CVSS: 5.0EPSS: 2%CPEs: 7EXPL: 0CVE-2016-3425 – OpenJDK: incorrect handling of surrogate pairs in XML attribute values (JAXP, 8143167)
https://notcve.org/view.php?id=CVE-2016-3425
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. Vulnerabilidad no especificada en Oracle Java SE 6u113, 7u99 y 8u77; Java SE Embedded 8u77; y JRockit R28.3.9 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP. It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2016-05 •
CVSS: 7.6EPSS: 22%CPEs: 9EXPL: 0CVE-2016-0603
https://notcve.org/view.php?id=CVE-2016-0603
Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory." Vulnerabilidad no especificada en el componente Java SE en Oracle Java SE 6u111, 7u95, 8u71 y 8u72, cuando se está ejecutando en Windows, permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Install. NOTA: la información anterior proviene de Oracle's Security Alert para CVE-2016-0603. • http://seclists.org/fulldisclosure/2016/Feb/54 http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0603-2874360.html http://www.securityfocus.com/archive/1/537462/100/0/threaded http://www.securityfocus.com/bid/83008 http://www.securitytracker.com/id/1034969 https://security.gentoo.org/glsa/201610-08 https://security.netapp.com/advisory/ntap-20160217-0001 •
CVSS: 10.0EPSS: 4%CPEs: 11EXPL: 0CVE-2016-0483 – Oracle Java readImage Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0483
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data. Vulnerabilidad no especificada en Oracle Java SE 6u105, 7u91 y 8u66; Java SE Embedded 8u65; y JRockit R28.3.8 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores relacionados con AWT. NOTA: la información anterior es de la CPU de Enero de 2016. • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-01 • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 5%CPEs: 10EXPL: 0CVE-2016-0466 – OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)
https://notcve.org/view.php?id=CVE-2016-0466
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP. Vulnerabilidad no especificada en los componentes Java SE, Java SE Embedded y JRockit en Oracle Java SE 6u105, 7u91 y 8u66; Java SE Embedded 8u65 y JRockit R28.3.8 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP. It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory. • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-01 •
CVSS: 10.0EPSS: 5%CPEs: 10EXPL: 0CVE-2016-0494 – ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
https://notcve.org/view.php?id=CVE-2016-0494
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con 2D. • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-01 • CWE-681: Incorrect Conversion between Numeric Types •