sandbox bypass)\n\nIt was discovered that the RemoteObjectInvocationHandler class in the\nRMI component of OpenJDK did not check if object proxy is an instance of\na proxy class and that it uses correct invocation handler. An untrusted\nJava application or applet could use this flaw to bypass certain Java\nsandbox restrictions by gaining access to data that should by protected\nby the sandbox.\n\n- CVE-2015-4911 (denial of service)\n\nIt was discovered that the StAX XML parser in the JAXP component of\nOpenJDK could do certain DTD processing even when DTD support was\ndisabled via the javax.xml.stream.supportDTD system property. A\nspecially crafted XML document could cause a Java application using JAXP\nto consume an excessive amount of memory and CPU time when parsed.", "edition": 2, "cvss3": {}, "published": "2015-10-23T00:00:00", "type": "archlinux", "title": "jre7-openjdk: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4871", "CVE-2015-4803", "CVE-2015-4902", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4810", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-10-23T00:00:00", "id": "ASA-201510-16", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-October/000418.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "f5": [{"lastseen": "2017-06-08T00:16:30", "edition": 2, "description": "\nF5 Product Development has assigned INSTALLER-1945 (Traffix) to this vulnerability, and has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP AAM| None| 12.0.0 \n11.4.0 - 11.6.0| Not vulnerable| None \nBIG-IP AFM| None| 12.0.0 \n11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP Analytics| None| 12.0.0 \n11.0.0 - 11.6.0| Not vulnerable| None \nBIG-IP APM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP ASM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP DNS| None| 12.0.0| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP GTM| None| 11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP Link Controller| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP PEM| None| 12.0.0 \n11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP PSM| None| 11.0.0 - 11.4.1 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP WOM| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nARX| None| 6.0.0 - 6.4.0| Not vulnerable| None \nEnterprise Manager| None| 3.0.0 - 3.1.1| Not vulnerable| None \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| Not vulnerable| None \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.2.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nLineRate| None| 2.5.0 - 2.6.1| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| 4.0.0 - 4.4.0 \n3.3.2 - 3.5.1| None| Low| Java\n\nIf you are running a version listed in the **Versions known to be vulnerable **column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable **column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nF5 responds to vulnerabilities in accordance with the** Severity** values published in the previous table. The **Severity **values and other security vulnerability parameters are defined in [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>).\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n", "cvss3": {}, "published": "2015-11-21T01:04:00", "title": "Java vulnerability CVE-2015-4803", "type": "f5", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4803", "CVE-2015-4911", "CVE-2015-4893"], "modified": "2016-01-09T02:33:00", "href": "https://support.f5.com/csp/article/K05534090", "id": "F5:K05534090", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-06-08T00:16:23", "edition": 2, "description": "\nF5 Product Development has assigned INSTALLER-1947 (Traffix SDC) to this vulnerability, and has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP AAM| None| 12.0.0 \n11.4.0 - 11.6.0| Not vulnerable| None \nBIG-IP AFM| None| 12.0.0 \n11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP Analytics| None| 12.0.0 \n11.0.0 - 11.6.0| Not vulnerable| None \nBIG-IP APM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP ASM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP DNS| None| 12.0.0| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP GTM| None| 11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP Link Controller| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP PEM| None| 12.0.0 \n11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP PSM| None| 11.0.0 - 11.4.1 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP WOM| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nARX| None| 6.0.0 - 6.4.0| Not vulnerable| None \nEnterprise Manager| None| 3.0.0 - 3.1.1| Not vulnerable| None \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| Not vulnerable| None \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.2.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nLineRate| None| 2.5.0 - 2.6.1| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| 4.0.0 - 4.4.0 \n3.3.2 - 3.5.1| None| Low| None\n\nIf you are running a version listed in the** Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable **column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n", "cvss3": {}, "published": "2015-11-21T01:15:00", "type": "f5", "title": "Java vulnerability CVE-2015-4893", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4803", "CVE-2015-4911", "CVE-2015-4893"], "modified": "2016-12-01T20:07:00", "href": "https://support.f5.com/csp/article/K14132811", "id": "F5:K14132811", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2021-06-08T19:14:50", "edition": 3, "description": "Vulnerability Recommended Actions\n\nIf you are running a version listed in the **Versions known to be vulnerable **column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable **column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nF5 responds to vulnerabilities in accordance with the** Severity** values published in the previous table. The **Severity **values and other security vulnerability parameters are defined in SOL4602: Overview of the F5 security vulnerability response policy.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n", "cvss3": {}, "published": "2015-11-20T00:00:00", "title": "SOL05534090 - Java vulnerability CVE-2015-4803", "type": "f5", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4803", "CVE-2015-4911", "CVE-2015-4893"], "modified": "2015-11-20T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/k/05/sol05534090.html", "id": "SOL05534090", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2021-06-08T19:14:50", "edition": 3, "description": "Vulnerability Recommended Actions\n\nIf you are running a version listed in the** Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable **column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n", "cvss3": {}, "published": "2015-11-20T00:00:00", "title": "SOL14132811 - Java vulnerability CVE-2015-4893", "type": "f5", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4803", "CVE-2015-4911", "CVE-2015-4893"], "modified": "2016-12-01T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/k/14/sol14132811.html", "id": "SOL14132811", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "aix": [{"lastseen": "2021-07-28T14:31:29", "description": "IBM SECURITY ADVISORY\n\nFirst Issued: Thu Dec 10 08:51:54 CST 2015\n\n\nThe most recent version of this document is available here:\n\nhttp://aix.software.ibm.com/aix/efixes/security/java_oct2015_advisory.asc\nhttps://aix.software.ibm.com/aix/efixes/security/java_oct2015_advisory.asc\nftp://aix.software.ibm.com/aix/efixes/security/java_oct2015_advisory.asc\n\n \nSecurity Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX\n CVE-2015-4844 CVE-2015-4843 CVE-2015-4805 CVE-2015-4860 CVE-2015-4883\n CVE-2015-4835 CVE-2015-4810 CVE-2015-4806 CVE-2015-4871 CVE-2015-4902\n CVE-2015-4872 CVE-2015-4911 CVE-2015-4893 CVE-2015-4840 CVE-2015-4842\n CVE-2015-4882 CVE-2015-4903 CVE-2015-4803 CVE-2015-4734 CVE-2015-5006 \n\n\n===============================================================================\n\nSUMMARY:\n\n There are multiple vulnerabilities in IBM SDK Java Technology Edition,\n Versions 5, 6, 7, 7.1, 8 that are used by AIX. These issues were disclosed\n as part of the IBM Java SDK updates in October 2015.\n\n\n===============================================================================\n\nVULNERABILITY DETAILS:\n\n CVEID: CVE-2015-4844\n DESCRIPTION: An unspecified vulnerability related to the 2D component has\n complete confidentiality impact, complete integrity impact, and\n complete availability impact.\n CVSS Base Score: 10\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107346 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4843\n DESCRIPTION: An unspecified vulnerability related to the Libraries\n component has complete confidentiality impact, complete integrity\n impact, and complete availability impact.\n CVSS Base Score: 10\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107342 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4805\n DESCRIPTION: An unspecified vulnerability related to the Serialization\n component has complete confidentiality impact, complete integrity\n impact, and complete availability impact.\n CVSS Base Score: 10\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107345 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4860\n DESCRIPTION: An unspecified vulnerability related to the RMI component has\n complete confidentiality impact, complete integrity impact, and\n complete availability impact.\n CVSS Base Score: 10\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107344 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4883\n DESCRIPTION: An unspecified vulnerability related to the RMI component has\n complete confidentiality impact, complete integrity impact, and\n complete availability impact.\n CVSS Base Score: 10\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107343 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4835\n DESCRIPTION: An unspecified vulnerability related to the CORBA component\n has complete confidentiality impact, complete integrity impact, and\n complete availability impact.\n CVSS Base Score: 10\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107340 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4810\n DESCRIPTION: An unspecified vulnerability related to the Deployment\n component has complete confidentiality impact, complete integrity\n impact, and complete availability impact.\n CVSS Base Score: 6.9\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107349 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)\n\n CVEID: CVE-2015-4806\n DESCRIPTION: An unspecified vulnerability related to the Libraries\n component has partial confidentiality impact, partial integrity impact,\n and no availability impact.\n CVSS Base Score: 6.4\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107350 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N)\n\n CVEID: CVE-2015-4871\n DESCRIPTION: An unspecified vulnerability related to the Libraries\n component has partial confidentiality impact, partial integrity impact,\n and no availability impact.\n CVSS Base Score: 5.8\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107351 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)\n\n CVEID: CVE-2015-4902\n DESCRIPTION: An unspecified vulnerability related to the Deployment\n component has no confidentiality impact, partial integrity impact, and\n no availability impact.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107352 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)\n\n CVEID: CVE-2015-4872\n DESCRIPTION: An unspecified vulnerability related to the Security\n component has no confidentiality impact, partial integrity impact,\n and no availability impact.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107361 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)\n\n CVEID: CVE-2015-4911\n DESCRIPTION: An unspecified vulnerability related to the JAXP component\n could allow a remote attacker to cause a denial of service.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107360 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n CVEID: CVE-2015-4893\n DESCRIPTION: An unspecified vulnerability related to the JAXP component\n could allow a remote attacker to cause a denial of service.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107359 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n CVEID: CVE-2015-4840\n DESCRIPTION: An unspecified vulnerability related to the 2D component\n could allow a remote attacker to obtain sensitive information.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107353 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)\n\n CVEID: CVE-2015-4842\n DESCRIPTION: An unspecified vulnerability related to the JAXP component\n could allow a remote attacker to obtain sensitive information.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107355 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)\n\n CVEID: CVE-2015-4882\n DESCRIPTION: An unspecified vulnerability related to the CORBA component\n could allow a remote attacker to cause a denial of service.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107354 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n CVEID: CVE-2015-4903\n DESCRIPTION: An unspecified vulnerability related to the RMI component\n could allow a remote attacker to obtain sensitive information.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107357 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)\n\n CVEID: CVE-2015-4803\n DESCRIPTION: An unspecified vulnerability related to the JAXP component\n could allow a remote attacker to cause a denial of service.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107358 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n CVEID: CVE-2015-4734\n DESCRIPTION: An unspecified vulnerability related to the JGSS component\n could allow a remote attacker to obtain sensitive information.\n CVSS Base Score: 5\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/107356 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)\n\n CVEID: CVE-2015-5006\n DESCRIPTION: IBM Java Security Components could allow an attacker with\n physical access to the system to obtain sensitive information from the\n Kerberos Credential Cache.\n CVSS Base Score: 4.6\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/106309 for the\n current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)\n\n\n AFFECTED PRODUCTS AND VERSIONS:\n \n AIX 5.3, 6.1, 7.1, 7.2\n VIOS 2.2.x\n\n The following fileset levels (VRMF) are vulnerable, if the \n respective Java version is installed:\n For Java5: Less than 5.0.0.620\n For Java6: Less than 6.0.0.510\n For Java7: Less than 7.0.0.270\n For Java7.1: Less than 7.1.0.150\n For Java8: Less than 8.0.0.70\n\n Note: to find out whether the affected Java filesets are installed \n on your systems, refer to the lslpp command found in AIX user's guide.\n\n Example: lslpp -L | grep -i java\n\n\n REMEDIATION:\n\n IBM SDK, Java 2 Technology Edition, Version 5.0 Service Refresh 16 \n Fix Pack 14 and subsequent releases:\n 32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=5.0.0.0&platform=AIX+32-bit,+pSeries&function=all\n 64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=5.0.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix \n Pack 15 and subsequent releases:\n 32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=6.0.0.0&platform=AIX+32-bit,+pSeries&function=all\n 64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=6.0.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 Fix\n Pack 20 and subsequent releases:\n 32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+32-bit,+pSeries&function=all \n 64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n IBM SDK, Java Technology Edition, Version 7R1 Service Refresh 3\n Fix Pack 20 and subsequent releases:\n 32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+32-bit,+pSeries&function=all\n 64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+64-bit,+pSeries&function=all \n\n IBM SDK, Java Technology Edition, Version 8 Service Refresh 2\n and subsequent releases:\n 32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+32-bit,+pSeries&function=all \n 64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n Note regarding CVE-2015-4911\n This was addressed by IBM in June 2008. As a reminder, users of Java 6\n and above should refer to the IBM XL XP-J documentation for the\n javax.xml.stream.supportDTD property for information to help avoid this\n vulnerability.\n\n\n WORKAROUNDS AND MITIGATIONS:\n\n None.\n\n\n===============================================================================\n\nCONTACT US:\n\n If you would like to receive AIX Security Advisories via email,\n please visit \"My Notifications\":\n\n http://www.ibm.com/support/mynotifications\n\n To view previously issued advisories, please visit:\n\n http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n \n Comments regarding the content of this announcement can be\n directed to:\n\n security-alert@austin.ibm.com\n\n To obtain the OpenSSL public key that can be used to verify the\n signed advisories and ifixes:\n\n Download the key from our web page:\n\n http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt\n\n To obtain the PGP public key that can be used to communicate\n securely with the AIX Security Team via security-alert@austin.ibm.com you\n can either:\n\n A. Download the key from our web page:\n\nhttp://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt\n\n B. Download the key from a PGP Public Key Server. The key ID is:\n\n 0x28BFAA12\n\n Please contact your local IBM AIX support center for any\n assistance.\n\n\nREFERENCES:\n \n Complete CVSS v2 Guide:\n http://www.first.org/cvss/v2/guide \n On-line Calculator v2:\n http://nvd.nist.gov/CVSS-v2-Calculator \n Complete CVSS v3 Guide:\n http://www.first.org/cvss/user-guide \n On-line Calculator v3:\n http://www.first.org/cvss/calculator/3.0 \n IBM Java SDK Security Bulletin: \n http://www-01.ibm.com/support/docview.wss?uid=swg21969225\n\nACKNOWLEDGEMENTS:\n\n None.\n\n\nCHANGE HISTORY:\n\n First Issued: Thu Dec 10 08:51:54 CST 2015 \n\n===============================================================================\n\n*The CVSS Environment Score is customer environment specific and will \nultimately impact the Overall CVSS Score. Customers can evaluate the impact \nof this vulnerability in their environments by accessing the links in the \nReference section of this Security Bulletin. \n\nDisclaimer\nAccording to the Forum of Incident Response and Security Teams (FIRST), the \nCommon Vulnerability Scoring System (CVSS) is an \"industry open standard \ndesigned to convey vulnerability severity and help to determine urgency and \npriority of response.\" IBM PROVIDES THE CVSS SCORES \"AS IS\" WITHOUT WARRANTY \nOF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS \nFOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT \nOF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.\n\n \n\n", "edition": 5, "cvss3": {}, "published": "2015-12-10T08:51:54", "title": "Multiple vulnerabilities in IBM Java SDK affect AIX", "type": "aix", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-5006", "CVE-2015-4860", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-4883", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-4871", "CVE-2015-4803", "CVE-2015-4902", "CVE-2015-4805", "CVE-2015-4806", "CVE-2015-4810", "CVE-2015-4835", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4840", "CVE-2015-4893"], "modified": "2015-12-10T08:51:54", "id": "JAVA_OCT2015_ADVISORY.ASC", "href": "https://aix.software.ibm.com/aix/efixes/security/java_oct2015_advisory.asc", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
