CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2014-2405
https://notcve.org/view.php?id=CVE-2014-2405
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462. Vulnerabilidad no especificada en OpenJDK 6 anterior a 6b31 en Debian GNU/Linux y Ubuntu 12.04 LTS y 10.04 LTS tiene impacto y vectores de ataque desconocidos, una vulnerabilidad diferente a CVE-2014-0462. • http://secunia.com/advisories/58415 http://www.debian.org/security/2014/dsa-2912 http://www.ubuntu.com/usn/USN-2191-1 •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2014-0462
https://notcve.org/view.php?id=CVE-2014-0462
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405. Vulnerabilidad no especificada en OpenJDK 6 anterior a 6b31 en Debian GNU/Linux y Ubuntu 12.04 LTS y 10.04 LTS tiene impacto y vectores de ataque desconocidos, una vulnerabilidad diferente a CVE-2014-2405. • http://secunia.com/advisories/58415 http://www.debian.org/security/2014/dsa-2912 http://www.ubuntu.com/usn/USN-2191-1 •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2014-1876 – OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)
https://notcve.org/view.php?id=CVE-2014-1876
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log. La función unpacker::redirect_stdio en unpack.cpp en unpack200 en OpenJDK 6, 7 y 8; Oracle Java SE 5.0u61, 6u71, 7u51 y 8; JRockit R27.8.1 y R28.3.1; y Java SE Embedded 7u51 no crea de manera segura archivos temporales cuando un archivo de registro no puede abrirse, lo que permite a usuarios locales sobreescribir archivos arbitrarios a través de un ataque de enlace simbólico en /tmp/unpack.log. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562 http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://marc.info/?l=bugtraq&m=140852974709252&w=2 http://osvdb.org/102808 http://rhn.redhat.com/errata/RHSA-2014-0675.html http://rhn.redhat.com/errata/RHSA-2014-0685.html http://seclists.org/oss-sec/2014/q1/242 http://seclists.org/oss-sec/2014/q1/285 http://secunia.com/advisories/58415 http://secunia.com/advisories/59058 http://security.gen • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-377: Insecure Temporary File •
CVSS: 7.5EPSS: 61%CPEs: 56EXPL: 0CVE-2013-2461 – OpenJDK: Missing check for valid DOMCanonicalizationMethod canonicalization algorithm (Libraries, 8014281)
https://notcve.org/view.php?id=CVE-2013-2461
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm." Vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE 7 Update 21 y versiones anteriores y 6 Update 45 y versiones anteriores; el componente Oracle JRockit en Oracle Fusion Middleware R27.7.5 y versiones anteriores y R28.2.7 y versiones anteriores; y OpenJDK 7 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con Libraries. NOTA: la información anterior es de la CPU de Junio y Julio de 2013. • http://advisories.mageia.org/MGASA-2013-0185.html http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2 http://marc.info/?l=bugtraq&m=137545505800971&w=2 http://marc.info/?l=bugtraq&m=137545592101387&w=2 http://rhn.redhat.com/errata/RHSA-2013-0963.html http://seclists.org/fulldisclosure/2014/Dec/23 http://secunia.com/advisories/54154 http://security.gentoo.org/glsa/glsa-201406-32.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:183 http: •
CVSS: 5.1EPSS: 0%CPEs: 72EXPL: 0CVE-2013-0169 – SSL/TLS: CBC padding timing attack (lucky-13)
https://notcve.org/view.php?id=CVE-2013-0169
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. El protocolo TLS v1.1 y v1.2 y el protocolo DTLS v1.0 y v1.2, tal como se utiliza en OpenSSL, OpenJDK, PolarSSL, y otros productos, no considera adecuadamente ataques a un requisito de verificación MAC durante el proceso de relleno CBC malformado, lo que permite a atacantes remotos para realizar ataques distintivos y los ataques de recuperación de texto plano través del análisis estadístico de los datos de tiempo de los paquetes hechos a mano, también conocido como el "Lucky Thirteen" de emisión. • http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html http:/&#x • CWE-310: Cryptographic Issues •