CVSS: 5.0EPSS: 5%CPEs: 7EXPL: 0CVE-2016-3425 – OpenJDK: incorrect handling of surrogate pairs in XML attribute values (JAXP, 8143167)
https://notcve.org/view.php?id=CVE-2016-3425
20 Apr 2016 — Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. Vulnerabilidad no especificada en Oracle Java SE 6u113, 7u99 y 8u77; Java SE Embedded 8u77; y JRockit R28.3.9 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP. It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part ... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-3426 – OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945)
https://notcve.org/view.php?id=CVE-2016-3426
20 Apr 2016 — Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE. Vulnerabilidad no especificada en Oracle Java SE 8u77 y Java SE Embedded 8u77 permite a atacantes remotos afectar a la confidencialidad a través de vectores relacionados con JCE. It was discovered that the GCM (Galois/Counter Mode) implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A re... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html •
CVSS: 9.3EPSS: 12%CPEs: 15EXPL: 0CVE-2016-0636 – OpenJDK: missing type safety checks for MethodHandle calls across class loaders, incorrect CVE-2013-5838 fix (Hotspot, 8151666)
https://notcve.org/view.php?id=CVE-2016-0636
24 Mar 2016 — Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component. Vulnerabilidad no especificada en Oracle Java SE 7u97, 8u73 y 8u74 permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con el subcomponente Hotspot. An improper type safety check was discovered in the Hotspot component. An untru... • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00003.html • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 7.6EPSS: 4%CPEs: 9EXPL: 0CVE-2016-0603 – Gentoo Linux Security Advisory 201610-08
https://notcve.org/view.php?id=CVE-2016-0603
08 Feb 2016 — Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."... • http://seclists.org/fulldisclosure/2016/Feb/54 •
CVSS: 7.1EPSS: 1%CPEs: 10EXPL: 0CVE-2016-0402 – OpenJDK: URL deserialization inconsistencies (Networking, 8059054)
https://notcve.org/view.php?id=CVE-2016-0402
21 Jan 2016 — Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a atacantes remotos afectar a la integridad a través de vectores desconocidos relacionados con Networking. The java-1.7.0-openjdk packages p... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html •
CVSS: 5.3EPSS: 0%CPEs: 9EXPL: 0CVE-2016-0448 – OpenJDK: logging of RMI connection secrets (JMX, 8130710)
https://notcve.org/view.php?id=CVE-2016-0448
21 Jan 2016 — Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a usuarios remotos autenticados afectar a la confidencialidad a través de vectores relacionados con JMX. The java-1.7.0-openjdk packages p... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.6EPSS: 2%CPEs: 10EXPL: 0CVE-2016-0466 – OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)
https://notcve.org/view.php?id=CVE-2016-0466
21 Jan 2016 — Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP. Vulnerabilidad no especificada en los componentes Java SE, Java SE Embedded y JRockit en Oracle Java SE 6u105, 7u91 y 8u66; Java SE Embedded 8u65 y JRockit R28.3.8 permite a atacantes remotos afectar a la disponibilidad a través de vectores relacionados con JAXP. It wa... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html •
CVSS: 5.8EPSS: 1%CPEs: 3EXPL: 0CVE-2016-0475 – OpenJDK: PBE incorrect key lengths (Libraries, 8138589)
https://notcve.org/view.php?id=CVE-2016-0475
21 Jan 2016 — Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Vulnerabilidad no especificada en los componentes Java SE, Java SE Embedded y JRockit en Oracle Java SE 8u66; Java SE Embedded 8u65; y JRockit R28.3.8 permite a atacantes remotos afectar a la confidencialidad y la integridad a través de vectores desconocid... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html •
CVSS: 10.0EPSS: 23%CPEs: 11EXPL: 0CVE-2016-0483 – Oracle Java readImage Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0483
21 Jan 2016 — Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data. Vulnerabilidad no especificada en Orac... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 13%CPEs: 10EXPL: 0CVE-2016-0494 – ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
https://notcve.org/view.php?id=CVE-2016-0494
21 Jan 2016 — Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vulnerabilidad no especificada en los componentes Java SE y Java SE Embedded en Oracle Java SE 6u105, 7u91 y 8u66 y Java SE Embedded 8u65 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores descono... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-681: Incorrect Conversion between Numeric Types •