CVSS: 5.0EPSS: 5%CPEs: 7EXPL: 0CVE-2016-3425 – OpenJDK: incorrect handling of surrogate pairs in XML attribute values (JAXP, 8143167)
https://notcve.org/view.php?id=CVE-2016-3425
20 Apr 2016 — Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. Vulnerabilidad no especificada en Oracle Java SE 6u113, 7u99 y 8u77; Java SE Embedded 8u77; y JRockit R28.3.9 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP. It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part ... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html •
CVSS: 7.6EPSS: 4%CPEs: 9EXPL: 0CVE-2016-0603 – Gentoo Linux Security Advisory 201610-08
https://notcve.org/view.php?id=CVE-2016-0603
08 Feb 2016 — Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."... • http://seclists.org/fulldisclosure/2016/Feb/54 •
CVSS: 7.1EPSS: 1%CPEs: 10EXPL: 0CVE-2016-0402 – OpenJDK: URL deserialization inconsistencies (Networking, 8059054)
https://notcve.org/view.php?id=CVE-2016-0402
21 Jan 2016 — Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a atacantes remotos afectar a la integridad a través de vectores desconocidos relacionados con Networking. The java-1.7.0-openjdk packages p... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html •
CVSS: 5.3EPSS: 0%CPEs: 9EXPL: 0CVE-2016-0448 – OpenJDK: logging of RMI connection secrets (JMX, 8130710)
https://notcve.org/view.php?id=CVE-2016-0448
21 Jan 2016 — Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a usuarios remotos autenticados afectar a la confidencialidad a través de vectores relacionados con JMX. The java-1.7.0-openjdk packages p... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.6EPSS: 2%CPEs: 10EXPL: 0CVE-2016-0466 – OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)
https://notcve.org/view.php?id=CVE-2016-0466
21 Jan 2016 — Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP. Vulnerabilidad no especificada en los componentes Java SE, Java SE Embedded y JRockit en Oracle Java SE 6u105, 7u91 y 8u66; Java SE Embedded 8u65 y JRockit R28.3.8 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP. It wa... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html •
CVSS: 10.0EPSS: 23%CPEs: 11EXPL: 0CVE-2016-0483 – Oracle Java readImage Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0483
21 Jan 2016 — Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data. Vulnerabilidad no especificada en Orac... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 13%CPEs: 10EXPL: 0CVE-2016-0494 – ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
https://notcve.org/view.php?id=CVE-2016-0494
21 Jan 2016 — Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores descono... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 7.7EPSS: 6%CPEs: 62EXPL: 0CVE-2015-8126 – libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions
https://notcve.org/view.php?id=CVE-2015-8126
13 Nov 2015 — Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. Múltiples desbordamientos de buffer en las funciones (1) png_set_PLTE y (2) png_get_PLTE en libpng en ver... • http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.1EPSS: 5%CPEs: 9EXPL: 0CVE-2015-4911 – OpenJDK: incomplete supportDTD enforcement (JAXP, 8130078)
https://notcve.org/view.php?id=CVE-2015-4911
21 Oct 2015 — Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893. Vulnerabilidad no especificada en Oracle Java SE 6u101, 7u85 y 8u60; Java SE Embedded 8u51 y JRockit R28.3.7 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP, una vulnerabilidad diferente a CVE-2015-4803 y CVE-20... • http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html •
CVSS: 10.0EPSS: 5%CPEs: 8EXPL: 0CVE-2015-4835 – OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383)
https://notcve.org/view.php?id=CVE-2015-4835
21 Oct 2015 — Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881. Vulnerabilidad no especificada en Oracle Java SE 6u101, 7u85 y 8u60 y Java SE Embedded 8u51, permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través de vectores relacionados con CORBA, una vulnerabilidad diferente a CVE-201... • http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html •