{"id": "CVE-2014-6585", "bulletinFamily": "NVD", "title": "CVE-2014-6585", "description": "Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.", "published": "2015-01-21T10:28:22", "modified": "2016-12-21T21:59:17", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6585", "reporter": "NVD", "references": ["http://www.vmware.com/security/advisories/VMSA-2015-0003.html", "http://rhn.redhat.com/errata/RHSA-2015-0079.html", "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html", "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html", "https://security.gentoo.org/glsa/201603-14", "http://www.ubuntu.com/usn/USN-2487-1", "http://www.securityfocus.com/bid/72173", "http://www.securitytracker.com/id/1031580", "https://security.gentoo.org/glsa/201507-14", "http://rhn.redhat.com/errata/RHSA-2015-0085.html", "http://rhn.redhat.com/errata/RHSA-2015-0086.html", "http://marc.info/?l=bugtraq&m=142607790919348&w=2", "http://marc.info/?l=bugtraq&m=142496355704097&w=2", "http://rhn.redhat.com/errata/RHSA-2015-0068.html", "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html", "http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581", "http://www.debian.org/security/2015/dsa-3144", "http://www.debian.org/security/2015/dsa-3147", "http://www.debian.org/security/2015/dsa-3323", "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html", "https://www-304.ibm.com/support/docview.wss?uid=swg21695474", "http://www.ubuntu.com/usn/USN-2486-1", "http://rhn.redhat.com/errata/RHSA-2015-0264.html", "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html", "http://rhn.redhat.com/errata/RHSA-2015-0080.html", "http://rhn.redhat.com/errata/RHSA-2015-0136.html"], "cvelist": ["CVE-2014-6585"], "type": "cve", "lastseen": "2017-04-18T15:55:18", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:oracle:jdk:1.6.0:update_85", "cpe:/a:oracle:jre:1.6.0:update_85", "cpe:/a:oracle:jdk:1.8.0:update_25", "cpe:/a:oracle:jre:1.7.0:update_72", "cpe:/a:oracle:jdk:1.5.0:update_75", "cpe:/a:oracle:jdk:1.7.0:update_72", "cpe:/a:oracle:jre:1.8.0:update_25", "cpe:/a:oracle:jre:1.5.0:update_75"], "cvelist": ["CVE-2014-6585"], "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.", "edition": 1, "hash": "0691588ce502ee18c5629d50689e034d4afdd88894e7214ff89ad353813b3097", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "dd5c16d91d20b969e6cf542d8ad0965d", "key": "published"}, {"hash": "43482720063b00259e4a71f72bd29837", "key": "title"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "6cef4c2b4938ed9e4e4b99bc94233850", "key": "cvss"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "480bda180978c859840676b86c6d26b7", "key": "cvelist"}, {"hash": "2a90c36ce348ad0d71153640dd608b95", "key": "description"}, {"hash": "134ec1e51a0fe79d06f1acd546750654", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "73db53f7f071889145fa80d4b9925a2b", "key": "cpe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "4badf51f3227f282a5cf8e6ecc47ea5e", "key": "href"}, {"hash": "339ff4813b163710532315425ca6f5b8", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6585", "id": "CVE-2014-6585", "lastseen": "2016-09-03T21:06:28", "modified": "2016-06-16T22:00:58", "objectVersion": "1.2", "published": "2015-01-21T10:28:22", "references": ["http://www.vmware.com/security/advisories/VMSA-2015-0003.html", "http://rhn.redhat.com/errata/RHSA-2015-0079.html", "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html", "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html", "http://www.ubuntu.com/usn/USN-2487-1", "http://www.securityfocus.com/bid/72173", "http://www.securitytracker.com/id/1031580", "http://rhn.redhat.com/errata/RHSA-2015-0085.html", "http://rhn.redhat.com/errata/RHSA-2015-0086.html", "http://marc.info/?l=bugtraq&m=142607790919348&w=2", "http://marc.info/?l=bugtraq&m=142496355704097&w=2", "http://rhn.redhat.com/errata/RHSA-2015-0068.html", "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html", "http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581", "http://www.debian.org/security/2015/dsa-3144", "http://www.debian.org/security/2015/dsa-3147", "https://www-304.ibm.com/support/docview.wss?uid=swg21695474", "http://www.ubuntu.com/usn/USN-2486-1", "http://rhn.redhat.com/errata/RHSA-2015-0264.html", "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html", "http://rhn.redhat.com/errata/RHSA-2015-0080.html", "http://rhn.redhat.com/errata/RHSA-2015-0136.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2014-6585", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T21:06:28"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "73db53f7f071889145fa80d4b9925a2b"}, {"key": "cvelist", "hash": "480bda180978c859840676b86c6d26b7"}, {"key": "cvss", "hash": "6cef4c2b4938ed9e4e4b99bc94233850"}, {"key": "description", "hash": "2a90c36ce348ad0d71153640dd608b95"}, {"key": "href", "hash": "4badf51f3227f282a5cf8e6ecc47ea5e"}, {"key": "modified", "hash": "5a0671974c345038b316e5cbbefa3ab3"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "dd5c16d91d20b969e6cf542d8ad0965d"}, {"key": "references", "hash": "7adb43572775ba5a2859075e03c7105a"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "43482720063b00259e4a71f72bd29837"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "e246c69a118c8f3f77a7af3ed2974cf40bc9052ff3b57ec47f82cf64546a10be", "viewCount": 0, "objectVersion": "1.2", "cpe": ["cpe:/a:oracle:jdk:1.6.0:update_85", "cpe:/a:oracle:jre:1.6.0:update_85", "cpe:/a:oracle:jdk:1.8.0:update_25", "cpe:/a:oracle:jre:1.7.0:update_72", "cpe:/a:oracle:jdk:1.5.0:update_75", "cpe:/a:oracle:jdk:1.7.0:update_72", "cpe:/a:oracle:jre:1.8.0:update_25", "cpe:/a:oracle:jre:1.5.0:update_75"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": [], "enchantments": {"vulnersScore": 5.0}}

{"result": {"nessus": [{"id": "FEDORA_2015-3569.NASL", "type": "nessus", "title": "Fedora 21 : icu-52.1-5.fc21 (2015-3569)", "description": "Security fix for CVE-2014-6585, CVE-2014-6591\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-04-03T00:00:00", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82544", "cvelist": ["CVE-2014-6585", "CVE-2014-6591"], "lastseen": "2017-10-29T13:37:19"}, {"id": "FEDORA_2015-3590.NASL", "type": "nessus", "title": "Fedora 20 : icu-50.1.2-11.fc20 (2015-3590)", "description": "Security fix for CVE-2014-6585, CVE-2014-6591\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-03-25T00:00:00", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82050", "cvelist": ["CVE-2014-6585", "CVE-2014-6591"], "lastseen": "2017-10-29T13:44:21"}, {"id": "MANDRIVA_MDVSA-2015-161.NASL", "type": "nessus", "title": "Mandriva Linux Security Advisory : icu (MDVSA-2015:161-1)", "description": "Updated icu packages fix security vulnerabilities :\n\nThe Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier or look-behind expression (CVE-2014-7923, CVE-2014-7926).\n\nThe collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted character sequence (CVE-2014-7940).\n\nIt was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program (CVE-2014-6585, CVE-2014-6591).", "published": "2015-03-30T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82414", "cvelist": ["CVE-2014-7923", "CVE-2014-6585", "CVE-2014-7940", "CVE-2014-7926", "CVE-2014-6591"], "lastseen": "2017-10-29T13:44:46"}, {"id": "FEDORA_2015-16315.NASL", "type": "nessus", "title": "Fedora 23 : icu-54.1-5.fc23 (2015-16315)", "description": "Security fix for CVE-2014-6585 CVE-2014-6591 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-09-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=86111", "cvelist": ["CVE-2014-7923", "CVE-2014-6585", "CVE-2014-9654", "CVE-2014-7926", "CVE-2014-6591"], "lastseen": "2018-01-31T07:08:17"}, {"id": "DEBIAN_DSA-3323.NASL", "type": "nessus", "title": "Debian DSA-3323-1 : icu - security update", "description": "Several vulnerabilities were discovered in the International Components for Unicode (ICU) library.\n\n - CVE-2014-8146 The Unicode Bidirectional Algorithm implementation does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.\n\n - CVE-2014-8147 The Unicode Bidirectional Algorithm implementation uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.\n\n - CVE-2015-4760 The Layout Engine was missing multiple boundary checks.\n These could lead to buffer overflows and memory corruption. A specially crafted file could cause an application using ICU to parse untrusted font files to crash and, possibly, execute arbitrary code.\n\nAdditionally, it was discovered that the patch applied to ICU in DSA-3187-1 for CVE-2014-6585 was incomplete, possibly leading to an invalid memory access. This could allow remote attackers to disclose portion of private memory via crafted font files.", "published": "2015-08-03T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=85162", "cvelist": ["CVE-2014-6585", "CVE-2014-8147", "CVE-2014-8146", "CVE-2015-4760"], "lastseen": "2017-10-29T13:43:59"}, {"id": "FEDORA_2015-16314.NASL", "type": "nessus", "title": "Fedora 22 : icu-54.1-4.fc22 (2015-16314)", "description": "Security fix for CVE-2014-6585 CVE-2014-6591 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-10-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=86376", "cvelist": ["CVE-2014-7923", "CVE-2014-6585", "CVE-2014-9654", "CVE-2014-7926", "CVE-2014-6591"], "lastseen": "2018-01-31T07:07:19"}, {"id": "REDHAT-RHSA-2015-0136.NASL", "type": "nessus", "title": "RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:0136)", "description": "Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nIBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-6585, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410)\n\nAll users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR16-FP9 release. All running instances of IBM Java must be restarted for this update to take effect.", "published": "2015-02-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81204", "cvelist": ["CVE-2015-0395", "CVE-2014-8892", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6593", "CVE-2015-0408", "CVE-2014-6591", "CVE-2014-8891"], "lastseen": "2017-10-29T13:32:57"}, {"id": "OPENSUSE-2015-91.NASL", "type": "nessus", "title": "openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2015:0190-1) (POODLE)", "description": "OpenJDK was updated to 2.5.4 - OpenJDK 7u75 to fix security issues and bugs :\n\n - Security fixes\n\n - S8046656: Update protocol support\n\n - S8047125, CVE-2015-0395: (ref) More phantom object references\n\n - S8047130: Fewer escapes from escape analysis\n\n - S8048035, CVE-2015-0400: Ensure proper proxy protocols\n\n - S8049253: Better GC validation\n\n - S8050807, CVE-2015-0383: Better performing performance data handling\n\n - S8054367, CVE-2015-0412: More references for endpoints\n\n - S8055304, CVE-2015-0407: More boxing for DirectoryComboBoxModel\n\n - S8055309, CVE-2015-0408: RMI needs better transportation considerations\n\n - S8055479: TLAB stability\n\n - S8055489, CVE-2014-6585: Better substitution formats\n\n - S8056264, CVE-2014-6587: Multicast support improvements\n\n - S8056276, CVE-2014-6591: Fontmanager feature improvements\n\n - S8057555, CVE-2014-6593: Less cryptic cipher suite management\n\n - S8058982, CVE-2014-6601: Better verification of an exceptional invokespecial\n\n - S8059485, CVE-2015-0410: Resolve parsing ambiguity\n\n - S8061210, CVE-2014-3566: Issues in TLS", "published": "2015-02-03T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81141", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2017-10-29T13:37:45"}, {"id": "REDHAT-RHSA-2015-0134.NASL", "type": "nessus", "title": "RHEL 5 : java-1.7.0-ibm (RHSA-2015:0134)", "description": "Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.\n\nRed Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nIBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-6549, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412)\n\nAll users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR8-FP10 release. All running instances of IBM Java must be restarted for the update to take effect.", "published": "2015-02-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81202", "cvelist": ["CVE-2014-8892", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2014-6587", "CVE-2015-0406", "CVE-2014-6593", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2014-8891"], "lastseen": "2017-10-29T13:42:04"}, {"id": "CENTOS_RHSA-2015-0067.NASL", "type": "nessus", "title": "CentOS 6 / 7 : java-1.7.0-openjdk (CESA-2015:0067) (POODLE)", "description": "Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.\n(CVE-2015-0412, CVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.\n(CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable SSL 3.0 support if needed. For additional information, refer to the Red Hat Bugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake.\nAn MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK.\nAn untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nNote: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.", "published": "2015-01-21T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=80868", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2017-10-29T13:36:10"}], "openvas": [{"id": "OPENVAS:1361412562310869156", "type": "openvas", "title": "Fedora Update for icu FEDORA-2015-3569", "description": "Check the version of icu", "published": "2015-04-03T00:00:00", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869156", "cvelist": ["CVE-2014-6585", "CVE-2014-6591"], "lastseen": "2017-07-25T10:52:54"}, {"id": "OPENVAS:1361412562310869116", "type": "openvas", "title": "Fedora Update for icu FEDORA-2015-3590", "description": "Check the version of icu", "published": "2015-03-22T00:00:00", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869116", "cvelist": ["CVE-2014-6585", "CVE-2014-6591"], "lastseen": "2017-07-25T10:53:35"}, {"id": "OPENVAS:1361412562310869313", "type": "openvas", "title": "Fedora Update for icu FEDORA-2015-6084", "description": "Check the version of icu", "published": "2015-04-29T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869313", "cvelist": ["CVE-2014-7923", "CVE-2014-6585", "CVE-2014-9654", "CVE-2014-7926", "CVE-2014-6591"], "lastseen": "2017-07-25T10:53:36"}, {"id": "OPENVAS:703323", "type": "openvas", "title": "Debian Security Advisory DSA 3323-1 (icu - security update)", "description": "Several vulnerabilities were discovered\nin the International Components for Unicode (ICU) library.\n\nCVE-2014-8146 \nThe Unicode Bidirectional Algorithm implementation does not properly\ntrack directionally isolated pieces of text, which allows remote\nattackers to cause a denial of service (heap-based buffer overflow)\nor possibly execute arbitrary code via crafted text.\n\nCVE-2014-8147 \nThe Unicode Bidirectional Algorithm implementation uses an integer\ndata type that is inconsistent with a header file, which allows\nremote attackers to cause a denial of service (incorrect malloc\nfollowed by invalid free) or possibly execute arbitrary code via\ncrafted text.\n\nCVE-2015-4760 \nThe Layout Engine was missing multiple boundary checks. These could\nlead to buffer overflows and memory corruption. A specially crafted\nfile could cause an application using ICU to parse untrusted font\nfiles to crash and, possibly, execute arbitrary code.\n\nAdditionally, it was discovered that the patch applied to ICU in DSA-3187-1\nfor CVE-2014-6585 \nwas incomplete, possibly leading to an invalid memory\naccess. This could allow remote attackers to disclose portion of private\nmemory via crafted font files.", "published": "2015-08-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=703323", "cvelist": ["CVE-2014-6585", "CVE-2014-8147", "CVE-2014-8146", "CVE-2015-4760"], "lastseen": "2017-07-24T12:53:35"}, {"id": "OPENVAS:1361412562310869314", "type": "openvas", "title": "Fedora Update for icu FEDORA-2015-6087", "description": "Check the version of icu", "published": "2015-04-29T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869314", "cvelist": ["CVE-2014-7923", "CVE-2014-6585", "CVE-2014-9654", "CVE-2014-7926", "CVE-2014-6591"], "lastseen": "2017-07-25T10:53:31"}, {"id": "OPENVAS:1361412562310703323", "type": "openvas", "title": "Debian Security Advisory DSA 3323-1 (icu - security update)", "description": "Several vulnerabilities were discovered\nin the International Components for Unicode (ICU) library.\n\nCVE-2014-8146 \nThe Unicode Bidirectional Algorithm implementation does not properly\ntrack directionally isolated pieces of text, which allows remote\nattackers to cause a denial of service (heap-based buffer overflow)\nor possibly execute arbitrary code via crafted text.\n\nCVE-2014-8147 \nThe Unicode Bidirectional Algorithm implementation uses an integer\ndata type that is inconsistent with a header file, which allows\nremote attackers to cause a denial of service (incorrect malloc\nfollowed by invalid free) or possibly execute arbitrary code via\ncrafted text.\n\nCVE-2015-4760 \nThe Layout Engine was missing multiple boundary checks. These could\nlead to buffer overflows and memory corruption. A specially crafted\nfile could cause an application using ICU to parse untrusted font\nfiles to crash and, possibly, execute arbitrary code.\n\nAdditionally, it was discovered that the patch applied to ICU in DSA-3187-1\nfor CVE-2014-6585 \nwas incomplete, possibly leading to an invalid memory\naccess. This could allow remote attackers to disclose portion of private\nmemory via crafted font files.", "published": "2015-08-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703323", "cvelist": ["CVE-2014-6585", "CVE-2014-8147", "CVE-2014-8146", "CVE-2015-4760"], "lastseen": "2018-04-06T11:28:34"}, {"id": "OPENVAS:1361412562310806130", "type": "openvas", "title": "Fedora Update for icu FEDORA-2015-16314", "description": "Check the version of icu", "published": "2015-10-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806130", "cvelist": ["CVE-2014-7923", "CVE-2014-6585", "CVE-2014-9654", "CVE-2014-7926", "CVE-2014-6591"], "lastseen": "2017-07-25T10:53:02"}, {"id": "OPENVAS:1361412562310805266", "type": "openvas", "title": "Oracle Java SE JRE Multiple Unspecified Vulnerabilities-04 Feb 2015 (Windows)", "description": "The host is installed with Oracle Java SE\n JRE and is prone to multiple unspecified vulnerabilities.", "published": "2015-02-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310805266", "cvelist": ["CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6593", "CVE-2015-0408", "CVE-2014-6591"], "lastseen": "2017-11-13T12:55:59"}, {"id": "OPENVAS:1361412562310108403", "type": "openvas", "title": "Oracle Java SE JRE Multiple Unspecified Vulnerabilities-04 Feb 2015 (Linux)", "description": "The host is installed with Oracle Java SE\n JRE and is prone to multiple unspecified vulnerabilities.", "published": "2015-02-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108403", "cvelist": ["CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6593", "CVE-2015-0408", "CVE-2014-6591"], "lastseen": "2018-03-12T12:01:47"}, {"id": "OPENVAS:1361412562310871303", "type": "openvas", "title": "RedHat Update for java-1.7.0-openjdk RHSA-2015:0068-01", "description": "Check the version of java-1.7.0-openjdk", "published": "2015-01-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871303", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2017-07-27T10:52:03"}], "debian": [{"id": "DSA-3323", "type": "debian", "title": "icu -- security update", "description": "Several vulnerabilities were discovered in the International Components for Unicode (ICU) library.\n\n * [CVE-2014-8146](<https://security-tracker.debian.org/tracker/CVE-2014-8146>)\n\nThe Unicode Bidirectional Algorithm implementation does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.\n\n * [CVE-2014-8147](<https://security-tracker.debian.org/tracker/CVE-2014-8147>)\n\nThe Unicode Bidirectional Algorithm implementation uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.\n\n * [CVE-2015-4760](<https://security-tracker.debian.org/tracker/CVE-2015-4760>)\n\nThe Layout Engine was missing multiple boundary checks. These could lead to buffer overflows and memory corruption. A specially crafted file could cause an application using ICU to parse untrusted font files to crash and, possibly, execute arbitrary code.\n\nAdditionally, it was discovered that the patch applied to ICU in DSA-3187-1 for [CVE-2014-6585](<https://security-tracker.debian.org/tracker/CVE-2014-6585>) was incomplete, possibly leading to an invalid memory access. This could allow remote attackers to disclose portion of private memory via crafted font files.\n\nFor the oldstable distribution (wheezy), these problems have been fixed in version 4.8.1.1-12+deb7u3.\n\nFor the stable distribution (jessie), these problems have been fixed in version 52.1-8+deb8u2.\n\nFor the testing distribution (stretch), these problems have been fixed in version 52.1-10.\n\nFor the unstable distribution (sid), these problems have been fixed in version 52.1-10.\n\nWe recommend that you upgrade your icu packages.", "published": "2015-08-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-3323", "cvelist": ["CVE-2014-6585", "CVE-2014-8147", "CVE-2014-8146", "CVE-2015-4760"], "lastseen": "2016-09-02T18:22:42"}, {"id": "DSA-3147", "type": "debian", "title": "openjdk-6 -- security update", "description": "Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.\n\nFor the stable distribution (wheezy), these problems have been fixed in version 6b34-1.13.6-1~deb7u1.\n\nWe recommend that you upgrade your openjdk-6 packages.", "published": "2015-01-30T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-3147", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-02T18:22:49"}, {"id": "DSA-3144", "type": "debian", "title": "openjdk-7 -- security update", "description": "Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.\n\nFor the stable distribution (wheezy), these problems have been fixed in version 7u75-2.5.4-1~deb7u1.\n\nFor the upcoming stable distribution (jessie), these problems will be fixed soon.\n\nFor the unstable distribution (sid), these problems have been fixed in version 7u75-2.5.4-1.\n\nWe recommend that you upgrade your openjdk-7 packages.", "published": "2015-01-29T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-3144", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-02T18:33:16"}, {"id": "DLA-219", "type": "debian", "title": "icu -- LTS security update", "description": "Several vulnerabilities were discovered in the International Components for Unicode (ICU) library:\n\n * [CVE-2013-1569](<https://security-tracker.debian.org/tracker/CVE-2013-1569>)\n\nGlyph table issue.\n\n * [CVE-2013-2383](<https://security-tracker.debian.org/tracker/CVE-2013-2383>)\n\nGlyph table issue.\n\n * [CVE-2013-2384](<https://security-tracker.debian.org/tracker/CVE-2013-2384>)\n\nFont layout issue.\n\n * [CVE-2013-2419](<https://security-tracker.debian.org/tracker/CVE-2013-2419>)\n\nFont processing issue.\n\n * [CVE-2014-6585](<https://security-tracker.debian.org/tracker/CVE-2014-6585>)\n\nOut-of-bounds read.\n\n * [CVE-2014-6591](<https://security-tracker.debian.org/tracker/CVE-2014-6591>)\n\nAdditional out-of-bounds reads.\n\n * [CVE-2014-7923](<https://security-tracker.debian.org/tracker/CVE-2014-7923>)\n\nMemory corruption in regular expression comparison.\n\n * [CVE-2014-7926](<https://security-tracker.debian.org/tracker/CVE-2014-7926>)\n\nMemory corruption in regular expression comparison.\n\n * [CVE-2014-7940](<https://security-tracker.debian.org/tracker/CVE-2014-7940>)\n\nUninitialized memory.\n\n * [CVE-2014-9654](<https://security-tracker.debian.org/tracker/CVE-2014-9654>)\n\nMore regular expression flaws.\n\nFor Debian 6 Squeeze, these issues have been fixed in icu version 4.4.1-8+squeeze3.", "published": "2015-05-14T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/2015/dla-219", "cvelist": ["CVE-2013-2384", "CVE-2014-7923", "CVE-2014-6585", "CVE-2014-7940", "CVE-2014-9654", "CVE-2013-2419", "CVE-2014-7926", "CVE-2014-6591", "CVE-2013-2383", "CVE-2013-1569"], "lastseen": "2016-09-02T12:57:36"}, {"id": "DSA-3187", "type": "debian", "title": "icu -- security update", "description": "Several vulnerabilities were discovered in the International Components for Unicode (ICU) library.\n\n * [CVE-2013-1569](<https://security-tracker.debian.org/tracker/CVE-2013-1569>)\n\nGlyph table issue.\n\n * [CVE-2013-2383](<https://security-tracker.debian.org/tracker/CVE-2013-2383>)\n\nGlyph table issue.\n\n * [CVE-2013-2384](<https://security-tracker.debian.org/tracker/CVE-2013-2384>)\n\nFont layout issue.\n\n * [CVE-2013-2419](<https://security-tracker.debian.org/tracker/CVE-2013-2419>)\n\nFont processing issue.\n\n * [CVE-2014-6585](<https://security-tracker.debian.org/tracker/CVE-2014-6585>)\n\nOut-of-bounds read.\n\n * [CVE-2014-6591](<https://security-tracker.debian.org/tracker/CVE-2014-6591>)\n\nAdditional out-of-bounds reads.\n\n * [CVE-2014-7923](<https://security-tracker.debian.org/tracker/CVE-2014-7923>)\n\nMemory corruption in regular expression comparison.\n\n * [CVE-2014-7926](<https://security-tracker.debian.org/tracker/CVE-2014-7926>)\n\nMemory corruption in regular expression comparison.\n\n * [CVE-2014-7940](<https://security-tracker.debian.org/tracker/CVE-2014-7940>)\n\nUninitialized memory.\n\n * [CVE-2014-9654](<https://security-tracker.debian.org/tracker/CVE-2014-9654>)\n\nMore regular expression flaws.\n\nFor the stable distribution (wheezy), these problems have been fixed in version 4.8.1.1-12+deb7u2.\n\nFor the upcoming stable (jessie) and unstable (sid) distributions, these problems have been fixed in version 52.1-7.1.\n\nWe recommend that you upgrade your icu packages.", "published": "2015-03-15T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-3187", "cvelist": ["CVE-2013-2384", "CVE-2014-7923", "CVE-2014-6585", "CVE-2014-7940", "CVE-2014-9654", "CVE-2013-2419", "CVE-2014-7926", "CVE-2014-6591", "CVE-2013-2383", "CVE-2013-1569"], "lastseen": "2016-09-02T18:37:08"}, {"id": "DLA-157", "type": "debian", "title": "openjdk-6 -- LTS security update", "description": "Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.\n\nFor Debian 6 Squeeze, these issues have been fixed in openjdk-6 version 6b34-1.13.6-1~deb6u1", "published": "2015-02-24T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/2015/dla-157", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-02T12:56:52"}], "redhat": [{"id": "RHSA-2015:0136", "type": "redhat", "title": "(RHSA-2015:0136) Important: java-1.5.0-ibm security update", "description": "IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Detailed\nvulnerability descriptions are linked from the IBM Security alerts\npage, listed in the References section. (CVE-2014-6585, CVE-2014-6591,\nCVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395, CVE-2015-0407,\nCVE-2015-0408, CVE-2015-0410)\n\nAll users of java-1.5.0-ibm are advised to upgrade to these updated\npackages, containing the IBM J2SE 5.0 SR16-FP9 release. All running\ninstances of IBM Java must be restarted for this update to take effect.\n", "published": "2015-02-05T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0136", "cvelist": ["CVE-2014-6585", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-8891", "CVE-2014-8892", "CVE-2015-0395", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410"], "lastseen": "2017-09-09T07:19:47"}, {"id": "RHSA-2015:0085", "type": "redhat", "title": "(RHSA-2015:0085) Important: java-1.6.0-openjdk security update", "description": "The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime\nEnvironment and the OpenJDK 6 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified\nbytecode from the class files. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nand RMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,\nCVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "published": "2015-01-26T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0085", "cvelist": ["CVE-2014-3566", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0383", "CVE-2015-0395", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412"], "lastseen": "2018-04-15T14:24:52"}, {"id": "RHSA-2015:0135", "type": "redhat", "title": "(RHSA-2015:0135) Critical: java-1.6.0-ibm security update", "description": "IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Detailed\nvulnerability descriptions are linked from the IBM Security alerts\npage, listed in the References section. (CVE-2014-6585, CVE-2014-6587,\nCVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892, CVE-2015-0395,\nCVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410,\nCVE-2015-0412)\n\nAll users of java-1.6.0-ibm are advised to upgrade to these updated\npackages, containing the IBM Java SE 6 SR16-FP3 release. All running\ninstances of IBM Java must be restarted for the update to take effect.\n", "published": "2015-02-05T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0135", "cvelist": ["CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-8891", "CVE-2014-8892", "CVE-2015-0395", "CVE-2015-0403", "CVE-2015-0406", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412"], "lastseen": "2017-09-09T07:19:27"}, {"id": "RHSA-2015:0067", "type": "redhat", "title": "(RHSA-2015:0067) Critical: java-1.7.0-openjdk security update", "description": "The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified\nbytecode from the class files. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nand RMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,\nCVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "published": "2015-01-21T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0067", "cvelist": ["CVE-2014-3566", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0383", "CVE-2015-0395", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412"], "lastseen": "2018-04-15T12:23:22"}, {"id": "RHSA-2015:0068", "type": "redhat", "title": "(RHSA-2015:0068) Important: java-1.7.0-openjdk security update", "description": "The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified\nbytecode from the class files. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nand RMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,\nCVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n", "published": "2015-01-20T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0068", "cvelist": ["CVE-2014-3566", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0383", "CVE-2015-0395", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412"], "lastseen": "2017-09-08T13:21:08"}, {"id": "RHSA-2015:0263", "type": "redhat", "title": "(RHSA-2015:0263) Low: Red Hat Satellite IBM Java Runtime security update", "description": "This update corrects several security vulnerabilities in the IBM Java\nRuntime Environment shipped as part of Red Hat Satellite 5.7. In a typical\noperating environment, these are of low security risk as the runtime is not\nused on untrusted applets.\n\nSeveral flaws were fixed in the IBM Java 2 Runtime Environment.\n(CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891,\nCVE-2014-8892, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407,\nCVE-2015-0408, CVE-2015-0410, CVE-2015-0412)\n\nUsers of Red Hat Satellite 5.7 are advised to upgrade to these updated\npackages, which contain the IBM Java SE 6 SR16-FP3 release. For this\nupdate to take effect, Red Hat Satellite must be restarted\n(\"/usr/sbin/rhn-satellite restart\"), as well as all running instances of\nIBM Java.\n", "published": "2015-02-24T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0263", "cvelist": ["CVE-2015-0395", "CVE-2014-8892", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6587", "CVE-2015-0406", "CVE-2014-6593", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2014-8891"], "lastseen": "2017-03-04T13:18:37"}, {"id": "RHSA-2015:0134", "type": "redhat", "title": "(RHSA-2015:0134) Critical: java-1.7.0-ibm security update", "description": "IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Detailed\nvulnerability descriptions are linked from the IBM Security alerts\npage, listed in the References section. (CVE-2014-6549, CVE-2014-6585,\nCVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892,\nCVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410,\nCVE-2015-0412)\n\nAll users of java-1.7.0-ibm are advised to upgrade to these updated\npackages, containing the IBM Java SE 7 SR8-FP10 release. All running\ninstances of IBM Java must be restarted for the update to take effect.\n", "published": "2015-02-05T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0134", "cvelist": ["CVE-2014-6549", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-8891", "CVE-2014-8892", "CVE-2015-0403", "CVE-2015-0406", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412"], "lastseen": "2017-09-09T07:20:11"}, {"id": "RHSA-2015:0133", "type": "redhat", "title": "(RHSA-2015:0133) Critical: java-1.7.1-ibm security update", "description": "IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment\nand the IBM Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Detailed\nvulnerability descriptions are linked from the IBM Security alerts\npage, listed in the References section. (CVE-2014-6549, CVE-2014-6585,\nCVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-8891, CVE-2014-8892,\nCVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410,\nCVE-2015-0412)\n\nAll users of java-1.7.1-ibm are advised to upgrade to these updated\npackages, containing the IBM Java SE 7R1 SR2-FP10 release. All running\ninstances of IBM Java must be restarted for the update to take effect.\n", "published": "2015-02-05T05:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0133", "cvelist": ["CVE-2014-6549", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-8891", "CVE-2014-8892", "CVE-2015-0403", "CVE-2015-0406", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412"], "lastseen": "2018-03-20T18:41:03"}, {"id": "RHSA-2015:0080", "type": "redhat", "title": "(RHSA-2015:0080) Critical: java-1.8.0-oracle security update", "description": "Oracle Java SE version 8 includes the Oracle Java Runtime Environment and\nthe Oracle Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the Oracle Java Runtime\nEnvironment and the Oracle Java Software Development Kit. Further\ninformation about these flaws can be found on the Oracle Java SE Critical\nPatch Update Advisory page, listed in the References section.\n(CVE-2014-3566, CVE-2014-6549, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591,\nCVE-2014-6593, CVE-2014-6601, CVE-2015-0383, CVE-2015-0395, CVE-2015-0403,\nCVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412,\nCVE-2015-0413, CVE-2015-0421, CVE-2015-0437)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nNote: With this update, the Oracle Java SE now disables the SSL 3.0\nprotocol to address the CVE-2014-3566 issue (also known as POODLE). Refer\nto the Red Hat Bugzilla bug linked to in the References section for\ninstructions on how to re-enable SSL 3.0 support if needed.\n\nAll users of java-1.8.0-oracle are advised to upgrade to these updated\npackages, which provide Oracle Java 8 Update 31 and resolve these issues.\nAll running instances of Oracle Java must be restarted for the update to\ntake effect.", "published": "2015-01-23T02:19:21", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0080", "cvelist": ["CVE-2014-3566", "CVE-2014-6549", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0383", "CVE-2015-0395", "CVE-2015-0403", "CVE-2015-0406", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412", "CVE-2015-0413", "CVE-2015-0421", "CVE-2015-0437"], "lastseen": "2018-02-01T02:09:50"}, {"id": "RHSA-2015:0079", "type": "redhat", "title": "(RHSA-2015:0079) Critical: java-1.7.0-oracle security update", "description": "Oracle Java SE version 7 includes the Oracle Java Runtime Environment and\nthe Oracle Java Software Development Kit.\n\nThis update fixes several vulnerabilities in the Oracle Java Runtime\nEnvironment and the Oracle Java Software Development Kit. Further\ninformation about these flaws can be found on the Oracle Java SE Critical\nPatch Update Advisory page, listed in the References section.\n(CVE-2014-3566, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593,\nCVE-2014-6601, CVE-2015-0383, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406,\nCVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412, CVE-2015-0413)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nNote: With this update, the Oracle Java SE now disables the SSL 3.0\nprotocol to address the CVE-2014-3566 issue (also known as POODLE). Refer\nto the Red Hat Bugzilla bug linked to in the References section for\ninstructions on how to re-enable SSL 3.0 support if needed.\n\nAll users of java-1.7.0-oracle are advised to upgrade to these updated\npackages, which provide Oracle Java 7 Update 75 and resolve these issues.\nAll running instances of Oracle Java must be restarted for the update to\ntake effect.", "published": "2015-01-23T02:17:01", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:0079", "cvelist": ["CVE-2014-3566", "CVE-2014-6585", "CVE-2014-6587", "CVE-2014-6591", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0383", "CVE-2015-0395", "CVE-2015-0403", "CVE-2015-0406", "CVE-2015-0407", "CVE-2015-0408", "CVE-2015-0410", "CVE-2015-0412", "CVE-2015-0413"], "lastseen": "2018-03-20T08:32:02"}], "amazon": [{"id": "ALAS-2015-471", "type": "amazon", "title": "Critical: java-1.7.0-openjdk", "description": "**Issue Overview:**\n\nA flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. ([CVE-2014-6601 __](<https://access.redhat.com/security/cve/CVE-2014-6601>))\n\nMultiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. ([CVE-2015-0412 __](<https://access.redhat.com/security/cve/CVE-2015-0412>), [CVE-2015-0408 __](<https://access.redhat.com/security/cve/CVE-2015-0408>))\n\nA flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. ([CVE-2015-0395 __](<https://access.redhat.com/security/cve/CVE-2015-0395>))\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. ([CVE-2015-0410 __](<https://access.redhat.com/security/cve/CVE-2015-0410>))\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. ([CVE-2014-3566 __](<https://access.redhat.com/security/cve/CVE-2014-3566>))\n\nNote: This update disables SSL 3.0 by default to address this issue. The jdk.tls.disabledAlgorithms security property can be used to re-enable SSL 3.0 support if needed. For additional information, refer to the Red Hat Bugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. ([CVE-2014-6593 __](<https://access.redhat.com/security/cve/CVE-2014-6593>))\n\nAn information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. ([CVE-2015-0407 __](<https://access.redhat.com/security/cve/CVE-2015-0407>))\n\nA NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. ([CVE-2014-6587 __](<https://access.redhat.com/security/cve/CVE-2014-6587>))\n\nMultiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. ([CVE-2014-6585 __](<https://access.redhat.com/security/cve/CVE-2014-6585>), [CVE-2014-6591 __](<https://access.redhat.com/security/cve/CVE-2014-6591>))\n\nMultiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. ([CVE-2015-0383 __](<https://access.redhat.com/security/cve/CVE-2015-0383>))\n\n \n**Affected Packages:** \n\n\njava-1.7.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.7.0-openjdk_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n java-1.7.0-openjdk-debuginfo-1.7.0.75-2.5.4.0.53.amzn1.i686 \n java-1.7.0-openjdk-1.7.0.75-2.5.4.0.53.amzn1.i686 \n java-1.7.0-openjdk-demo-1.7.0.75-2.5.4.0.53.amzn1.i686 \n java-1.7.0-openjdk-src-1.7.0.75-2.5.4.0.53.amzn1.i686 \n java-1.7.0-openjdk-devel-1.7.0.75-2.5.4.0.53.amzn1.i686 \n \n noarch: \n java-1.7.0-openjdk-javadoc-1.7.0.75-2.5.4.0.53.amzn1.noarch \n \n src: \n java-1.7.0-openjdk-1.7.0.75-2.5.4.0.53.amzn1.src \n \n x86_64: \n java-1.7.0-openjdk-devel-1.7.0.75-2.5.4.0.53.amzn1.x86_64 \n java-1.7.0-openjdk-1.7.0.75-2.5.4.0.53.amzn1.x86_64 \n java-1.7.0-openjdk-src-1.7.0.75-2.5.4.0.53.amzn1.x86_64 \n java-1.7.0-openjdk-debuginfo-1.7.0.75-2.5.4.0.53.amzn1.x86_64 \n java-1.7.0-openjdk-demo-1.7.0.75-2.5.4.0.53.amzn1.x86_64 \n \n \n", "published": "2015-01-22T14:18:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://alas.aws.amazon.com/ALAS-2015-471.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-28T21:03:56"}, {"id": "ALAS-2015-480", "type": "amazon", "title": "Important: java-1.6.0-openjdk", "description": "**Issue Overview:**\n\nA flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. ([CVE-2014-6601 __](<https://access.redhat.com/security/cve/CVE-2014-6601>))\n\nMultiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. ([CVE-2015-0412 __](<https://access.redhat.com/security/cve/CVE-2015-0412>), [CVE-2015-0408 __](<https://access.redhat.com/security/cve/CVE-2015-0408>))\n\nA flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. ([CVE-2015-0395 __](<https://access.redhat.com/security/cve/CVE-2015-0395>))\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. ([CVE-2015-0410 __](<https://access.redhat.com/security/cve/CVE-2015-0410>))\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. ([CVE-2014-3566 __](<https://access.redhat.com/security/cve/CVE-2014-3566>))\n\nNote: This update disables SSL 3.0 by default to address this issue. The jdk.tls.disabledAlgorithms security property can be used to re-enable SSL 3.0 support if needed. For additional information, refer to the Red Hat Bugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. ([CVE-2014-6593 __](<https://access.redhat.com/security/cve/CVE-2014-6593>))\n\nAn information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. ([CVE-2015-0407 __](<https://access.redhat.com/security/cve/CVE-2015-0407>))\n\nA NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. ([CVE-2014-6587 __](<https://access.redhat.com/security/cve/CVE-2014-6587>))\n\nMultiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. ([CVE-2014-6585 __](<https://access.redhat.com/security/cve/CVE-2014-6585>), [CVE-2014-6591 __](<https://access.redhat.com/security/cve/CVE-2014-6591>))\n\nMultiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. ([CVE-2015-0383 __](<https://access.redhat.com/security/cve/CVE-2015-0383>)) The [CVE-2015-0383 __](<https://access.redhat.com/security/cve/CVE-2015-0383>) issue was discovered by Red Hat.\n\n \n**Affected Packages:** \n\n\njava-1.6.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.6.0-openjdk_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n java-1.6.0-openjdk-devel-1.6.0.34-67.1.13.6.0.69.amzn1.i686 \n java-1.6.0-openjdk-javadoc-1.6.0.34-67.1.13.6.0.69.amzn1.i686 \n java-1.6.0-openjdk-1.6.0.34-67.1.13.6.0.69.amzn1.i686 \n java-1.6.0-openjdk-demo-1.6.0.34-67.1.13.6.0.69.amzn1.i686 \n java-1.6.0-openjdk-debuginfo-1.6.0.34-67.1.13.6.0.69.amzn1.i686 \n java-1.6.0-openjdk-src-1.6.0.34-67.1.13.6.0.69.amzn1.i686 \n \n src: \n java-1.6.0-openjdk-1.6.0.34-67.1.13.6.0.69.amzn1.src \n \n x86_64: \n java-1.6.0-openjdk-src-1.6.0.34-67.1.13.6.0.69.amzn1.x86_64 \n java-1.6.0-openjdk-devel-1.6.0.34-67.1.13.6.0.69.amzn1.x86_64 \n java-1.6.0-openjdk-demo-1.6.0.34-67.1.13.6.0.69.amzn1.x86_64 \n java-1.6.0-openjdk-1.6.0.34-67.1.13.6.0.69.amzn1.x86_64 \n java-1.6.0-openjdk-javadoc-1.6.0.34-67.1.13.6.0.69.amzn1.x86_64 \n java-1.6.0-openjdk-debuginfo-1.6.0.34-67.1.13.6.0.69.amzn1.x86_64 \n \n \n", "published": "2015-02-11T19:38:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://alas.aws.amazon.com/ALAS-2015-480.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-28T21:04:06"}, {"id": "ALAS-2015-472", "type": "amazon", "title": "Important: java-1.8.0-openjdk", "description": "**Issue Overview:**\n\nMultiple flaws were found in the way the Hotspot component in OpenJDK verified bytecode from the class files, and in the way this component generated code for bytecode. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. ([CVE-2014-6601 __](<https://access.redhat.com/security/cve/CVE-2014-6601>), [CVE-2015-0437 __](<https://access.redhat.com/security/cve/CVE-2015-0437>))\n\nMultiple improper permission check issues were discovered in the JAX-WS, Libraries, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. ([CVE-2015-0412 __](<https://access.redhat.com/security/cve/CVE-2015-0412>), [CVE-2014-6549 __](<https://access.redhat.com/security/cve/CVE-2014-6549>), [CVE-2015-0408 __](<https://access.redhat.com/security/cve/CVE-2015-0408>))\n\nA flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. ([CVE-2015-0395 __](<https://access.redhat.com/security/cve/CVE-2015-0395>))\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. ([CVE-2015-0410 __](<https://access.redhat.com/security/cve/CVE-2015-0410>))\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. ([CVE-2014-3566 __](<https://access.redhat.com/security/cve/CVE-2014-3566>))\n\nNote: This update disables SSL 3.0 by default to address this issue. The jdk.tls.disabledAlgorithms security property can be used to re-enable SSL 3.0 support if needed. For additional information, refer to the Red Hat Bugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. ([CVE-2014-6593 __](<https://access.redhat.com/security/cve/CVE-2014-6593>))\n\nAn information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. ([CVE-2015-0407 __](<https://access.redhat.com/security/cve/CVE-2015-0407>))\n\nA NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. ([CVE-2014-6587 __](<https://access.redhat.com/security/cve/CVE-2014-6587>))\n\nMultiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. ([CVE-2014-6585 __](<https://access.redhat.com/security/cve/CVE-2014-6585>), [CVE-2014-6591 __](<https://access.redhat.com/security/cve/CVE-2014-6591>))\n\nMultiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. ([CVE-2015-0383 __](<https://access.redhat.com/security/cve/CVE-2015-0383>))\n\n \n**Affected Packages:** \n\n\njava-1.8.0-openjdk\n\n \n**Issue Correction:** \nRun _yum update java-1.8.0-openjdk_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n java-1.8.0-openjdk-1.8.0.31-2.b13.5.amzn1.i686 \n java-1.8.0-openjdk-demo-1.8.0.31-2.b13.5.amzn1.i686 \n java-1.8.0-openjdk-debuginfo-1.8.0.31-2.b13.5.amzn1.i686 \n java-1.8.0-openjdk-headless-1.8.0.31-2.b13.5.amzn1.i686 \n java-1.8.0-openjdk-src-1.8.0.31-2.b13.5.amzn1.i686 \n java-1.8.0-openjdk-devel-1.8.0.31-2.b13.5.amzn1.i686 \n \n noarch: \n java-1.8.0-openjdk-javadoc-1.8.0.31-2.b13.5.amzn1.noarch \n \n src: \n java-1.8.0-openjdk-1.8.0.31-2.b13.5.amzn1.src \n \n x86_64: \n java-1.8.0-openjdk-1.8.0.31-2.b13.5.amzn1.x86_64 \n java-1.8.0-openjdk-headless-1.8.0.31-2.b13.5.amzn1.x86_64 \n java-1.8.0-openjdk-debuginfo-1.8.0.31-2.b13.5.amzn1.x86_64 \n java-1.8.0-openjdk-devel-1.8.0.31-2.b13.5.amzn1.x86_64 \n java-1.8.0-openjdk-src-1.8.0.31-2.b13.5.amzn1.x86_64 \n java-1.8.0-openjdk-demo-1.8.0.31-2.b13.5.amzn1.x86_64 \n \n \n", "published": "2015-01-22T14:20:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://alas.aws.amazon.com/ALAS-2015-472.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0437"], "lastseen": "2016-09-28T21:03:58"}], "ubuntu": [{"id": "USN-2522-3", "type": "ubuntu", "title": "ICU vulnerabilities", "description": "USN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the font patches caused a regression when using LibreOffice Calc. The patches have now been updated to fix the regression.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nIt was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)\n\nIt was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-6585, CVE-2014-6591)\n\nIt was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)\n\nIt was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940)", "published": "2015-03-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2522-3/", "cvelist": ["CVE-2013-2384", "CVE-2014-7923", "CVE-2014-6585", "CVE-2014-7940", "CVE-2014-9654", "CVE-2013-2419", "CVE-2014-7926", "CVE-2014-6591", "CVE-2013-2383", "CVE-2013-1569"], "lastseen": "2018-03-29T18:17:43"}, {"id": "USN-2522-1", "type": "ubuntu", "title": "ICU vulnerabilities", "description": "It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)\n\nIt was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-6585, CVE-2014-6591)\n\nIt was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)\n\nIt was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940)", "published": "2015-03-05T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2522-1/", "cvelist": ["CVE-2013-2384", "CVE-2014-7923", "CVE-2014-6585", "CVE-2014-7940", "CVE-2014-9654", "CVE-2013-2419", "CVE-2014-7926", "CVE-2014-6591", "CVE-2013-2383", "CVE-2013-1569"], "lastseen": "2018-03-29T18:20:16"}, {"id": "USN-2522-2", "type": "ubuntu", "title": "ICU regression", "description": "USN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the font patches caused a regression when using LibreOffice Calc. The patches have been temporarily backed out until the regression is investigated.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nIt was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)\n\nIt was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-6585, CVE-2014-6591)\n\nIt was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)\n\nIt was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940)", "published": "2015-03-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2522-2/", "cvelist": ["CVE-2013-2384", "CVE-2014-7923", "CVE-2014-6585", "CVE-2014-7940", "CVE-2014-9654", "CVE-2013-2419", "CVE-2014-7926", "CVE-2014-6591", "CVE-2013-2383", "CVE-2013-1569"], "lastseen": "2018-03-29T18:21:26"}, {"id": "USN-2486-1", "type": "ubuntu", "title": "OpenJDK 6 vulnerabilities", "description": "Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-3566, CVE-2014-6587, CVE-2014-6601, CVE-2015-0395, CVE-2015-0408, CVE-2015-0412)\n\nSeveral vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2014-6585, CVE-2014-6591, CVE-2015-0400, CVE-2015-0407)\n\nA vulnerability was discovered in the OpenJDK JRE related to information disclosure and integrity. An attacker could exploit this to expose sensitive data over the network. (CVE-2014-6593)\n\nA vulnerability was discovered in the OpenJDK JRE related to integrity and availability. An attacker could exploit this to cause a denial of service. (CVE-2015-0383)\n\nA vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could this exploit to cause a denial of service. (CVE-2015-0410)", "published": "2015-01-27T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2486-1/", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2018-03-29T18:19:16"}, {"id": "USN-2487-1", "type": "ubuntu", "title": "OpenJDK 7 vulnerabilities", "description": "Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-3566, CVE-2014-6587, CVE-2014-6601, CVE-2015-0395, CVE-2015-0408, CVE-2015-0412)\n\nSeveral vulnerabilities were discovered in the OpenJDK JRE related to information disclosure. An attacker could exploit these to expose sensitive data over the network. (CVE-2014-6585, CVE-2014-6591, CVE-2015-0400, CVE-2015-0407)\n\nA vulnerability was discovered in the OpenJDK JRE related to information disclosure and integrity. An attacker could exploit this to expose sensitive data over the network. (CVE-2014-6593)\n\nA vulnerability was discovered in the OpenJDK JRE related to integrity and availability. An attacker could exploit this to cause a denial of service. (CVE-2015-0383)\n\nA vulnerability was discovered in the OpenJDK JRE related to availability. An attacker could this exploit to cause a denial of service. (CVE-2015-0410)\n\nA vulnerability was discovered in the OpenJDK JRE related to data integrity. (CVE-2015-0413)", "published": "2015-01-28T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2487-1/", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2018-03-29T18:21:23"}], "suse": [{"id": "SUSE-SU-2015:0503-1", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "description": "This update fixes 13 security issues.\n\n These security issues were fixed:\n - CVE-2015-0395: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85,\n 7u72, and 8u25 allowed remote attackers to affect confidentiality,\n integrity, and availability via unknown vectors related to Hotspot\n (bnc#914041).\n - CVE-2015-0400: Unspecified vulnerability in Oracle Java SE 6u85, 7u72,\n and 8u25 allowed remote attackers to affect confidentiality via unknown\n vectors related to Libraries (bnc#914041).\n - CVE-2015-0383: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85,\n 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and\n R28.3.4 allowed local users to affect integrity and availability via\n unknown vectors related to Hotspot (bnc#914041).\n - CVE-2015-0412: Unspecified vulnerability in Oracle Java SE 6u85, 7u72,\n and 8u25 allowed remote attackers to affect confidentiality, integrity,\n and availability via vectors related to JAX-WS (bnc#914041).\n - CVE-2015-0407: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85,\n 7u72, and 8u25 allowed remote attackers to affect confidentiality via\n unknown vectors related to Swing (bnc#914041).\n - CVE-2015-0408: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85,\n 7u72, and 8u25 allowed remote attackers to affect confidentiality,\n integrity, and availability via vectors related to RMI (bnc#914041).\n - CVE-2014-6585: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85,\n 7u72, and 8u25 allowed remote attackers to affect confidentiality via\n unknown vectors reelated to 2D, a different vulnerability than\n CVE-2014-6591 (bnc#914041).\n - CVE-2014-6587: Unspecified vulnerability in Oracle Java SE 6u85, 7u72,\n and 8u25 allowed local users to affect confidentiality, integrity, and\n availability via unknown vectors related to Libraries (bnc#914041).\n - CVE-2014-6591: Unspecified vulnerability in the Java SE component in\n Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to\n affect confidentiality via unknown vectors related to 2D, a different\n vulnerability than CVE-2014-6585 (bnc#914041).\n - CVE-2014-6593: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85,\n 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and\n 28.3.4 allowed remote attackers to affect confidentiality and integrity\n via vectors related to JSSE (bnc#914041).\n - CVE-2014-6601: Unspecified vulnerability in Oracle Java SE 6u85, 7u72,\n and 8u25 allowed remote attackers to affect confidentiality, integrity,\n and availability via unknown vectors related to Hotspot (bnc#914041).\n - CVE-2015-0410: Unspecified vulnerability in the Java SE, Java SE\n Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and\n 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4\n allowed remote attackers to affect availability via unknown vectors\n related to Security (bnc#914041).\n - CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i\n and other products, used nondeterministic CBC padding, which made it\n easier for man-in-the-middle attackers to obtain cleartext data via a\n padding-oracle attack, aka the &quot;POODLE&quot; issue (bnc#901223).\n\n These non-security issues were fixed:\n - Update protocol support (S8046656).\n - Fewer escapes from escape analysis (S8047130).\n - Better GC validation (S8049253).\n - TLAB stability (S8055479).\n\n", "published": "2015-03-16T12:05:47", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2016-09-04T11:26:30"}, {"id": "OPENSUSE-SU-2015:0190-1", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "description": "OpenJDK was updated to 2.5.4 - OpenJDK 7u75 to fix security issues and\n bugs:\n\n * Security fixes\n - S8046656: Update protocol support\n - S8047125, CVE-2015-0395: (ref) More phantom object references\n - S8047130: Fewer escapes from escape analysis\n - S8048035, CVE-2015-0400: Ensure proper proxy protocols\n - S8049253: Better GC validation\n - S8050807, CVE-2015-0383: Better performing performance data handling\n - S8054367, CVE-2015-0412: More references for endpoints\n - S8055304, CVE-2015-0407: More boxing for DirectoryComboBoxModel\n - S8055309, CVE-2015-0408: RMI needs better transportation considerations\n - S8055479: TLAB stability\n - S8055489, CVE-2014-6585: Better substitution formats\n - S8056264, CVE-2014-6587: Multicast support improvements\n - S8056276, CVE-2014-6591: Fontmanager feature improvements\n - S8057555, CVE-2014-6593: Less cryptic cipher suite management\n - S8058982, CVE-2014-6601: Better verification of an exceptional\n invokespecial\n - S8059485, CVE-2015-0410: Resolve parsing ambiguity\n - S8061210, CVE-2014-3566: Issues in TLS\n\n", "published": "2015-02-02T12:04:48", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2016-09-04T11:38:48"}, {"id": "SUSE-SU-2015:0336-1", "type": "suse", "title": "Security update for java-1_7_0-openjdk (important)", "description": "java-1_7_0-openjdk was updated to fix 19 security issues.\n\n Details are available at\n <a rel=\"nofollow\" href=\"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#A\">http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#A</a>\n ppendixJAVA\n &lt;<a rel=\"nofollow\" href=\"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#\">http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#</a>\n AppendixJAVA&gt;\n\n Security Issues:\n\n * CVE-2014-6601\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6601\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6601</a>&gt;\n * CVE-2015-0412\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0412\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0412</a>&gt;\n * CVE-2014-6549\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6549\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6549</a>&gt;\n * CVE-2015-0408\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0408\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0408</a>&gt;\n * CVE-2015-0395\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0395\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0395</a>&gt;\n * CVE-2015-0437\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0437\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0437</a>&gt;\n * CVE-2015-0403\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0403\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0403</a>&gt;\n * CVE-2015-0421\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0421\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0421</a>&gt;\n * CVE-2015-0406\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0406\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0406</a>&gt;\n * CVE-2015-0383\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0383\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0383</a>&gt;\n * CVE-2015-0400\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400</a>&gt;\n * CVE-2015-0407\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0407\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0407</a>&gt;\n * CVE-2015-0410\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410</a>&gt;\n * CVE-2014-6587\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6587\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6587</a>&gt;\n * CVE-2014-3566\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566</a>&gt;\n * CVE-2014-6593\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593</a>&gt;\n * CVE-2014-6585\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585</a>&gt;\n * CVE-2014-6591\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591</a>&gt;\n * CVE-2015-0413\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0413\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0413</a>&gt;\n\n", "published": "2015-02-20T00:04:57", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2016-09-04T12:02:22"}], "oraclelinux": [{"id": "ELSA-2015-0085", "type": "oraclelinux", "title": "java-1.6.0-openjdk security update", "description": "[1:1.6.0.33-1.13.6.1.0.1.el5_11]\n- Add oracle-enterprise.patch\n[1:1.6.0.34-1.13.6.1]\n- Update to latest 1.13.6 release candidate tarball\n- Fixes a number of issues found with b34:\n- * OJ51, PR2187: Sync patch for 4873188 with 7 version\n- * OJ52, PR2185: Application of 6786276 introduces compatibility issue\n- * OJ53, PR2181: strict-aliasing warnings issued on PPC32\n- * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport\n- * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: 'Bad address'\n- * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine\n- Also includes PR2180, so patch dropped from RPM.\n- Resolves: rhbz#1180289\n[1:1.6.0.34-1.13.6.0]\n- Apply pr2180.patch to work around issue with older autotools.\n- Resolves: rhbz#1180289\n[1:1.6.0.34-1.13.6.0]\n- Update to IcedTea 1.13.6\n- Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.\n- Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.\n- Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.\n- Add US_export_policy.jar and local_policy.jar to packages.\n- Resolves: rhbz#1180289", "published": "2015-01-26T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-0085.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-04T11:16:13"}, {"id": "ELSA-2015-0068", "type": "oraclelinux", "title": "java-1.7.0-openjdk security update", "description": "[1:1.7.0.75-2.5.4.0.0.1.el5_11]\n- Add oracle-enterprise.patch\n- Fix DISTRO_NAME to 'Oracle Linux'\n[1:1.7.0.75-2.5.4.0]\n- Bump to 2.5.4 using OpenJDK 7u75 b13.\n- Fix elliptic curve list as part of fsg.sh\n- Resolves: rhbz#1180294", "published": "2015-01-21T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-0068.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-04T11:16:48"}, {"id": "ELSA-2015-0067", "type": "oraclelinux", "title": "java-1.7.0-openjdk security update", "description": "[1:1.7.0.75-2.5.4.0.0.1.el6_6]\n- Update DISTRO_NAME in specfile\n[1:1.7.0.75-2.5.4.0]\n- Fix abrt_friendly_hs_log_jdk7.patch to apply again.\n[1:1.7.0.75-2.5.4.0]\n- Bump to 2.5.4 using OpenJDK 7u75 b13.\n- Remove earlier temporary patch for RH1146622 (included upstream)\n- Fix elliptic curve list as part of fsg.sh\n- Resolves: rhbz#1180295\n- Resolves: rhbz#1173706", "published": "2015-01-21T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-0067.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-09-04T11:17:06"}, {"id": "ELSA-2015-0069", "type": "oraclelinux", "title": "java-1.8.0-openjdk security update", "description": "[1:1.8.0.31-1.b13]\n- Update to January CPU patch update.\n- Resolves: RHBZ#1180299\n[1:1.8.0.25-4.b17]\n- updated aarch64 sources\n- epoch synced to 1\n- all ppcs excluded from classes dump(1156151)\n- Resolves: rhbz#1173706", "published": "2015-01-21T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-0069.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0437"], "lastseen": "2016-09-04T11:16:17"}], "f5": [{"id": "SOL16352", "type": "f5", "title": "SOL16352 - Multiple OpenJDK vulnerabilities", "description": "Vulnerability Recommended Actions\n\nNone\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n", "published": "2015-04-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://support.f5.com/kb/en-us/solutions/public/16000/300/sol16352.html", "cvelist": ["CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2016-11-09T00:09:29"}, {"id": "F5:K16352", "type": "f5", "title": "Multiple OpenJDK vulnerabilities", "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerabilities, and for information about releases or hotfixes that address the vulnerabilities, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP AAM| None| 11.4.0 - 11.6.0| Not vulnerable| None \nBIG-IP AFM| None| 11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP Analytics| None| 11.0.0 - 11.6.0| Not vulnerable| None \nBIG-IP APM| None| 11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP ASM| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP GTM| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP Link Controller| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP PEM| None| 11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP PSM| None| 11.0.0 - 11.4.1 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.0.0 - 11.3.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP WOM| None| 11.0.0 - 11.3.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nARX| None| 6.0.0 - 6.4.0| Not vulnerable| None \nEnterprise Manager| None| 3.0.0 - 3.1.1 \n2.1.0 - 2.3.0| Not vulnerable| None \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| Not vulnerable| None \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.2.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nLineRate| None| 2.2.0 - 2.5.0 \n1.6.0 - 1.6.4| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| None| 4.0.0 - 4.1.0 \n3.3.2 - 3.5.1| Not vulnerable| None \nBIG-IP Edge Clients for Android| None| 2.0.0 - 2.0.6| Not vulnerable| None \nBIG-IP Edge Clients for Apple iOS| None| 2.0.0 - 2.0.4 \n1.0.5 - 1.0.6| Not vulnerable| None \nBIG-IP Edge Clients for Linux| None| 6035.x - 7110.x| Not vulnerable| None \nBIG-IP Edge Clients for MAC OS X| None| 6035.x - 7110.x| Not vulnerable| None \nBIG-IP Edge Clients for Windows| None| 6035.x - 7110.x| Not vulnerable| None \nBIG-IP Edge Clients Windows Phone 8.1| None| 1.0.0.x| Not vulnerable| None \nBIG-IP Edge Portal for Android| None| 1.0.0 - 1.0.2| Not vulnerable| None \nBIG-IP Edge Portal for Apple iOS| None| 1.0.0 - 1.0.3| Not vulnerable| None \n \n**Note**: As of February 17, 2015, AskF5 Security Advisory articles include the** Severity** value. Security Advisory articles published before this date do not list a** Severity** value.\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n", "published": "2015-04-02T23:52:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://support.f5.com/csp/article/K16352", "cvelist": ["CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2017-06-08T00:16:30"}, {"id": "F5:K16354", "type": "f5", "title": "Multiple JavaSE client-side vulnerabilities", "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP AAM| None| 11.4.0 - 11.6.0| Not vulnerable| None \nBIG-IP AFM| None| 11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP Analytics| None| 11.0.0 - 11.6.0| Not vulnerable| None \nBIG-IP APM| None| 11.0.0 - 11.6.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP ASM| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| Not vulnerable| None \nBIG-IP GTM| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP Link Controller| None| 11.0.0 - 11.6.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP PEM| None| 11.3.0 - 11.6.0| Not vulnerable| None \nBIG-IP PSM| None| 11.0.0 - 11.4.1 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.0.0 - 11.3.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nBIG-IP WOM| None| 11.0.0 - 11.3.0 \n10.0.0 - 10.2.4| Not vulnerable| None \nARX| None| 6.0.0 - 6.4.0| Not vulnerable| None \nEnterprise Manager| None| 3.0.0 - 3.1.1 \n2.1.0 - 2.3.0| Not vulnerable| None \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| Not vulnerable| None \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.2.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nLineRate| None| 2.2.0 - 2.5.0 \n1.6.0 - 1.6.4| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| None| 4.0.0 - 4.1.0 \n3.3.2 - 3.5.1| Not vulnerable| None \nBIG-IP Edge Clients for Android| None| 2.0.0 - 2.0.6| Not vulnerable| None \nBIG-IP Edge Clients for Apple iOS| None| 2.0.0 - 2.0.4 \n1.0.5 - 1.0.6| Not vulnerable| None \nBIG-IP Edge Clients for Linux| None| 6035.x - 7110.x| Not vulnerable| None \nBIG-IP Edge Clients for MAC OS X| None| 6035.x - 7110.x| Not vulnerable| None \nBIG-IP Edge Clients for Windows| None| 6035.x - 7110.x| Not vulnerable| None \nBIG-IP Edge Clients Windows Phone 8.1| None| 1.0.0.x| Not vulnerable| None \nBIG-IP Edge Portal for Android| None| 1.0.0 - 1.0.2| Not vulnerable| None \nBIG-IP Edge Portal for Apple iOS| None| 1.0.0 - 1.0.3| Not vulnerable| None \n \n**Note**: As of February 17, 2015, AskF5 Security Advisory articles include the **Severity** value. Security Advisory articles published before this date do not list a **Severity** value.\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n", "published": "2015-04-03T00:05:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://support.f5.com/csp/article/K16354", "cvelist": ["CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2014-6549", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2017-06-08T00:16:16"}, {"id": "SOL16354", "type": "f5", "title": "SOL16354 - Multiple JavaSE client-side vulnerabilities", "description": "Vulnerability Recommended Actions\n\nNone\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n", "published": "2015-04-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://support.f5.com/kb/en-us/solutions/public/16000/300/sol16354.html", "cvelist": ["CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2014-6549", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2016-11-09T00:10:01"}], "centos": [{"id": "CESA-2015:0067", "type": "centos", "title": "java security update", "description": "**CentOS Errata and Security Advisory** CESA-2015:0067\n\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified\nbytecode from the class files. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nand RMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,\nCVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nNote: If the web browser plug-in provided by the icedtea-web package was\ninstalled, the issues exposed via Java applets could have been exploited\nwithout user interaction if a user visited a malicious website.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020889.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020891.html\n\n**Affected packages:**\njava-1.7.0-openjdk\njava-1.7.0-openjdk-accessibility\njava-1.7.0-openjdk-demo\njava-1.7.0-openjdk-devel\njava-1.7.0-openjdk-headless\njava-1.7.0-openjdk-javadoc\njava-1.7.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-0067.html", "published": "2015-01-21T05:42:52", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2015-January/020889.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2017-10-03T18:24:49"}, {"id": "CESA-2015:0068", "type": "centos", "title": "java security update", "description": "**CentOS Errata and Security Advisory** CESA-2015:0068\n\n\nThe java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime\nEnvironment and the OpenJDK 7 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified\nbytecode from the class files. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nand RMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,\nCVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nAll users of java-1.7.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020888.html\n\n**Affected packages:**\njava-1.7.0-openjdk\njava-1.7.0-openjdk-demo\njava-1.7.0-openjdk-devel\njava-1.7.0-openjdk-javadoc\njava-1.7.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-0068.html", "published": "2015-01-21T05:35:44", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2015-January/020888.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2017-10-03T18:25:37"}, {"id": "CESA-2015:0085", "type": "centos", "title": "java security update", "description": "**CentOS Errata and Security Advisory** CESA-2015:0085\n\n\nThe java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime\nEnvironment and the OpenJDK 6 Java Software Development Kit.\n\nA flaw was found in the way the Hotspot component in OpenJDK verified\nbytecode from the class files. An untrusted Java application or applet\ncould possibly use this flaw to bypass Java sandbox restrictions.\n(CVE-2014-6601)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nand RMI components in OpenJDK. An untrusted Java application or applet\ncould use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412,\nCVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nAll users of java-1.6.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020898.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020900.html\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020903.html\n\n**Affected packages:**\njava-1.6.0-openjdk\njava-1.6.0-openjdk-demo\njava-1.6.0-openjdk-devel\njava-1.6.0-openjdk-javadoc\njava-1.6.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-0085.html", "published": "2015-01-26T19:17:49", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2015-January/020898.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412"], "lastseen": "2017-10-03T18:25:00"}, {"id": "CESA-2015:0069", "type": "centos", "title": "java security update", "description": "**CentOS Errata and Security Advisory** CESA-2015:0069\n\n\nThe java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime\nEnvironment and the OpenJDK 8 Java Software Development Kit.\n\nMultiple flaws were found in the way the Hotspot component in OpenJDK\nverified bytecode from the class files, and in the way this component\ngenerated code for bytecode. An untrusted Java application or applet could\npossibly use these flaws to bypass Java sandbox restrictions.\n(CVE-2014-6601, CVE-2015-0437)\n\nMultiple improper permission check issues were discovered in the JAX-WS,\nLibraries, and RMI components in OpenJDK. An untrusted Java application or\napplet could use these flaws to bypass Java sandbox restrictions.\n(CVE-2015-0412, CVE-2014-6549, CVE-2015-0408)\n\nA flaw was found in the way the Hotspot garbage collector handled phantom\nreferences. An untrusted Java application or applet could use this flaw to\ncorrupt the Java Virtual Machine memory and, possibly, execute arbitrary\ncode, bypassing Java sandbox restrictions. (CVE-2015-0395)\n\nA flaw was found in the way the DER (Distinguished Encoding Rules) decoder\nin the Security component in OpenJDK handled negative length values. A\nspecially crafted, DER-encoded input could cause a Java application to\nenter an infinite loop when decoded. (CVE-2015-0410)\n\nA flaw was found in the way the SSL 3.0 protocol handled padding bytes when\ndecrypting messages that were encrypted using block ciphers in cipher block\nchaining (CBC) mode. This flaw could possibly allow a man-in-the-middle\n(MITM) attacker to decrypt portions of the cipher text using a padding\noracle attack. (CVE-2014-3566)\n\nNote: This update disables SSL 3.0 by default to address this issue.\nThe jdk.tls.disabledAlgorithms security property can be used to re-enable\nSSL 3.0 support if needed. For additional information, refer to the Red Hat\nBugzilla bug linked to in the References section.\n\nIt was discovered that the SSL/TLS implementation in the JSSE component in\nOpenJDK failed to properly check whether the ChangeCipherSpec was received\nduring the SSL/TLS connection handshake. An MITM attacker could possibly\nuse this flaw to force a connection to be established without encryption\nbeing enabled. (CVE-2014-6593)\n\nAn information leak flaw was found in the Swing component in OpenJDK. An\nuntrusted Java application or applet could use this flaw to bypass certain\nJava sandbox restrictions. (CVE-2015-0407)\n\nA NULL pointer dereference flaw was found in the MulticastSocket\nimplementation in the Libraries component of OpenJDK. An untrusted Java\napplication or applet could possibly use this flaw to bypass certain Java\nsandbox restrictions. (CVE-2014-6587)\n\nMultiple boundary check flaws were found in the font parsing code in the 2D\ncomponent in OpenJDK. A specially crafted font file could allow an\nuntrusted Java application or applet to disclose portions of the Java\nVirtual Machine memory. (CVE-2014-6585, CVE-2014-6591)\n\nMultiple insecure temporary file use issues were found in the way the\nHotspot component in OpenJDK created performance statistics and error log\nfiles. A local attacker could possibly make a victim using OpenJDK\noverwrite arbitrary files using a symlink attack. (CVE-2015-0383)\n\nThe CVE-2015-0383 issue was discovered by Red Hat.\n\nAll users of java-1.8.0-openjdk are advised to upgrade to these updated\npackages, which resolve these issues. All running instances of OpenJDK Java\nmust be restarted for the update to take effect.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020890.html\n\n**Affected packages:**\njava-1.8.0-openjdk\njava-1.8.0-openjdk-demo\njava-1.8.0-openjdk-devel\njava-1.8.0-openjdk-headless\njava-1.8.0-openjdk-javadoc\njava-1.8.0-openjdk-src\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-0069.html", "published": "2015-01-21T05:43:50", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2015-January/020890.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0437"], "lastseen": "2017-10-03T18:26:14"}], "archlinux": [{"id": "ASA-201501-18", "type": "archlinux", "title": "jdk7-openjdk: multiple issues", "description": "- CVE-2014-3566 (man-in-the-middle)\nNondeterministic CBC padding, which makes it easier for\nman-in-the-middle attackers to obtain cleartext data via a\npadding-oracle attack, aka the &quot;POODLE&quot; issue.\n\n- CVE-2014-6585 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6587 (privilege escalation)\nMulticastSocket NULL pointer dereference allows local users to affect\nconfidentiality, integrity, and availability.\n\n- CVE-2014-6591 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6593 (man-in-the-middle)\nIncorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows\nremote attackers to affect confidentiality and integrity.\n\n- CVE-2014-6601 (arbitrary code execution)\nClass verifier insufficient invokespecial calls verification related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0383 (denial of service)\nInsecure hsperfdata temporary file handling related to Hotspot allows\nlocal users to affect integrity and availability.\n\n- CVE-2015-0395 (arbitrary code execution)\nPhantom references handling issue in garbage collector related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0400 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of Java SE accessible data.\n\n- CVE-2015-0403 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0406 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of accessible data and\nability to cause a partial denial of service.\n\n- CVE-2015-0407 (information disclosure)\nDirectory information leak via file chooser related to Swing allows\nremote attackers to affect confidentiality.\n\n- CVE-2015-0408 (arbitrary code execution)\nIncorrect context class loader use in RMI transport allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0410 (denial of service)\nDER decoder infinite loop allows remote attackers to affect availability.\n\n- CVE-2015-0412 (arbitrary code execution)\nInsufficient code privileges checks related to JAX-WS allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0413 (unauthorized modification)\nSuccessful attack of this vulnerability can result in unauthorized\nupdate, insert or delete access to some Java SE accessible data.", "published": "2015-01-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://lists.archlinux.org/pipermail/arch-security/2015-January/000216.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2016-09-02T18:44:40"}, {"id": "ASA-201501-14", "type": "archlinux", "title": "jdk8-openjdk: multiple issues", "description": "- CVE-2014-3566 (man-in-the-middle)\nNondeterministic CBC padding, which makes it easier for\nman-in-the-middle attackers to obtain cleartext data via a\npadding-oracle attack, aka the &quot;POODLE&quot; issue.\n\n- CVE-2014-6549 (arbitrary code execution)\nIncorrect class loader permission check in ClassLoader getParent()\nallows remote attackers to affect confidentiality, integrity, and\navailability.\n\n- CVE-2014-6585 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6587 (privilege escalation)\nMulticastSocket NULL pointer dereference allows local users to affect\nconfidentiality, integrity, and availability.\n\n- CVE-2014-6591 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6593 (man-in-the-middle)\nIncorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows\nremote attackers to affect confidentiality and integrity.\n\n- CVE-2014-6601 (arbitrary code execution)\nClass verifier insufficient invokespecial calls verification related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0383 (denial of service)\nInsecure hsperfdata temporary file handling related to Hotspot allows\nlocal users to affect integrity and availability.\n\n- CVE-2015-0395 (arbitrary code execution)\nPhantom references handling issue in garbage collector related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0400 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of Java SE accessible data.\n\n- CVE-2015-0403 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0406 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of accessible data and\nability to cause a partial denial of service.\n\n- CVE-2015-0407 (information disclosure)\nDirectory information leak via file chooser related to Swing allows\nremote attackers to affect confidentiality.\n\n- CVE-2015-0408 (arbitrary code execution)\nIncorrect context class loader use in RMI transport allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0410 (denial of service)\nDER decoder infinite loop allows remote attackers to affect availability.\n\n- CVE-2015-0412 (arbitrary code execution)\nInsufficient code privileges checks related to JAX-WS allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0413 (unauthorized modification)\nSuccessful attack of this vulnerability can result in unauthorized\nupdate, insert or delete access to some Java SE accessible data.\n\n- CVE-2015-0421 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0437 (arbitrary code execution)\nCode generation issue related to Hotspot allows remote attackers to\naffect confidentiality, integrity, and availability.", "published": "2015-01-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://lists.archlinux.org/pipermail/arch-security/2015-January/000210.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2016-09-02T18:44:42"}, {"id": "ASA-201501-15", "type": "archlinux", "title": "jre8-openjdk: multiple issues", "description": "- CVE-2014-3566 (man-in-the-middle)\nNondeterministic CBC padding, which makes it easier for\nman-in-the-middle attackers to obtain cleartext data via a\npadding-oracle attack, aka the &quot;POODLE&quot; issue.\n\n- CVE-2014-6549 (arbitrary code execution)\nIncorrect class loader permission check in ClassLoader getParent()\nallows remote attackers to affect confidentiality, integrity, and\navailability.\n\n- CVE-2014-6585 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6587 (privilege escalation)\nMulticastSocket NULL pointer dereference allows local users to affect\nconfidentiality, integrity, and availability.\n\n- CVE-2014-6591 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6593 (man-in-the-middle)\nIncorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows\nremote attackers to affect confidentiality and integrity.\n\n- CVE-2014-6601 (arbitrary code execution)\nClass verifier insufficient invokespecial calls verification related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0383 (denial of service)\nInsecure hsperfdata temporary file handling related to Hotspot allows\nlocal users to affect integrity and availability.\n\n- CVE-2015-0395 (arbitrary code execution)\nPhantom references handling issue in garbage collector related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0400 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of Java SE accessible data.\n\n- CVE-2015-0403 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0406 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of accessible data and\nability to cause a partial denial of service.\n\n- CVE-2015-0407 (information disclosure)\nDirectory information leak via file chooser related to Swing allows\nremote attackers to affect confidentiality.\n\n- CVE-2015-0408 (arbitrary code execution)\nIncorrect context class loader use in RMI transport allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0410 (denial of service)\nDER decoder infinite loop allows remote attackers to affect availability.\n\n- CVE-2015-0412 (arbitrary code execution)\nInsufficient code privileges checks related to JAX-WS allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0413 (unauthorized modification)\nSuccessful attack of this vulnerability can result in unauthorized\nupdate, insert or delete access to some Java SE accessible data.\n\n- CVE-2015-0421 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0437 (arbitrary code execution)\nCode generation issue related to Hotspot allows remote attackers to\naffect confidentiality, integrity, and availability.", "published": "2015-01-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://lists.archlinux.org/pipermail/arch-security/2015-January/000211.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2016-09-02T18:44:45"}, {"id": "ASA-201501-19", "type": "archlinux", "title": "jre7-openjdk: multiple issues", "description": "- CVE-2014-3566 (man-in-the-middle)\nNondeterministic CBC padding, which makes it easier for\nman-in-the-middle attackers to obtain cleartext data via a\npadding-oracle attack, aka the &quot;POODLE&quot; issue.\n\n- CVE-2014-6585 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6587 (privilege escalation)\nMulticastSocket NULL pointer dereference allows local users to affect\nconfidentiality, integrity, and availability.\n\n- CVE-2014-6591 (out-of-bounds read)\nAllows remote attackers to affect confidentiality via font parsing\nout-of-bounds read related to 2D.\n\n- CVE-2014-6593 (man-in-the-middle)\nIncorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows\nremote attackers to affect confidentiality and integrity.\n\n- CVE-2014-6601 (arbitrary code execution)\nClass verifier insufficient invokespecial calls verification related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0383 (denial of service)\nInsecure hsperfdata temporary file handling related to Hotspot allows\nlocal users to affect integrity and availability.\n\n- CVE-2015-0395 (arbitrary code execution)\nPhantom references handling issue in garbage collector related to\nHotspot allows remote attackers to affect confidentiality, integrity,\nand availability.\n\n- CVE-2015-0400 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of Java SE accessible data.\n\n- CVE-2015-0403 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0406 (information disclosure)\nSuccessful unauthenticated network attacks via multiple protocols can\nresult in unauthorized read access to a subset of accessible data and\nability to cause a partial denial of service.\n\n- CVE-2015-0407 (information disclosure)\nDirectory information leak via file chooser related to Swing allows\nremote attackers to affect confidentiality.\n\n- CVE-2015-0408 (arbitrary code execution)\nIncorrect context class loader use in RMI transport allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0410 (denial of service)\nDER decoder infinite loop allows remote attackers to affect availability.\n\n- CVE-2015-0412 (arbitrary code execution)\nInsufficient code privileges checks related to JAX-WS allows remote\nattackers to affect confidentiality, integrity, and availability.\n\n- CVE-2015-0413 (unauthorized modification)\nSuccessful attack of this vulnerability can result in unauthorized\nupdate, insert or delete access to some Java SE accessible data.\n\n- CVE-2015-0421 (arbitrary code execution)\nSuccessful attack of this vulnerability can result in unauthorized\nOperating System takeover including arbitrary code execution.\n\n- CVE-2015-0437 (arbitrary code execution)\nCode generation issue related to Hotspot allows remote attackers to\naffect confidentiality, integrity, and availability.", "published": "2015-01-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://lists.archlinux.org/pipermail/arch-security/2015-January/000217.html", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2016-09-02T18:44:40"}], "gentoo": [{"id": "GLSA-201507-14", "type": "gentoo", "title": "Oracle JRE/JDK: Multiple vulnerabilities", "description": "### Background\n\nThe Oracle Java Development Kit (JDK) and the Oracle Java Runtime Environment (JRE) provide the Oracle Java platform. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Oracle JRE/JDK. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nAn context-dependent attacker may be able to influence the confidentiality, integrity, and availability of Java applications/runtime. \n\n### Workaround\n\nThere is no workaround at this time.\n\n### Resolution\n\nAll Oracle JRE 8 users should upgrade to the latest stable version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/oracle-jre-bin-1.8.0.31\n \n\nAll Oracle JDK 8 users should upgrade to the latest stable version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/oracle-jdk-bin-1.8.0.31\n \n\nAll Oracle JRE 7 users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/oracle-jre-bin-1.7.0.76\n \n\nAll Oracle JDK 7 users should upgrade to the latest stable version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/oracle-jdk-bin-1.7.0.76", "published": "2015-07-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://security.gentoo.org/glsa/201507-14", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400"], "lastseen": "2016-09-06T19:46:42"}, {"id": "GLSA-201603-14", "type": "gentoo", "title": "IcedTea: Multiple vulnerabilities", "description": "### Background\n\nIcedTea\u2019s aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions. \n\n### Description\n\nVarious OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot, Libraries, and JAXP, exist which allows remote attackers to affect the confidentiality, integrity, and availability of vulnerable systems. This includes the possibility of remote execution of arbitrary code, information disclosure, or Denial of Service. Many of the vulnerabilities can only be exploited through sandboxed Java Web Start applications and java applets. Please reference the CVEs listed for specific details. \n\n### Impact\n\nRemote attackers may remotely execute arbitrary code, compromise information, or cause Denial of Service. \n\n### Workaround\n\nThere is no known work around at this time.\n\n### Resolution\n\nIcedTea 7.x users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/icedtea-7.2.6.4\"\n \n\nIcedTea bin 7.x users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/icedtea-bin-7.2.6.4\"\n \n\nIcedTea 6.x users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/icedtea-6.1.13.9\"\n \n\nIcedTea bin 6.x users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/icedtea-bin-6.1.13.9\"", "published": "2016-03-12T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://security.gentoo.org/glsa/201603-14", "cvelist": ["CVE-2015-2601", "CVE-2015-4749", "CVE-2015-2632", "CVE-2015-2625", "CVE-2015-4732", "CVE-2015-4860", "CVE-2015-0395", "CVE-2015-4903", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4872", "CVE-2015-2613", "CVE-2015-4883", "CVE-2015-0407", "CVE-2014-6585", "CVE-2016-0483", "CVE-2016-0448", "CVE-2015-4882", "CVE-2015-4734", "CVE-2015-0383", "CVE-2015-4871", "CVE-2015-4803", "CVE-2014-6587", "CVE-2015-2590", "CVE-2015-4805", "CVE-2015-4806", "CVE-2016-0466", "CVE-2015-2628", "CVE-2016-0494", "CVE-2016-0402", "CVE-2015-4733", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-4835", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-2621", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-4731", "CVE-2015-4911", "CVE-2015-4844", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4748", "CVE-2015-4893", "CVE-2015-4760"], "lastseen": "2016-09-06T19:46:55"}], "kaspersky": [{"id": "KLA10447", "type": "kaspersky", "title": "\r KLA10447Multiple vulnerabilities in Java SE\t\t\t ", "description": "### *CVSS*:\n10.0\n\n### *Detect date*:\n01/13/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Oracle products. Malicious users can exploit these vulnerabilities to cause loss of integrity, denial of service and obtain sensitive information.\n\n### *Affected products*:\nOracle Java SE versions 5u75, 6u85, 7u72 and 8u25 \nOracle Java SE Embeded 7u71 and 8u6 \nJRockit 27.8.4 and 28.3.4 \n\n\n### *Solution*:\nUpdate to latest version \n[Get JRockit](<http://www.oracle.com/technetwork/middleware/jrockit/overview/index-101826.html>) \n[Get Java SE](<http://www.oracle.com/technetwork/java/javase/downloads/index.html>)\n\n### *Original advisories*:\n[Oracle advisory](<http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html>) \n\n\n### *Impacts*:\nOSI \n\n### *Related products*:\n[Oracle JRockit](<https://threats.kaspersky.com/en/product/Oracle-JRockit/>)\n\n### *CVE-IDS*:\n[CVE-2014-6591](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591>) \n[CVE-2014-6549](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6549>) \n[CVE-2015-0395](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0395>) \n[CVE-2014-6587](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6587>) \n[CVE-2015-0406](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0406>) \n[CVE-2015-0437](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0437>) \n[CVE-2014-6585](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585>) \n[CVE-2015-0410](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410>) \n[CVE-2015-0421](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0421>) \n[CVE-2015-0400](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400>) \n[CVE-2015-0413](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0413>) \n[CVE-2015-0403](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0403>) \n[CVE-2015-0383](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0383>) \n[CVE-2015-0412](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0412>) \n[CVE-2014-6601](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6601>) \n[CVE-2015-0407](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0407>) \n[CVE-2015-0408](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0408>) \n[CVE-2014-3566](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>) \n[CVE-2014-6593](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593>)", "published": "2015-01-13T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://threats.kaspersky.com/en/vulnerability/KLA10447", "cvelist": ["CVE-2014-3566", "CVE-2015-0395", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2015-0383", "CVE-2014-6587", "CVE-2015-0406", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-6601", "CVE-2015-0421", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0437"], "lastseen": "2018-03-30T14:11:45"}], "aix": [{"id": "JAVA_FEB2015_ADVISORY.ASC", "type": "aix", "title": "Multiple vulnerabilities in current releases of IBM SDK Java Technology Edition; issues disclosed in the Oracle Feb 2015 Critical Patch Update vulnerability and two additional Vuln", "description": "IBM SECURITY ADVISORY\n\nFirst Issued: Thu Feb 19 10:53:54 CST 2015\n\nThe most recent version of this document is available here:\n\nhttp://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc\nhttps://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc\nftp://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc\n===============================================================================\n VULNERABILITY SUMMARY\n\nVULNERABILITY: Multiple vulnerabilities in current releases of the IBM\u00ae SDK,\n Java Technology Edition; issues disclosed in the Oracle Feburary\n 2015 Critical Patch Update vulnerability and two additional \n vulnerability.\n\nPLATFORMS: AIX 5.3, 6.1 and 7.1.\n VIOS 2.2.x\n\nSOLUTION: Apply the fix as described below.\n\nTHREAT: Varies threats described below.\n\nCVE Numbers: CVE-2014-6549 CVSS=10, CVE-2015-0408 CVSS=10, CVE-2015-0412 CVSS=10,\n CVE-2015-0403 CVSS=6.9, CVE-2015-0406 CVSS=5.8, CVE-2015-0410 VCSS=5,\n CVE-2015-0407 CVSS=5, CVE-2015-0400 CVSS=5, CVE-2014-3566 CVSS=4.3\n CVE-2014-6587 CVSS=4.3, CVE-2014-6593 CVSS=4, CVE-2014-6591 CVSS=2.6,\n CVE-2014-6585 CVSS=2.6, CVE-2014-8891 CVSS=6.8\n \n\nReboot required? NO\nWorkarounds? NO\n \n===============================================================================\n DETAILED INFORMATION\n\nI. DESCRIPTION\n\n This bulletin covers all applicable IBM\u00ae Java SDK CVEs published by Oracle as part\n of their February 2015 Critical Patch Update. For more information please refer to \n Oracles's February 2015 CPU Advisory and the X-Force database entries referenced \n below.\n\nII. CVSS\n\n CVEID: CVE-2014-6549\n CVSS Base Score: 10\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100141 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) \n\n CVEID: CVE-2015-0408\n CVSS Base Score: 10\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100142 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) \n\n CVEID: CVE-2015-0412\n CVSS Base Score: 10\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100140 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) \n\n CVEID: CVE-2015-0403\n CVSS Base Score: 6.9\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100145 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C) \n\n CVEID: CVE-2015-0406\n CVSS Base Score: 5.8\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100147 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:P) \n\n CVEID: CVE-2015-0410\n CVSS Base Score: 5\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100151 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) \n\n CVEID: CVE-2015-0407\n CVSS Base Score: 5\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100150 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) \n\n CVEID: CVE-2015-0400\n CVSS Base Score: 5\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100149 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) \n\n CVEID: CVE-2014-3566\n CVSS Base Score: 4.3\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97013 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)\n\n CVEID: CVE-2014-6587\n CVSS Base Score: 4.3\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100152 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:L/AC:L/Au:S/C:P/I:P/A:P) \n\n CVEID: CVE-2014-6593\n CVSS Base Score: 4\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100153 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N) \n\n CVEID: CVE-2014-6591\n CVSS Base Score: 2.6\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100155 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N) \n\n\n Specific to IBM Java CVE(s):\n\n CVEID: CVE-2014-6585\n CVSS Base Score: 2.6\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100154 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)\n\n\n CVEID: CVE-2014-8891\n CVSS Base Score: 6.8\n CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99010 for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n\nIII. PLATFORM VULNERABILITY ASSESSMENT\n\n The following fileset levels (VRMF) are vulnerable, if the respective Java version is installed:\n For Java5: Less than 5.0.0.590\n For Java6: Less than 6.0.0.470\n For Java7: Less than 7.0.0.195\n For Java7 Release 1: Less than 7.1.0.75\n\n Note: To find out whether the affected filesets are installed on your\n systems, refer to the lslpp command found in AIX user's guide.\n\n Example: lslpp -L | grep -i java\n\nIV. FIXES\n\n AFFECTED PRODUCTS AND VERSIONS:\n AIX 5.3\n AIX 6.1\n AIX 7.1\n VIOS 2.2.x\n\n REMEDIATION:\n IBM SDK, Java Technology Edition, Version 5.0 Service Refresh 16 Fix Pack 9 and later\n 32-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix32j5b&S_TACT=105AGX05&S_CMP=JDK\n 64-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix64j5b&S_TACT=105AGX05&S_CMP=JDK\n\n IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 3 and later\n 32-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix32j6b&S_TACT=105AGX05&S_CMP=JDK\n 64-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix64j6b&S_TACT=105AGX05&S_CMP=JDK\n\n IBM SDK, Java Technology Edition, Version 7, Service Refresh 8 Fix Pack 10 and later\n 32-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix32j7b&S_TACT=105AGX05&S_CMP=JDK\n 64-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix64j7b&S_TACT=105AGX05&S_CMP=JDK\n\n IBM SDK, Java Technology Edition, Version 7 Release 1 Service Refresh 2 Fix Pack 10 and later\n 32-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix32j7r1&S_TACT=105AGX05&S_CMP=JDK\n 64-bit: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=dka&S_PKG=aix64j7r1&S_TACT=105AGX05&S_CMP=JDK\n\n To learn more about AIX support levels and Java service releases, see the following:\n http://www.ibm.com/developerworks/java/jdk/aix/service.html#levels\n\n Published advisory OpenSSL signature file location:\n \n http://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc.sig\n https://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc.sig\n ftp://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc.sig\n\n openssl dgst -sha1 -verify <pubkey_file> -signature <advisory_file>.sig <advisory_file>\n\nV. WORKAROUNDS\n\n None\n\nVI. CONTACT US\n\n If you would like to receive AIX Security Advisories via email,\n please visit \"My Notifications\":\n\n http://www.ibm.com/support/mynotifications\n\n To view previously issued advisories, please visit:\n\n http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n\n Comments regarding the content of this announcement can be\n directed to:\n\n security-alert@austin.ibm.com\n\n To obtain the OpenSSL public key that can be used to verify the\n signed advisories and ifixes:\n\n Download the key from our web page:\n\n http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt\n\n To obtain the PGP public key that can be used to communicate\n securely with the AIX Security Team via security-alert@austin.ibm.com you\n can either:\n\n A. Download the key from our web page:\n\n http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt\n\n B. Download the key from a PGP Public Key Server. The key ID is:\n\n 0x28BFAA12\n\n Please contact your local IBM AIX support center for any\n assistance.\n\nVII. REFERENCES:\n\n Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html\n On-line Calculator V2: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2\n CVE-2014-6549: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6549\n CVE-2015-0408: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0408\n CVE-2015-0412: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0412\n CVE-2015-0403: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0403\n CVE-2015-0406: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0406\n CVE-2015-0410: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410\n CVE-2015-0407: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0407\n CVE-2015-0400: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400\n CVE-2014-3566: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566\n CVE-2014-6587: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6587\n CVE-2014-6593: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593\n CVE-2014-6591: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591\n CVE-2014-6585: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585\n CVE-2014-8891: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891\n\n *The CVSS Environment Score is customer environment specific and will\n ultimately impact the Overall CVSS Score. Customers can evaluate the\n impact of this vulnerability in their environments by accessing the links\n in the Reference section of this Flash.\n\n Note: According to the Forum of Incident Response and Security Teams\n (FIRST), the Common Vulnerability Scoring System (CVSS) is an \"industry\n open standard designed to convey vulnerability severity and help to\n determine urgency and priority of response.\" IBM PROVIDES THE CVSS SCORES\n \"AS IS\" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF\n MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE\n RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY\n VULNERABILITY.\n", "published": "2015-02-19T10:53:54", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://aix.software.ibm.com/aix/efixes/security/java_feb2015_advisory.asc", "cvelist": ["CVE-2014-3566", "CVE-2015-0407", "CVE-2014-6585", "CVE-2015-0410", "CVE-2014-6549", "CVE-2014-6587", "CVE-2015-0406", "CVE-2014-6593", "CVE-2015-0403", "CVE-2015-0408", "CVE-2014-6591", "CVE-2015-0412", "CVE-2015-0400", "CVE-2014-8891"], "lastseen": "2016-10-24T17:48:11"}], "oracle": [{"id": "ORACLE:CPUJAN2015-1972971", "type": "oracle", "title": "Oracle Critical Patch Update - January 2015", "description": "A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:\n\n \n\n\n[Critical Patch Updates and Security Alerts](<http://www.oracle.com/technetwork/topics/security/alerts-086861.html>) for information about Oracle Security Advisories.\n\n \n\n\n**Oracle has received specific reports of malicious exploitation of vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that malicious attackers have been successful because customers had failed to apply these Oracle patches. Oracle therefore _strongly_ recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes _without_ delay.**\n\n \n\n\nThis Critical Patch Update contains 169 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at <https://blogs.oracle.com/security>.\n\n \n\n\nPlease note that on October 16, 2014, Oracle released information for [CVE-2014-3566 \"POODLE\"](<http://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html>). Customers of affected Oracle products are strongly advised to apply the fixes and/or configuration steps that were announced for CVE-2014-3566 in addition to the fixes announced in this CPU.\n\n \n\n\nThis Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available at: <http://www.oracle.com/technetwork/topics/security/cpufaq-098434.html#CVRF>.\n\n \n\n", "published": "2015-03-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "", "cvelist": ["CVE-2015-0388", "CVE-2014-6574", "CVE-2015-0390", "CVE-2011-4317", "CVE-2014-6592", "CVE-2014-3566", "CVE-2011-4461", "CVE-2015-0386", "CVE-2015-0425", "CVE-2014-6566", "CVE-2013-4784", "CVE-2014-0191", "CVE-2015-0365", "CVE-2014-6579", "CVE-2014-6556", "CVE-2014-0231", "CVE-2014-6571", "CVE-2015-0427", "CVE-2014-6578", "CVE-2015-0398", "CVE-2014-6510", "CVE-2014-6595", "CVE-2011-3607", "CVE-2014-6518", "CVE-2015-0385", "CVE-2015-0395", "CVE-2015-0368", "CVE-2013-6449", "CVE-2014-6575", "CVE-2015-0380", "CVE-2015-0424", "CVE-2003-0001", "CVE-2014-6565", "CVE-2015-0407", "CVE-2014-0076", "CVE-2015-0362", "CVE-2015-0430", "CVE-2014-6585", "CVE-2015-0410", "CVE-2013-5704", "CVE-2015-0402", "CVE-2015-0379", "CVE-2014-6548", "CVE-2015-0396", "CVE-2015-0422", "CVE-2015-0435", "CVE-2014-5704", "CVE-2013-5605", "CVE-2014-6584", "CVE-2014-0224", "CVE-2014-4259", "CVE-2015-0391", "CVE-2014-6567", "CVE-2015-0418", "CVE-2013-0338", "CVE-2014-6480", "CVE-2014-6576", "CVE-2015-0428", "CVE-2015-0431", "CVE-2014-0098", "CVE-2014-6549", "CVE-2015-0420", "CVE-2015-0432", "CVE-2015-0383", "CVE-2011-3389", "CVE-2013-1741", "CVE-2014-6583", "CVE-2014-6597", "CVE-2014-4279", "CVE-2004-0230", "CVE-2015-0369", "CVE-2014-6525", "CVE-2015-0372", "CVE-2014-6582", "CVE-2015-0378", "CVE-2015-0392", "CVE-2015-0416", "CVE-2014-6587", "CVE-2013-1740", "CVE-2013-6438", "CVE-2015-0406", "CVE-2015-0401", "CVE-2014-6569", "CVE-2014-3470", "CVE-2012-0053", "CVE-2013-1739", "CVE-2014-6599", "CVE-2014-1492", "CVE-2013-2877", "CVE-2015-0417", "CVE-2015-0404", "CVE-2013-6450", "CVE-2013-5606", "CVE-2014-0114", "CVE-2015-0364", "CVE-2014-0050", "CVE-2010-5107", "CVE-2011-3368", "CVE-2014-6573", "CVE-2014-1490", "CVE-2010-5298", "CVE-2013-4286", "CVE-2015-0371", "CVE-2014-6526", "CVE-2015-0382", "CVE-2014-1568", "CVE-2015-0363", "CVE-2014-6600", "CVE-2014-6580", "CVE-2014-6509", "CVE-2015-0375", "CVE-2015-0414", "CVE-2014-0195", "CVE-2015-0413", "CVE-2014-6593", "CVE-2014-0198", "CVE-2014-6601", "CVE-2014-6594", "CVE-2015-0373", "CVE-2015-0421", "CVE-2013-2186", "CVE-2014-3567", "CVE-2014-6581", "CVE-2014-0015", "CVE-2015-0403", "CVE-2014-6570", "CVE-2015-0408", "CVE-2015-0429", "CVE-2014-6596", "CVE-2014-6521", "CVE-2015-0374", "CVE-2014-6591", "CVE-2014-6586", "CVE-2014-6524", "CVE-2014-6572", "CVE-2015-0370", "CVE-2015-0412", "CVE-2015-0400", "CVE-2015-0409", "CVE-2015-0387", "CVE-2015-0389", "CVE-2015-0399", "CVE-2014-0118", "CVE-2015-0415", "CVE-2014-6590", "CVE-2015-0376", "CVE-2014-6481", "CVE-2015-0393", "CVE-2015-0366", "CVE-2015-0419", "CVE-2014-6568", "CVE-2015-0377", "CVE-2015-0394", "CVE-2015-0397", "CVE-2015-0384", "CVE-2014-6589", "CVE-2014-1491", "CVE-2014-6528", "CVE-2014-6588", "CVE-2014-6541", "CVE-2011-1944", "CVE-2015-0437", "CVE-2014-6514", "CVE-2014-0117", "CVE-2014-4212", "CVE-2015-0436", "CVE-2014-6598", "CVE-2015-0367", "CVE-2014-0226", "CVE-2013-1620", "CVE-2013-4545", "CVE-2015-0426", "CVE-2015-0434", "CVE-2014-0221", "CVE-2015-0411", "CVE-2015-0381", "CVE-2014-6577"], "lastseen": "2018-04-18T20:23:51"}]}}