10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%
CVE-2014-3566 (man-in-the-middle)
Nondeterministic CBC padding, which makes it easier for
man-in-the-middle attackers to obtain cleartext data via a
padding-oracle attack, aka the "POODLE" issue.
CVE-2014-6587 (privilege escalation)
MulticastSocket NULL pointer dereference allows local users to affect
confidentiality, integrity, and availability.
CVE-2014-6593 (man-in-the-middle)
Incorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows
remote attackers to affect confidentiality and integrity.
CVE-2014-6601 (arbitrary code execution)
Class verifier insufficient invokespecial calls verification related to
Hotspot allows remote attackers to affect confidentiality, integrity,
and availability.
CVE-2015-0383 (denial of service)
Insecure hsperfdata temporary file handling related to Hotspot allows
local users to affect integrity and availability.
CVE-2015-0395 (arbitrary code execution)
Phantom references handling issue in garbage collector related to
Hotspot allows remote attackers to affect confidentiality, integrity,
and availability.
CVE-2015-0400 (information disclosure)
Successful unauthenticated network attacks via multiple protocols can
result in unauthorized read access to a subset of Java SE accessible data.
CVE-2015-0403 (arbitrary code execution)
Successful attack of this vulnerability can result in unauthorized
Operating System takeover including arbitrary code execution.
CVE-2015-0406 (information disclosure)
Successful unauthenticated network attacks via multiple protocols can
result in unauthorized read access to a subset of accessible data and
ability to cause a partial denial of service.
CVE-2015-0407 (information disclosure)
Directory information leak via file chooser related to Swing allows
remote attackers to affect confidentiality.
CVE-2015-0408 (arbitrary code execution)
Incorrect context class loader use in RMI transport allows remote
attackers to affect confidentiality, integrity, and availability.
CVE-2015-0410 (denial of service)
DER decoder infinite loop allows remote attackers to affect availability.
CVE-2015-0412 (arbitrary code execution)
Insufficient code privileges checks related to JAX-WS allows remote
attackers to affect confidentiality, integrity, and availability.
CVE-2015-0413 (unauthorized modification)
Successful attack of this vulnerability can result in unauthorized
update, insert or delete access to some Java SE accessible data.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
any | any | any | jre7-openjdk-headless | < 7.u75_2.5.4-1 | UNKNOWN |
www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976.html#JAVA
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6549
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6587
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6593
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6601
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0383
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0395
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0400
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0403
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0406
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0407
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0408
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0410
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0412
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0413