| Description: | Summary:
The remote host is missing an update for the 'java-1_7_0-ibm'
package(s) announced via the referenced advisory.
Vulnerability Insight:
java-1_7_0-ibm was updated to version 1.7.0_sr7.3 to fix 37 security
issues:
* CVE-2014-8891: Unspecified vulnerability (bnc#916266)
* CVE-2014-8892: Unspecified vulnerability (bnc#916265)
* CVE-2014-3065: Unspecified vulnerability in IBM Java Runtime
Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0),
6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and
before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary
code via vectors related to the shared classes cache (bnc#904889).
* CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through
1.0.1i and other products, uses nondeterministic CBC padding, which
makes it easier for man-in-the-middle attackers to obtain cleartext
data via a padding-oracle attack, aka the 'POODLE' issue
(bnc#901223).
* CVE-2014-6513: Unspecified vulnerability in Oracle Java SE 6u81,
7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers
to affect confidentiality, integrity, and availability via vectors
related to AWT (bnc#901239).
* CVE-2014-6456: Unspecified vulnerability in Oracle Java SE 7u67 and
8u20 allows remote attackers to affect confidentiality, integrity,
and availability via unknown vectors (bnc#901239).
* CVE-2014-6503: Unspecified vulnerability in Oracle Java SE 6u81,
7u67, and 8u20 allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to
Deployment, a different vulnerability than CVE-2014-4288,
CVE-2014-6493, and CVE-2014-6532 (bnc#901239).
* CVE-2014-6532: Unspecified vulnerability in Oracle Java SE 6u81,
7u67, and 8u20 allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to
Deployment, a different vulnerability than CVE-2014-4288,
CVE-2014-6493, and CVE-2014-6503 (bnc#901239).
* CVE-2014-4288: Unspecified vulnerability in Oracle Java SE 6u81,
7u67, and 8u20 allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to
Deployment, a different vulnerability than CVE-2014-6493,
CVE-2014-6503, and CVE-2014-6532 (bnc#901239).
* CVE-2014-6493: Unspecified vulnerability in Oracle Java SE 6u81,
7u67, and 8u20 allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to
Deployment, a different vulnerability than CVE-2014-4288,
CVE-2014-6503, and CVE-2014-6532 (bnc#901239).
* CVE-2014-6492: Unspecified vulnerability in Oracle Java SE 6u81,
7u67, and 8u20, when running on Firefox, allows re ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
java-1_7_0-ibm on SUSE Linux Enterprise Server 11 SP2 LTSS
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
