CVSS: 9.3EPSS: 2%CPEs: 7EXPL: 0CVE-2014-2490 – Oracle Java ResourceBundle Format String Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-2490
Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Vulnerabilidad no especificada en el componente Java SE en Oracle Java SE 7u60 y SE 8u5 permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Hotspot. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of ResourceBundles. The issue lies in insufficient validation of user-supplied data when applying a ResourceBundle. • http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://seclists.org/fulldisclosure/2014/Dec/23 http://secunia.com/advisories/60129 http://secunia.com/advisories/60485 http://secunia.com/advisories/60812 http://security.gentoo.org/glsa/glsa-201502-12.xml http://www.debian.org/security/2014/dsa-2980 http://www.debian.org/security/2014/dsa-2987 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.securityfocus.com/archive/1/534161/100/0& • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2014-2414 – OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030)
https://notcve.org/view.php?id=CVE-2014-2414
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB. Vulnerabilidad no especificada en Oracle Java SE 6u71, 7u51, y 8, y Java SE Embedded 7u51, permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores relacionados con JAXB. • http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://marc.info/?l=bugtraq&m=140852974709252&w=2 http://rhn.redhat.com/errata/RHSA-2014-0675.html http://rhn.redhat.com/errata/RHSA-2014-0685.html http://secunia.com/advisories/58415 http://security.gentoo.org/glsa/glsa-201406-32.xml http://security.gentoo.org/glsa/glsa-201502-12.xml http://www-01.ibm.com/support/docview.wss?uid=swg21672080 http://www.debian.org/security/2014/dsa-2912 http://www.oracle •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2014-2427 – OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163)
https://notcve.org/view.php?id=CVE-2014-2427
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Vulnerabilidad no especificada en Oracle Java SE 5.0u61, 6u71, 7u51, y 8, y Java SE Embedded 7u51, permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con el Sound. • http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://marc.info/?l=bugtraq&m=140852974709252&w=2 http://rhn.redhat.com/errata/RHSA-2014-0675.html http://rhn.redhat.com/errata/RHSA-2014-0685.html http://secunia.com/advisories/58415 http://security.gentoo.org/glsa/glsa-201406-32.xml http://security.gentoo.org/glsa/glsa-201502-12.xml http://www-01.ibm.com/support/docview.wss?uid=swg21672080 http://www.debian.org/security/2014/dsa-2912 http://www.oracle •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2014-2413 – OpenJDK: method handle call hierachy bypass (Libraries, 8032686)
https://notcve.org/view.php?id=CVE-2014-2413
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries. Vulnerabilidad no especificada en Oracle Java SE 7u51 y 8, y Java SE Embedded 7u51, permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con las librerías. • http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://rhn.redhat.com/errata/RHSA-2014-0675.html http://security.gentoo.org/glsa/glsa-201502-12.xml http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html http://www.securityfocus.com/bid/66917 http://www.ubuntu.com/usn/USN-2187-1 https://access.redhat.com/errata/RHSA-2014:0413 https://access.redhat.com/security/cve/CVE-2014-2413 https://bugzilla.redhat.com/show_bug.cgi?id=1087446 •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2014-2412 – OpenJDK: AWT thread context handling (AWT, 8025010)
https://notcve.org/view.php?id=CVE-2014-2412
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451. Vulnerabilidad no especificada en Oracle Java SE 5.0u61, 6u71, SE 7u51, y 8, y Java SE Embedded 7u51, permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores relacionados con AWT, una vulnerabilidad diferente a CVE-2014-0451. • http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://marc.info/?l=bugtraq&m=140852974709252&w=2 http://rhn.redhat.com/errata/RHSA-2014-0675.html http://rhn.redhat.com/errata/RHSA-2014-0685.html http://secunia.com/advisories/58415 http://security.gentoo.org/glsa/glsa-201406-32.xml http://security.gentoo.org/glsa/glsa-201502-12.xml http://www-01.ibm.com/support/docview.wss?uid=swg21672080 http://www.debian.org/security/2014/dsa-2912 http://www.oracle •