Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.882656
Category:CentOS Local Security Checks
Title:CentOS Update for java CESA-2017:0269 centos7
Summary:Check the version of java
Description:Summary:
Check the version of java

Vulnerability Insight:
The java-1.7.0-openjdk packages provide the
OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es):

* It was discovered that the RMI registry and DCG implementations in the
RMI component of OpenJDK performed deserialization of untrusted inputs. A
remote attacker could possibly use this flaw to execute arbitrary code with
the privileges of RMI registry or a Java RMI application. (CVE-2017-3241)

This issue was addressed by introducing whitelists of classes that can be
deserialized by RMI registry or DCG. These whitelists can be customized
using the newly introduced sun.rmi.registry.registryFilter and
sun.rmi.transport.dgcFilter security properties.

* Multiple flaws were discovered in the Libraries and Hotspot components in
OpenJDK. An untrusted Java application or applet could use these flaws to
completely bypass Java sandbox restrictions. (CVE-2017-3272, CVE-2017-3289)

* A covert timing channel flaw was found in the DSA implementation in the
Libraries component of OpenJDK. A remote attacker could possibly use this
flaw to extract certain information about the used key via a timing side
channel. (CVE-2016-5548)

* It was discovered that the Libraries component of OpenJDK accepted ECSDA
signatures using non-canonical DER encoding. This could cause a Java
application to accept signature in an incorrect format not accepted by
other cryptographic tools. (CVE-2016-5546)

* It was discovered that the 2D component of OpenJDK performed parsing of
iTXt and zTXt PNG image chunks even when configured to ignore metadata. An
attacker able to make a Java application parse a specially crafted PNG
image could cause the application to consume an excessive amount of memory.
(CVE-2017-3253)

* It was discovered that the Libraries component of OpenJDK did not
validate the length of the object identifier read from the DER input before
allocating memory to store the OID. An attacker able to make a Java
application decode a specially crafted DER input could cause the
application to consume an excessive amount of memory. (CVE-2016-5547)

* It was discovered that the JAAS component of OpenJDK did not use the
correct way to extract user DN from the result of the user search LDAP
query. A specially crafted user LDAP entry could cause the application to
use an incorrect DN. (CVE-2017-3252)

* It was discovered that the Networking component of OpenJDK failed to
properly parse user info from the URL. A remote attacker could cause a Java
application to incorrectly parse an attacker supplied URL and interpret it
differently from other applications processing the same URL.
(CVE-2016- ...

Description truncated, please see the referenced URL(s) for more information.

Affected Software/OS:
java on CentOS 7

Solution:
Please Install the Updated Packages.

CVSS Score:
6.8

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2016-5546
BugTraq ID: 95506
http://www.securityfocus.com/bid/95506
Debian Security Information: DSA-3782 (Google Search)
http://www.debian.org/security/2017/dsa-3782
https://security.gentoo.org/glsa/201701-65
https://security.gentoo.org/glsa/201707-01
RedHat Security Advisories: RHSA-2017:0175
http://rhn.redhat.com/errata/RHSA-2017-0175.html
RedHat Security Advisories: RHSA-2017:0176
http://rhn.redhat.com/errata/RHSA-2017-0176.html
RedHat Security Advisories: RHSA-2017:0177
http://rhn.redhat.com/errata/RHSA-2017-0177.html
RedHat Security Advisories: RHSA-2017:0180
http://rhn.redhat.com/errata/RHSA-2017-0180.html
RedHat Security Advisories: RHSA-2017:0263
http://rhn.redhat.com/errata/RHSA-2017-0263.html
RedHat Security Advisories: RHSA-2017:0269
http://rhn.redhat.com/errata/RHSA-2017-0269.html
RedHat Security Advisories: RHSA-2017:0336
http://rhn.redhat.com/errata/RHSA-2017-0336.html
RedHat Security Advisories: RHSA-2017:0337
http://rhn.redhat.com/errata/RHSA-2017-0337.html
RedHat Security Advisories: RHSA-2017:0338
http://rhn.redhat.com/errata/RHSA-2017-0338.html
RedHat Security Advisories: RHSA-2017:1216
https://access.redhat.com/errata/RHSA-2017:1216
http://www.securitytracker.com/id/1037637
Common Vulnerability Exposure (CVE) ID: CVE-2016-5547
BugTraq ID: 95521
http://www.securityfocus.com/bid/95521
Common Vulnerability Exposure (CVE) ID: CVE-2016-5548
BugTraq ID: 95559
http://www.securityfocus.com/bid/95559
Common Vulnerability Exposure (CVE) ID: CVE-2016-5552
BugTraq ID: 95512
http://www.securityfocus.com/bid/95512
http://www.securitytracker.com/id/1037798
Common Vulnerability Exposure (CVE) ID: CVE-2017-3231
BugTraq ID: 95563
http://www.securityfocus.com/bid/95563
Common Vulnerability Exposure (CVE) ID: CVE-2017-3241
BugTraq ID: 95488
http://www.securityfocus.com/bid/95488
https://www.exploit-db.com/exploits/41145/
https://erpscan.io/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/
Common Vulnerability Exposure (CVE) ID: CVE-2017-3252
BugTraq ID: 95509
http://www.securityfocus.com/bid/95509
Common Vulnerability Exposure (CVE) ID: CVE-2017-3253
BugTraq ID: 95498
http://www.securityfocus.com/bid/95498
Common Vulnerability Exposure (CVE) ID: CVE-2017-3261
BugTraq ID: 95566
http://www.securityfocus.com/bid/95566
Common Vulnerability Exposure (CVE) ID: CVE-2017-3272
BugTraq ID: 95533
http://www.securityfocus.com/bid/95533
Common Vulnerability Exposure (CVE) ID: CVE-2017-3289
BugTraq ID: 95525
http://www.securityfocus.com/bid/95525
Common Vulnerability Exposure (CVE) ID: CVE-2016-2183
BugTraq ID: 92630
http://www.securityfocus.com/bid/92630
BugTraq ID: 95568
http://www.securityfocus.com/bid/95568
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697
http://www-01.ibm.com/support/docview.wss?uid=swg21991482
http://www-01.ibm.com/support/docview.wss?uid=swg21995039
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
http://www.splunk.com/view/SP-CAAAPSV
http://www.splunk.com/view/SP-CAAAPUE
https://access.redhat.com/articles/2548661
https://access.redhat.com/security/cve/cve-2016-2183
https://bto.bluecoat.com/security-advisory/sa133
https://bugzilla.redhat.com/show_bug.cgi?id=1369383
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
https://kc.mcafee.com/corporate/index?page=content&id=SB10171
https://kc.mcafee.com/corporate/index?page=content&id=SB10310
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
https://security.netapp.com/advisory/ntap-20160915-0001/
https://security.netapp.com/advisory/ntap-20170119-0001/
https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008
https://www.openssl.org/blog/blog/2016/08/24/sweet32/
https://www.tenable.com/security/tns-2016-16
https://www.tenable.com/security/tns-2016-20
https://www.tenable.com/security/tns-2016-21
https://www.tenable.com/security/tns-2017-09
https://security.gentoo.org/glsa/201612-16
https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/
https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/
https://sweet32.info/
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.sigsac.org/ccs/CCS2016/accepted-papers/
https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue
https://www.ietf.org/mail-archive/web/tls/current/msg04560.html
RedHat Security Advisories: RHSA-2017:0462
http://rhn.redhat.com/errata/RHSA-2017-0462.html
RedHat Security Advisories: RHSA-2017:2708
https://access.redhat.com/errata/RHSA-2017:2708
RedHat Security Advisories: RHSA-2017:2709
https://access.redhat.com/errata/RHSA-2017:2709
RedHat Security Advisories: RHSA-2017:2710
https://access.redhat.com/errata/RHSA-2017:2710
RedHat Security Advisories: RHSA-2017:3113
https://access.redhat.com/errata/RHSA-2017:3113
RedHat Security Advisories: RHSA-2017:3114
https://access.redhat.com/errata/RHSA-2017:3114
RedHat Security Advisories: RHSA-2017:3239
https://access.redhat.com/errata/RHSA-2017:3239
RedHat Security Advisories: RHSA-2017:3240
https://access.redhat.com/errata/RHSA-2017:3240
RedHat Security Advisories: RHSA-2018:2123
https://access.redhat.com/errata/RHSA-2018:2123
RedHat Security Advisories: RHSA-2019:1245
https://access.redhat.com/errata/RHSA-2019:1245
RedHat Security Advisories: RHSA-2019:2859
https://access.redhat.com/errata/RHSA-2019:2859
RedHat Security Advisories: RHSA-2020:0451
https://access.redhat.com/errata/RHSA-2020:0451
http://www.securitytracker.com/id/1036696
SuSE Security Announcement: SUSE-SU-2016:2470 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
CopyrightCopyright (C) 2017 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.