CVSS: 10.0EPSS: 67%CPEs: 81EXPL: 0CVE-2016-3427 – Oracle Java SE and JRockit Unspecified Vulnerability
https://notcve.org/view.php?id=CVE-2016-3427
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Vulnerabilidad no especificada en Oracle Java SE 6u113, 7u99 y 8u77; Java SE Embedded 8u77; y JRockit R28.3.9 permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través de vectores relacionados con JMX. It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2016-05 • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 12%CPEs: 11EXPL: 0CVE-2016-0483 – Oracle Java readImage Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0483
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data. Vulnerabilidad no especificada en Oracle Java SE 6u105, 7u91 y 8u66; Java SE Embedded 8u65; y JRockit R28.3.8 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores relacionados con AWT. NOTA: la información anterior es de la CPU de Enero de 2016. • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-01 • CWE-787: Out-of-bounds Write •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-0475 – OpenJDK: PBE incorrect key lengths (Libraries, 8138589)
https://notcve.org/view.php?id=CVE-2016-0475
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Vulnerabilidad no especificada en los componentes Java SE, Java SE Embedded y JRockit en Oracle Java SE 8u66; Java SE Embedded 8u65; y JRockit R28.3.8 permite a atacantes remotos afectar a la confidencialidad y la integridad a través de vectores desconocidos relacionados con Libraries. It was discovered that the password-based encryption (PBE) implementation in the Libraries component in OpenJDK used an incorrect key length. This could, in certain cases, lead to generation of keys that were weaker than expected. • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html http://rhn.redhat.com/errata/RHSA-2016-0049.html http://rhn.redhat.com/errata/RHSA-2016-0050.html http://rhn.redhat.com/errata/RHSA-2016-0055.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html http://www.securitytracker.com/id/1034715 https://kc.mcafee.com/corporate/index?page=content&id=SB10148 https:/&#x •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2015-4872 – OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291)
https://notcve.org/view.php?id=CVE-2015-4872
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security. Vulnerabilidad no especificada en Oracle Java SE 6u101, 7u85 y 8u60; Java SE Embedded 8u51 y JRockit R28.3.7 permite a atacantes remotos afectar a la integridad a través de vectores desconocidos relacionados con Security. • http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-12 •
CVSS: 5.0EPSS: 7%CPEs: 9EXPL: 0CVE-2015-4911 – OpenJDK: incomplete supportDTD enforcement (JAXP, 8130078)
https://notcve.org/view.php?id=CVE-2015-4911
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893. Vulnerabilidad no especificada en Oracle Java SE 6u101, 7u85 y 8u60; Java SE Embedded 8u51 y JRockit R28.3.7 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP, una vulnerabilidad diferente a CVE-2015-4803 y CVE-2015-4893. • http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-12 •