Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Red Hat Local Security Checks
Title:RedHat Update for java-1.8.0-openjdk RHSA-2015:1228-01
Summary:The remote host is missing an update for the 'java-1.8.0-openjdk'; package(s) announced via the referenced advisory.
The remote host is missing an update for the 'java-1.8.0-openjdk'
package(s) announced via the referenced advisory.

Vulnerability Insight:
The java-1.8.0-openjdk packages provide
the OpenJDK 8 Java Runtime
Environment and the OpenJDK 8 Java Software Development Kit.

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI
components in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass Java sandbox restrictions. (CVE-2015-4760,
CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733)

A flaw was found in the way the Libraries component of OpenJDK verified
Online Certificate Status Protocol (OCSP) responses. An OCSP response with
no nextUpdate date specified was incorrectly handled as having unlimited
validity, possibly causing a revoked X.509 certificate to be interpreted as
valid. (CVE-2015-4748)

It was discovered that the JCE component in OpenJDK failed to use constant
time comparisons in multiple cases. An attacker could possibly use these
flaws to disclose sensitive information by measuring the time used to
perform operations using these non-constant time comparisons.

It was discovered that the GCM (Galois Counter Mode) implementation in the
Security component of OpenJDK failed to properly perform a null check.
This could cause the Java Virtual Machine to crash when an application
performed encryption using a block cipher in the GCM mode. (CVE-2015-2659)

A flaw was found in the RC4 encryption algorithm. When using certain keys
for RC4 encryption, an attacker could obtain portions of the plain text
from the cipher text without the knowledge of the encryption key.

Note: With this update, OpenJDK now disables RC4 TLS/SSL cipher suites by
default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug
1207101, linked to in the References section, for additional details about
this change.

A flaw was found in the way the TLS protocol composed the Diffie-Hellman
(DH) key exchange. A man-in-the-middle attacker could use this flaw to
force the use of weak 512 bit export-grade keys during the key exchange,
allowing them do decrypt all traffic. (CVE-2015-4000)

Note: This update forces the TLS/SSL client implementation in OpenJDK to
reject DH key sizes below 768 bits, which prevents sessions to be
downgraded to export-grade keys. Refer to Red Hat Bugzilla bug 1223211,
linked to in the References section, for additional details about this

It was discovered that the JNDI component in OpenJDK did not handle DNS
resolutions correctly. An attacker able to t ...

Description truncated, please see the referenced URL(s) for more information.

Affected Software/OS:
java-1.8.0-openjdk on Red Hat Enterprise Linux Desktop (v. 6),
Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Server (v. 7),
Red Hat Enterprise Linux Workstation (v. 6)

Please Install the Updated Packages.

CVSS Score:

CVSS Vector:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-2590
BugTraq ID: 75818
Debian Security Information: DSA-3316 (Google Search)
Debian Security Information: DSA-3339 (Google Search)
RedHat Security Advisories: RHSA-2015:1228
RedHat Security Advisories: RHSA-2015:1229
RedHat Security Advisories: RHSA-2015:1230
RedHat Security Advisories: RHSA-2015:1241
RedHat Security Advisories: RHSA-2015:1242
RedHat Security Advisories: RHSA-2015:1243
RedHat Security Advisories: RHSA-2015:1485
RedHat Security Advisories: RHSA-2015:1486
RedHat Security Advisories: RHSA-2015:1488
RedHat Security Advisories: RHSA-2015:1526
RedHat Security Advisories: RHSA-2015:1544
RedHat Security Advisories: RHSA-2015:1604
SuSE Security Announcement: SUSE-SU-2015:1319 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1320 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1288 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1289 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2015-2601
BugTraq ID: 75867
Common Vulnerability Exposure (CVE) ID: CVE-2015-2621
BugTraq ID: 75874
Common Vulnerability Exposure (CVE) ID: CVE-2015-2625
BugTraq ID: 75895
SuSE Security Announcement: SUSE-SU-2015:2166 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:2192 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:0113 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2015-2628
BugTraq ID: 75796
Common Vulnerability Exposure (CVE) ID: CVE-2015-2632
BugTraq ID: 75861
Common Vulnerability Exposure (CVE) ID: CVE-2015-2659
BugTraq ID: 75877
Common Vulnerability Exposure (CVE) ID: CVE-2015-2808
BugTraq ID: 73684
BugTraq ID: 91787
HPdes Security Advisory: HPSBGN03338
HPdes Security Advisory: HPSBGN03354
HPdes Security Advisory: HPSBGN03366
HPdes Security Advisory: HPSBGN03367
HPdes Security Advisory: HPSBGN03372
HPdes Security Advisory: HPSBGN03399
HPdes Security Advisory: HPSBGN03402
HPdes Security Advisory: HPSBGN03403
HPdes Security Advisory: HPSBGN03405
HPdes Security Advisory: HPSBGN03407
HPdes Security Advisory: HPSBGN03414
HPdes Security Advisory: HPSBGN03415
HPdes Security Advisory: HPSBMU03345
HPdes Security Advisory: HPSBMU03377
HPdes Security Advisory: HPSBMU03401
HPdes Security Advisory: HPSBUX03512
HPdes Security Advisory: SSRT102073
HPdes Security Advisory: SSRT102127
HPdes Security Advisory: SSRT102129
HPdes Security Advisory: SSRT102133
HPdes Security Advisory: SSRT102150
HPdes Security Advisory: SSRT102254
RedHat Security Advisories: RHSA-2015:1006
RedHat Security Advisories: RHSA-2015:1007
RedHat Security Advisories: RHSA-2015:1020
RedHat Security Advisories: RHSA-2015:1021
RedHat Security Advisories: RHSA-2015:1091
SuSE Security Announcement: SUSE-SU-2015:1073 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1085 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1086 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1138 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1161 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2015-3149
BugTraq ID: 75933
Common Vulnerability Exposure (CVE) ID: CVE-2015-4000
BugTraq ID: 74733
Debian Security Information: DSA-3287 (Google Search)
Debian Security Information: DSA-3300 (Google Search)
Debian Security Information: DSA-3324 (Google Search)
Debian Security Information: DSA-3688 (Google Search)
HPdes Security Advisory: HPSBGN03351
HPdes Security Advisory: HPSBGN03361
HPdes Security Advisory: HPSBGN03362
HPdes Security Advisory: HPSBGN03373
HPdes Security Advisory: HPSBGN03404
HPdes Security Advisory: HPSBGN03411
HPdes Security Advisory: HPSBGN03533
HPdes Security Advisory: HPSBMU03356
HPdes Security Advisory: HPSBUX03363
HPdes Security Advisory: HPSBUX03388
HPdes Security Advisory: SSRT102112
HPdes Security Advisory: SSRT102180
NETBSD Security Advisory: NetBSD-SA2015-008
RedHat Security Advisories: RHSA-2015:1072
RedHat Security Advisories: RHSA-2015:1185
RedHat Security Advisories: RHSA-2015:1197
RedHat Security Advisories: RHSA-2016:1624
RedHat Security Advisories: RHSA-2016:2056
SuSE Security Announcement: SUSE-SU-2015:1143 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1150 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1177 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1181 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1182 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1183 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1184 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1185 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1268 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1269 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1449 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1581 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:1663 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:0224 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:0262 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1139 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1209 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1229 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1266 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1277 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:1684 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:0226 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:0255 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:0261 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:0478 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:0483 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2015-4731
BugTraq ID: 75812
Common Vulnerability Exposure (CVE) ID: CVE-2015-4732
BugTraq ID: 75823
Common Vulnerability Exposure (CVE) ID: CVE-2015-4733
BugTraq ID: 75832
Common Vulnerability Exposure (CVE) ID: CVE-2015-4748
BugTraq ID: 75854
Common Vulnerability Exposure (CVE) ID: CVE-2015-4749
BugTraq ID: 75890
Common Vulnerability Exposure (CVE) ID: CVE-2015-4760
BugTraq ID: 75784
Debian Security Information: DSA-3323 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2015-0383
BugTraq ID: 72155
Debian Security Information: DSA-3144 (Google Search)
Debian Security Information: DSA-3147 (Google Search)
HPdes Security Advisory: HPSBUX03273
HPdes Security Advisory: HPSBUX03281
HPdes Security Advisory: SSRT101951
HPdes Security Advisory: SSRT101968
RedHat Security Advisories: RHSA-2015:0068
RedHat Security Advisories: RHSA-2015:0079
RedHat Security Advisories: RHSA-2015:0080
RedHat Security Advisories: RHSA-2015:0085
RedHat Security Advisories: RHSA-2015:0086
SuSE Security Announcement: SUSE-SU-2015:0336 (Google Search)
SuSE Security Announcement: SUSE-SU-2015:0503 (Google Search)
SuSE Security Announcement: openSUSE-SU-2015:0190 (Google Search)
XForce ISS Database: oracle-cpujan2015-cve20150383(100148)
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.