DIESER SERVICE KANN ÜBERSETZUNGEN VON GOOGLE ENTHALTEN. GOOGLE ÜBERNIMMT KEINERLEI VERANTWORTUNG FÜR DIE ÜBERSETZUNGEN. DARUNTER FÄLLT JEGLICHE VERANTWORTUNG IN BEZUG AUF RICHTIGKEIT UND ZUVERLÄSSIGKEIT SOWIE JEGLICHE STILLSCHWEIGENDEN GEWÄHRLEISTUNGEN DER MARKTGÄNGIGKEIT, NICHT-VERLETZUNG VON RECHTEN DRITTER ODER DER EIGNUNG FÜR EINEN BESTIMMTEN ZWECK.

Die Website von Kaspersky Lab wurde für Ihre Bequemlichkeit mithilfe einer Übersetzungssoftware von Google Translate übersetzt. Es wurden angemessene Bemühungen für die Bereitstellung einer akkuraten Übersetzung unternommen. Bitte beachten Sie, dass automatisierte Übersetzungen nicht perfekt sind und menschliche Übersetzer in keinem Fall ersetzen sollen. Übersetzungen werden den Nutzern der Kaspersky-Lab-Website als Service und "wie sie sind" zur Verfügung gestellt. Die Richtigkeit, Zuverlässigkeit oder Korrektheit jeglicher Übersetzungen aus dem Englischen in eine andere Sprache wird weder ausdrücklich noch stillschweigend garantiert. Einige Inhalte (z. B. Bilder, Videos, Flash, usw.) können aufgrund der Einschränkungen der Übersetzungssoftware möglicherweise nicht inhaltsgetreu übersetzt werden.

KLA11122
Multiple vulnerabilities in Oracle Java SE, Java SE Embedded and JRockit
Aktualisiert: 03/29/2019
Erkennungsdatum
?
10/17/2017
Schweregrad
?
Hoch
Beschreibung

Multiple serious vulnerabilities have been found in Oracle Java SE. Malicious users can exploit these vulnerabilities to cause denial of service and bypass security restrictions.

Below is a complete list of vulnerabilities:

  1. An unspecified vulnerability in subcomponent Smart Card IO can be exploited remotely by unauthenticated attacker via multiple protocols to obtain sensitive information and to bypass security restrictions;
  2. An unspecified vulnerability in subcomponent Serialization can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  3. An unspecified vulnerability in subcomponent RMI (Remote Method Invocation) can be exploited remotely by unauthenticated attacker via multiple protocols to bypass security restrictions;
  4. An unspecified vulnerability in subcomponent Javadoc can be exploited remotely by unauthenticated attacker via multiple protocols to execute arbitrary code;
  5. An unspecified vulnerability in subcomponent Networking can be exploited remotely by unauthenticated attacker via HTTP to cause bypass security restrictions;
  6. An unspecified vulnerability in subcomponent Deployment can be exploited remotely by unauthenticated attacker via multiple protocols to bypass security restrictions;
  7. Unspecified vulnerabilities in subcomponent Server can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service or to bypass security restrictions;
  8. An unspecified vulnerability in subcomponent Server can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  9. An unspecified vulnerability in subcomponent Serialization can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  10. An unspecified vulnerability in subcomponent Hotspot can be exploited remotely by unauthenticated attacker via multiple protocols to bypass security restrictions;
  11. An unspecified vulnerability in subcomponent Serialization can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  12. An unspecified vulnerability in subcomponent Libraries can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  13. An unspecified vulnerability in subcomponent JAXP (Java API for XML Processing) can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  14. An unspecified vulnerability in subcomponent JAX-WS (The Java API for XML Web Services) can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  15. An unspecified vulnerability in subcomponent Networking can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  16. An unspecified vulnerability in subcomponent Security can be exploited remotely by unauthenticated attacker via multiple protocols to bypass security restrictions;
  17. An unspecified vulnerability in subcomponent Serialization can be exploited remotely by unauthenticated attacker via multiple protocols to cause denial of service;
  18. Unspecified vulnerabilities in subcomponent Server can be exploited remotely by unauthenticated attacker via HTTP protocols to bypass security restrictions;
  19. An unspecified vulnerability in subcomponent Libraries can be exploited remotely by unauthenticated attacker via multiple protocols to bypass security restrictions;

Technical details

Vulnerabilities (1), (4) and (6) are related to Java SE.

Vulnerabilities (2), (5), (9), (15) and (16) are related to Java SE, Java SE Embedded and JRockit

Vulnerabilities (3), (10), (12), (13), (14), (17) and (19) are related to Java SE and Java SE Embedded.

Vulnerabilities (7), (8) and (18) are related to Java Management Console.

Vulnerability (11) is related to Java SE and JRockit.

Beeinträchtigte Produkte

Java SE 6 versions earlier than 6u161
Java SE 7 versions earlier than 7u151
Java SE 8 versions earlier than 8u151
Java SE Embedded versions earlier than 8u151
Java SE version 9
JRockit R28.3.15

Lösung

Update to the latest version
Software downloads

Ursprüngliche Informationshinweise

Oracle Critical Patch Update Advisory – October 2017

Folgen
?
ACE 
[?]

DoS 
[?]

SB 
[?]
CVE-IDS
?
Offizielle Informationshinweise von Microsoft
Microsoft Sicherheitsupdate-Guide
KB-Liste

KB is Microsoft Knowledge Base article (In security case it corresponds Microsoft Security Advisory). KB is an atomic part of Microsoft security updates, which is detected by Microsoft Updater and can be installed or reverted. KB can contain not only programmatically updates and not only updates released by Microsoft.


Link zum Original