CVE-2012-1541

CVE-2012-1541 is described as an unspecified vulnerability in Oracle Java SE 7u11 and 6u38 related to the JRE Deployment, potentially allowing remote code execution via manipulation of applet-containing DOM nodes in WebKit-based browsers. The description cites claims (not commented by Oracle) abo...

CVE-2009-2675

The CVE-2009-2675 entry concerns an integer overflow in the unpack200 utility of Sun Java Runtime Environment (JRE) / JDK. Affected: JRE/JDK 6 before Update 15 and JRE/JDK 5.0 before Update 20. Root cause: heap-based buffer overflow during decompression triggered by crafted Pack200 headers (unspe...

CVE-2013-0438

CVE-2013-0438 is an unspecified vulnerability in the Java Runtime Environment (JRE) component of Oracle Java SE 7 up to Update 11 and Java SE 6 up to Update 38, related to Deployment, that can affect confidentiality via unknown vectors. The connected IBM Storwize V7000 Unified bulletin maps CVE-2...

CVE-2009-3875

CVE-2009-3875 : The Java Runtime Environment (JRE) in Sun/Oracle Java SE has a timing-attack flaw in the HMAC digest verification that could allow forged signatures and potentially bypass authentication. Affected products include JDK/JRE 5.0 before Update 22, JDK/JRE 6 before Update 17, and older...

CVE-2008-3103

CVE-2008-3103 refers to an unspecified vulnerability in the Sun JRE/JDK JMX management agent where, if local monitoring is enabled, a remote attacker could perform unauthorized operations via unknown vectors. The IBM Cloud Pak for Security bulletin lists CP4S versions affected (1.7.2.0, 1.8.0.0, ...

CVE-2008-5354

CVE-2008-5354 describes a stack-based buffer overflow in Sun JRE/JDK/J2SE components that affects JRE/JDK 6u10 and earlier, 5.0u16 and earlier, and 1.4.2_18 and earlier. The vulnerability allows arbitrary code execution when a user opens a crafted JAR file, with the issue triggered by an excessiv...

CVE-2009-3868

CVE-2009-3868 affects Sun Java SE (JDK/JRE 5.0 before Update 22, JDK/JRE 6 before Update 17, SDK/JRE 1.3.x before 1.3.1_27, SDK/JRE 1.4.x before 1.4.2_24) and arises from improper parsing of color profiles. A crafted image file could allow remote attackers to gain privileges. The description spec...

CVE-2009-2671

CVE-2009-2671 affects Sun JRE/JDK: SOCKS proxy implementation in Sun Java Runtime Environment (JRE) and JDK allowed information leakage of the invoking user name via untrusted applets/Web Start. Affected products: JDK/JRE 6 pre-Update 15 and 5.0 pre-Update 20. Root cause: proxy mechanism informat...

CVE-2013-0351

CVE-2013-0351 refers to an unspecified vulnerability in Oracle Java SE JRE components used by IBM products. Connected Nessus/IBM entries confirm this CVE is currently unpatched in some deployments. AFFECTED PRODUCTS AND VERSIONS (IBM): IBM WebSphere ILOG JRules (V7.1.1) on Windows with a bundled ...

CVE-2008-1191

Technical details for CVE-2008-1191 are not provided in the supplied documents. Please monitor for updates.

CVE-2008-5339

CVE-2008-5339 affects Sun JDK/JRE components (Java Web Start and Java Plug-in) across multiple older builds: Java 6 Update 10 and earlier, Java 5.0 Update 16 and earlier, and SDK/JRE 1.4.2_18 and earlier. The description indicates an unspecified vulnerability where untrusted JWS applications coul...

CVE-2009-2673

CVE-2009-2673 is the OpenJDK/Sun JRE proxy mechanism vulnerability that allows non-authenticated socket or URL connections due to a flaw in the proxy handling. Affected components include OpenJDK/OpenJRE proxy implementation and related JRE components as disclosed in multiple advisories (e.g., CV...

CVE-2009-3866

CVE-2009-3866 affects Sun Java SE/JDK/JRE 6 prior to Update 17. The vulnerability stems from the Java Web Start Installer not properly enforcing security model permissions when removing installer extensions, allowing a remote attacker to achieve arbitrary code execution by altering a JNLP file’s ...

CVE-2009-1096

Technical details for CVE-2009-1096 are not publicly provided in the connected documents. No concrete affected products, versions, or fixes are specified beyond the initial description. Monitor for updates.

CVE-2009-2672

CVE-2009-2672 is a Sun JRE/JDK proxy mechanism vulnerability where an untrusted applet or Java Web Start application could access browser cookies and related session data, enabling session hijacking. The issue is tied to the JRE proxy implementation and affects Sun JRE/JDK before certain updates....

CVE-2009-3867

CVE-2009-3867 is a stack-based buffer overflow in Sun Java SE: HsbParser.getSoundBank that can allow remote code execution via a long file: URL argument. Affected are Sun JDK/JRE 5.0 before Update 22, JDK/JRE 6 before Update 17, SDK/JRE 1.3.x before 1.3.1_27, and SDK/JRE 1.4.x before 1.4.2_24. Ex...

CVE-2008-3107

CVE-2008-3107 concerns Sun Java Runtime Environment (JRE/JDK) and affects: JRE/JDK 6 before Update 7; JDK/JRE 5.0 before Update 16; and J2SE 1.4.x before 1.4.2_18. Description: an untrusted (1) application or (2) applet could gain privileges via self-granted access, enabling read/write/execute of...

CVE-2010-0084

CVE-2010-0084 is linked to OpenJDK/OpenJRE flaws addressing Policy/PolicyFile leakage in Java 6/5/OpenJDK packages. Connected docs indicate affected products (Oracle Java SE/Business, OpenJDK/OpenJRE) and versions, but do not provide a concrete fix/version unless drawn from advisories; remediatio...

CVE-2010-0095

CVE-2010-0095 affects Java Runtime/OpenJDK/OpenJRE (as tracked in OpenVAS Scientific Linux/Nessus entries). Vulnerability: Subclasses of InetAddress may incorrectly interpret network addresses, potentially allowing an untrusted applet or application to bypass network access restrictions. This is ...

CVE-2010-4452

CVE-2010-4452 affects the Deployment component of Oracle Java SE/JRE (Java for Business) up to 6 Update 23. The vulnerability could allow remote exploitation by untrusted Web Start/applets, impacting confidentiality, integrity, and availability via unknown vectors. Public materials in connected d...

CVE-2009-3883

CVE-2009-3883 affects Sun Java SE 5.0 before Update 22 and Java SE 6 before Update 17 (OpenJDK) in the Swing PL&F implementation. The issue involves information leaks in mutable variables within Swing, enabling potential remote disclosure with partial confidentiality, integrity, and availability ...

CVE-2010-3552

Technical details for CVE-2010-3552 are not provided in the connected documents. The initial description remains high-level. Monitor Oracle Java CPU advisories and vendor advisories for affected versions, impact, and remediation information.

CVE-2010-3556

CVE-2010-3556 affects Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28. The vulnerability is in the 2D component and is described as unspecified with unknown attack vectors; it is stated to impact confidentiality, integrity, and availability. No concrete exp...

CVE-2010-4471

Technical details for CVE-2010-4471 are not provided in the supplied documents. No impacted products, exploit info, or remediation are described here. Monitor for updates from official advisories.

CVE-2011-0868

CVE-2011-0868 affects Oracle Java SE 6, specifically the JRE component up to Update 25 and earlier. The vulnerability is described as an unspecified issue in the 2D subsystem that could impact confidentiality via unknown attack vectors, with no explicit exploit details provided in the sources. Th...

CVE-2008-3104

CVE-2008-3104 affects Sun Java Runtime Environment (JRE) and related JDK/JRE distributions. The issue involves multiple vulnerabilities in the JRE that can allow a remote attacker to bypass an applet’s outbound connection restrictions by connecting to localhost services on the machine that loaded...

CVE-2008-3110

CVE-2008-3110 : Technical details are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and related bulletins.

CVE-2010-3549

CVE-2010-3549 affects Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28. The incident is tied to incorrect handling of HTTP chunked transfer encoding by HttpURLConnection, with potential impacts to confidentiality, integrity, and availability. The connected O...

CVE-2010-3574

CVE-2010-3574 is tied to HttpURLConnection HTTP TRACE handling. Oracle Java SE/Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, 1.3.1_28 were noted as affected in the CVE entry, and the entry cites a claim that untrusted code could perform TRACE requests due to a permission check issue. Co...

CVE-2010-4469

CVE-2010-4469 affects Oracle Java SE and Java for Business JRE components, with the MiracleLinux AXSA advisory listing Java 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier. The connected Nessus entry explicitly states the issue is an unspecified vulnerability in the J...

CVE-2006-2426

CVE-2006-2426 affects Sun JRE/JDK/J2SDK 1.5.0_6 and earlier. The vulnerability enables a remote attacker to cause a denial of service via disk consumption by abusing Font.createFont to create temporary files in the %temp% directory. Affected products include Sun JRE/JDK/Sun SDK up to 1.5.0_6; con...

CVE-2008-5358

CVE-2008-5358 affects Sun Java Runtime Environment (JRE) / JDK, specifically JRE 6 Update 10 and earlier. The vulnerability arises from processing a crafted GIF file that triggers memory corruption during the splash screen display, possibly linked to splashscreen.dll, enabling remote arbitrary co...

CVE-2009-3871

CVE-2009-3871 is a heap-based buffer overflow in the AWT setBytePixels function of the Java Runtime Environment (JRE). Affected products/lines include Sun Java SE (JDK/JRE) 5.0 before Update 22, JDK/JRE 6 before Update 17, and older SDK/JRE 1.3.x/1.4.x branches. Other connected advisories referen...

CVE-2009-3874

CVE-2009-3874 is an integer overflow in JPEGImageReader of Java Image I/O that allows remote code execution via large JPEG subsample dimensions. Affected: Sun JDK/JRE 5.0 before Update 22, JDK/JRE 6 before Update 17, and SDK/JRE 1.4.x before 1.4.2_24. Remediation: upgrade to a version where the J...

CVE-2010-3563

CVE-2010-3563 is a remote‑execution vulnerability in the Oracle Java SE/Java for Business Deployment component (as reported in the Oct 2010 CPU). The description and connected notes indicate an issue in how Web Start retrieves security policies, potentially allowing a remote attacker to bypass sa...

CVE-2011-0873

CVE-2011-0873 is an unspecified vulnerability in Oracle Java SE JRE components affecting Java SE 6 Update 25 and earlier and Java SE 5.0 Update 29 and earlier. The flaw potentially impacts confidentiality, integrity, and availability via unknown vectors related to 2D. The connected advisories ref...

CVE-2011-3516

CVE-2011-3516 is described as an unspecified vulnerability in the Oracle Java SE JDK/JRE 6 Update 27 and earlier on Windows, affecting the Deployment component. It allows remote untrusted Java Web Start applications and untrusted applets to compromise confidentiality, integrity, and availability ...

CVE-2011-3558

CVE-2011-3558 is an unspecified vulnerability in Oracle Java SE/JDK/JRE 7 and 6 Update 27 and earlier. The issue affects the Java Runtime Environment and could allow remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Ho...

CVE-2009-2674

CVE-2009-2674 affects Sun Java Web Start (javaws.exe) in Sun JRE/JDK 6 prior to Update 15. The root cause is an integer overflow/heap-based buffer overflow when processing crafted JPEG images displayed on the splash screen, enabling context-dependent attackers to execute arbitrary code. Connected...

CVE-2010-3553

Technical details for CVE-2010-3553 are not publicly available in the provided connected documents. Please monitor for updated advisories that disclose affected products, vulnerabilities, remediation, or exploitation information.

CVE-2010-4450

CVE-2010-4450 is an unspecified vulnerability in the Java Runtime Environment (JRE) across Oracle Java SE and Java for Business packages ( Solaris/Linux: 6 Update 23 and earlier; 5.0 Update 27 and earlier; 1.4.2_29 and earlier). The issue is described as allowing local standalone applications to ...

CVE-2011-0863

CVE-2011-0863 affects Oracle Java SE 6 (JRE) Deployment in Update 25 and earlier; a vulnerability in Deployment could allow remote, untrusted Java Web Start apps/Applets to compromise confidentiality, integrity and availability via unknown vectors. The issue is tracked across multiple advisories;...

CVE-2013-0429

CVE-2013-0429 is a disclosed vulnerability in the Java Runtime Environment affecting Oracle JDK/JRE 7u11 and earlier, OpenJDK 6/7, via CORBA-related vectors that could impact confidentiality, integrity, and availability. Public documents note a potential sandbox-bypass claim related to a shared P...

CVE-2008-5350

CVE-2008-5350 affects Sun JDK/JRE components: JRE 6 Update 10 and earlier, JDK/JRE 5.0 Update 16 and earlier, and SDK/JRE 1.4.2_18 and earlier. The vulnerability allows an untrusted Java applet/application to list the contents of the user’s home directory via unknown vectors. The description does...

CVE-2008-5351

CVE-2008-5351 affects Java Runtime Environment (Sun JDK/JRE 6 Update 10 and earlier; JDK/JRE 5.0 Update 16 and earlier; SDK/JRE 1.4.2_18 and earlier). The issue is that UTF-8 encodings in use may not be the shortest form, which can allow bypassing protection mechanisms relying on shortest-form UT...

CVE-2008-5352

CVE-2008-5352: Integer overflow in Pack200 jar unpacking in unpack200 (unpack.dll) used by Java Runtime Environment (JRE) for Sun JDK/JRE. Affected: JRE/JDK 6 Update 10 and earlier, and JDK/JRE 5.0 Update 16 and earlier. The overflow in the heap-based buffer can allow untrusted applications and a...

CVE-2010-3569

CVE-2010-3569 is reported as a vulnerability in the Java Runtime Environment affecting JRE/OpenJDK/related distributions (e.g., IcedTea/OpenJDK builds). The root cause is described as inconsistencies in the Serialization API, with remote attackers able to impact confidentiality, integrity, and av...

CVE-2011-0869

CVE-2011-0869 affects Oracle Java SE 6 Update 26 and earlier in the JRE. The vulnerability is in the JRE’s SAAJ handling and could allow remote untrusted Java Web Start applications or applets to disclose data (confidentiality impact). The MiracleLinux/Nessus OpenVAS entries confirm the CVE and r...

CVE-2011-3550

Technical details for CVE-2011-3550 are not provided in the connected documents. Monitor for updates.

CVE-2008-0657

CVE-2008-0657 affects Sun JDK/JRE: Java 2 Platform versions in scope include JRE/JDK 6 Update 1 and earlier, and 5.0 Update 13 and earlier. The underlying issue is multiple, unspecified vulnerabilities in the Java Runtime Environment that allow an untrusted application or applet to elevate privil...