Professional OVAL Repository
[Eng]
[Rus]
[Sign-In]
OVAL
Search
Categories
RedCheck
About
OVAL Definitions
OVAL Items
FSTEC Data Bank Information Security Threats
NKCKI
EOL (End Of Life)
Linux Security Advisories
Mozilla Foundation Security Advisory
IBM
VMware
Cisco
Check Point Software Technologies
Apache
Solaris
FreeBSD
Development
GitHub Enterprise
Google Chrome Security Advisories
Oracle Security Advisories
Adobe Security Advisories
OpenSSL Security Advisories
Microsoft
CVE
CWE
CPE
Latest Updates
OS ROSA
ALT Linux
Astra Linux
RED OS
DSA (Debian Security Advisory) Patсh Statistics
DSA (Debian Security Advisory) Patсh Feed
DSA (Debian Security Advisory) Vulnerability Feed
DLA (Debian Security Advisory) Patсh Statistics
DLA (Debian Security Advisory) Patсh Feed
DLA (Debian Security Advisory) Vulnerability Feed
ALT Linux (Security Bulletins) Patсh Statistics
ALT Linux (Security Bulletins) Patсh Feed
ALT Linux (Security Bulletins) Vulnerability Feed
RED OS (Security Bulletins) Patсh Statistics
RED OS (Security Bulletins) Patсh Feed
RED OS (Security Bulletins) Vulnerability Feed
USN (Ubuntu Security Notice) Patсh Statistics
USN (Ubuntu Security Notice) Patсh Feed
USN (Ubuntu Security Notice) Vulnerability Feed
RHSA (RedHat Security Advisory) Patсh Statistics
RHSA (RedHat Security Advisory) Patсh Feed
RHSA (RedHat Security Advisory) Vulnerability Feed
ELSA (Oracle Linux Security Advisory) Patсh Statistics
ELSA (Oracle Linux Security Advisory) Patсh Feed
ELSA (Oracle Linux Security Advisory) Vulnerability Feed
SUSE (SUSE Security Advisories) Patсh Statistics
SUSE (SUSE Security Advisories) Patсh Feed
SUSE (SUSE Security Advisories) Vulnerability Feed
openSUSE (openSUSE Security Advisories) Patсh Statistics
openSUSE (openSUSE Security Advisories) Patсh Feed
openSUSE (openSUSE Security Advisories) Vulnerability Feed
Amazon Linux AMI (Security Bulletins) Patсh Statistics
Amazon Linux AMI (Security Bulletins) Patсh Feed
Amazon Linux AMI (Security Bulletins) Vulnerability Feed
Mageia Linux (Security Bulletins) Patсh Statistics
Mageia Linux (Security Bulletins) Patсh Feed
Mageia Linux (Security Bulletins) Vulnerability Feed
OS ROSA SX COBALT 1.0
OS ROSA DX COBALT 1.0
ROSA 7.3 (Security Advisories) Patсh Statistics
ROSA 7.3 (Security Advisories) Patсh Feed
ROSA 7.3 (Security Advisories) Vulnerability Feed
ALT Linux SPT 6.0
ALT Linux SPT 7.0
ALT 8 SP
ALT 9
Astra Linux SE 1.5
Astra Linux SE 1.6
Astra Linux SE 1.7
Astra Linux SE 1.8
RED OS Murom 7.1
RED OS Murom 7.2
IBM DB2
VMware Vulnerabilities Advisory (VMSA)
VMware vCenter Patch Advisories
VMware ESXi Patch Advisories
VMware NSX Patches
VMware NSX Vulnerabilities
VMware Photon OS 1.0 Patches
VMware Photon OS 1.0 Vulnerabilities
VMware Photon OS 2.0 Patches
VMware Photon OS 2.0 Vulnerabilities
Cisco ASA
Cisco IOS/NX-OS Advisory
Cisco NX-OS Vulnerabilities
Check Point Gaia
Apache Tomcat Advisories
Apache Tomcat Server
Apache HTTP Server
Python
Node.js
RubyGems
Qt
Microsoft Security Bulletin
Microsoft Knowledge Base Article
Microsoft SharePoint
Microsoft SharePoint Foundation 2013
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016
About OVALdb
User manual
Pricing
Contact us
OVAL Definitions
>
OVAL Definition Details
Id
oval:ru.altx-soft.nix:def:11044
Version
7
Class
patch
ALTXid
132899
Language
Russian
Severity
NotAvailable
Title
Обновление пакета java-1.6.0-openjdk
Description
Закрыто большое количество уязвимостей.
Family
unix
Platform
ROSA SX COBALT 1.0
Product
java-1.6.0-openjdk
Reference
VENDOR: ROSA
VENDOR: ROSA
Id:
ROSA
Reference:
https://www.rosalinux.ru/support/
CVE: CVE-2014-6457
CVE: CVE-2014-6457
Id:
CVE-2014-6457
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6457
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61631 (SECUNIA)
61143 (SECUNIA)
70538 (BID)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
61164 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
http://www-01.ibm.com/support/docview.wss?uid=swg21692299 (CONFIRM)
61635 (SECUNIA)
CVE: CVE-2014-6502
CVE: CVE-2014-6502
Id:
CVE-2014-6502
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6502
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries.
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61143 (SECUNIA)
70533 (BID)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61164 (SECUNIA)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
CVE: CVE-2014-6504
CVE: CVE-2014-6504
Id:
CVE-2014-6504
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6504
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
70564 (BID)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61164 (SECUNIA)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
DSA-3080 (DEBIAN)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
CVE: CVE-2014-6506
CVE: CVE-2014-6506
Id:
CVE-2014-6506
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6506
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSSv2 Score:
6.8
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
70556 (BID)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61164 (SECUNIA)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
CVE: CVE-2014-6511
CVE: CVE-2014-6511
Id:
CVE-2014-6511
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6511
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61143 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
70548 (BID)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61164 (SECUNIA)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html (CONFIRM)
CVE: CVE-2014-6512
CVE: CVE-2014-6512
Id:
CVE-2014-6512
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6512
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61631 (SECUNIA)
70567 (BID)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
61164 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
https://kc.mcafee.com/corporate/index?page=content&id=SB10092 (CONFIRM)
CVE: CVE-2014-6517
CVE: CVE-2014-6517
Id:
CVE-2014-6517
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6517
Comment
: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
70552 (BID)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61631 (SECUNIA)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
61164 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
DSA-3080 (DEBIAN)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
https://kc.mcafee.com/corporate/index?page=content&id=SB10092 (CONFIRM)
CVE: CVE-2014-6519
CVE: CVE-2014-6519
Id:
CVE-2014-6519
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6519
Comment
: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Hotspot.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
70570 (BID)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61164 (SECUNIA)
61346 (SECUNIA)
61609 (SECUNIA)
61928 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
DSA-3080 (DEBIAN)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
CVE: CVE-2014-6531
CVE: CVE-2014-6531
Id:
CVE-2014-6531
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6531
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
70572 (BID)
RHSA-2014:1636 (REDHAT)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61164 (SECUNIA)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
CVE: CVE-2014-6558
CVE: CVE-2014-6558
Id:
CVE-2014-6558
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6558
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (CONFIRM)
60416 (SECUNIA)
60417 (SECUNIA)
RHSA-2014:1658 (REDHAT)
RHSA-2014:1636 (REDHAT)
70544 (BID)
60414 (SECUNIA)
RHSA-2014:1634 (REDHAT)
RHSA-2014:1633 (REDHAT)
USN-2386-1 (UBUNTU)
RHSA-2014:1620 (REDHAT)
RHSA-2014:1657 (REDHAT)
61631 (SECUNIA)
61143 (SECUNIA)
61629 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1634.html (CONFIRM)
http://linux.oracle.com/errata/ELSA-2014-1633.html (CONFIRM)
61020 (SECUNIA)
61018 (SECUNIA)
http://linux.oracle.com/errata/ELSA-2014-1636 (CONFIRM)
61346 (SECUNIA)
61609 (SECUNIA)
61163 (SECUNIA)
61928 (SECUNIA)
61164 (SECUNIA)
USN-2388-1 (UBUNTU)
USN-2388-2 (UBUNTU)
SUSE-SU-2014:1422 (SUSE)
DSA-3077 (DEBIAN)
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 (CONFIRM)
RHSA-2014:1880 (REDHAT)
RHSA-2014:1876 (REDHAT)
RHSA-2014:1881 (REDHAT)
DSA-3080 (DEBIAN)
RHSA-2014:1882 (REDHAT)
RHSA-2014:1877 (REDHAT)
SUSE-SU-2014:1549 (SUSE)
SUSE-SU-2014:1526 (SUSE)
SSRT101770 (HP)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0345 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
https://kc.mcafee.com/corporate/index?page=content&id=SB10092 (CONFIRM)
CVE: CVE-2014-2490
CVE: CVE-2014-2490
Id:
CVE-2014-2490
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
Comment
: Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
HPSBUX03091 (HP)
1030577 (SECTRACK)
68645 (BID)
60812 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4209
CVE: CVE-2014-4209
Id:
CVE-2014-4209
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX.
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68639 (BID)
60245 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61577 (SECUNIA)
61640 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144209(94596) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4216
CVE: CVE-2014-4216
Id:
CVE-2014-4216
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68562 (BID)
60245 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
1030577 (SECTRACK)
60812 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
oracle-cpujul2014-cve20144216(94591) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4218
CVE: CVE-2014-4218
Id:
CVE-2014-4218
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68583 (BID)
60245 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61577 (SECUNIA)
61640 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144218(94599) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4219
CVE: CVE-2014-4219
Id:
CVE-2014-4219
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
Comment
: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68620 (BID)
60245 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61577 (SECUNIA)
61640 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144219(94589) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4244
CVE: CVE-2014-4244
Id:
CVE-2014-4244
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68624 (BID)
59503 (SECUNIA)
60245 (SECUNIA)
https://kc.mcafee.com/corporate/index?page=content&id=SB10083 (CONFIRM)
60831 (SECUNIA)
60326 (SECUNIA)
60890 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21681966 (CONFIRM)
61469 (SECUNIA)
61846 (SECUNIA)
61294 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685242 (CONFIRM)
58830 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685121 (CONFIRM)
61215 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685178 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21686142 (CONFIRM)
61293 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21683429 (CONFIRM)
61278 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685122 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21683438 (CONFIRM)
61050 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61640 (SECUNIA)
61577 (SECUNIA)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
http://www-01.ibm.com/support/docview.wss?uid=swg21688893 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21689593 (CONFIRM)
60846 (SECUNIA)
62314 (SECUNIA)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
https://www.ibm.com/support/docview.wss?uid=swg21680418 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21683484 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21683338 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21681379 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
http://www.ibm.com/support/docview.wss?uid=swg21683518 (CONFIRM)
61417 (SECUNIA)
61264 (SECUNIA)
61254 (SECUNIA)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60497 (SECUNIA)
60485 (SECUNIA)
60335 (SECUNIA)
60129 (SECUNIA)
60032 (SECUNIA)
60031 (SECUNIA)
60002 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144244(94605) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2013-3829
CVE: CVE-2013-3829
Id:
CVE-2013-3829
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829
Comment
: Unspecified vulnerability in the Java SE, Java SE Embedded component in Oracle Java SE Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=1019133 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
USN-2033-1 (UBUNTU)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63120 (BID)
oval:org.mitre.oval:def:19002 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-4002
CVE: CVE-2013-4002
Id:
CVE-2013-4002
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002
Comment
: XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
CVSSv2 Score:
7.1
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:N/I:N/A:C
References:
http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013 (MISC)
http://www-01.ibm.com/support/docview.wss?uid=swg21644197 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
SUSE-SU-2013:1256 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
61310 (BID)
SUSE-SU-2013:1257 (SUSE)
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21648172 (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
USN-2033-1 (UBUNTU)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1505 (REDHAT)
IC98015 (AIXAPAR)
http://www-01.ibm.com/support/docview.wss?uid=swg21657539 (CONFIRM)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21653371 (CONFIRM)
56257 (SECUNIA)
RHSA-2013:1059 (REDHAT)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
RHSA-2014:1822 (REDHAT)
RHSA-2014:1818 (REDHAT)
RHSA-2014:1821 (REDHAT)
RHSA-2014:1823 (REDHAT)
RHSA-2015:0675 (REDHAT)
RHSA-2015:0720 (REDHAT)
RHSA-2015:0765 (REDHAT)
RHSA-2015:0773 (REDHAT)
ibm-java-cve20134002-dos(85260) (XF)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
https://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
https://issues.apache.org/jira/browse/XERCESJ-1679 (CONFIRM)
http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patch (CONFIRM)
https://www.oracle.com/security-alerts/cpuapr2022.html (MISC)
[j-users] 20180503 [ANNOUNCEMENT]: Apache Xerces-J 2.12.0 now available ()
[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report ()
[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 ()
CVE: CVE-2013-5772
CVE: CVE-2013-5772
Id:
CVE-2013-5772
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5772
Comment
: Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u40 and earlier and Java SE 6u60 and earlier allows remote attackers to affect integrity via unknown vectors related to jhat.
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
63089 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19219 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5774
CVE: CVE-2013-5774
Id:
CVE-2013-5774
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=1019147 (CONFIRM)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63128 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19032 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5778
CVE: CVE-2013-5778
Id:
CVE-2013-5778
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=1018984 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63134 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19020 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5780
CVE: CVE-2013-5780
Id:
CVE-2013-5780
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5780
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1018785 (CONFIRM)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63115 (BID)
oval:org.mitre.oval:def:19101 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5782
CVE: CVE-2013-5782
Id:
CVE-2013-5782
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=1019108 (CONFIRM)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63103 (BID)
oval:org.mitre.oval:def:18645 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5783
CVE: CVE-2013-5783
Id:
CVE-2013-5783
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing.
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1019137 (CONFIRM)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63154 (BID)
oval:org.mitre.oval:def:19088 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5784
CVE: CVE-2013-5784
Id:
CVE-2013-5784
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to SCRIPTING.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63098 (BID)
oval:org.mitre.oval:def:19049 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5790
CVE: CVE-2013-5790
Id:
CVE-2013-5790
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5790
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to BEANS.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
USN-2033-1 (UBUNTU)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63102 (BID)
oval:org.mitre.oval:def:18733 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5797
CVE: CVE-2013-5797
Id:
CVE-2013-5797
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5797
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and JavaFX 2.2.40 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.
CVSSv2 Score:
3.5
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
SINGLE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:S/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=1018720 (CONFIRM)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63095 (BID)
oval:org.mitre.oval:def:18956 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5802
CVE: CVE-2013-5802
Id:
CVE-2013-5802
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1019130 (CONFIRM)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63135 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19207 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5803
CVE: CVE-2013-5803
Id:
CVE-2013-5803
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5803
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JGSS.
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=1018713 (CONFIRM)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63082 (BID)
oval:org.mitre.oval:def:18874 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5804
CVE: CVE-2013-5804
Id:
CVE-2013-5804
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, and JRockit R27.7.6 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc.
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=1019131 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63149 (BID)
oval:org.mitre.oval:def:19188 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5809
CVE: CVE-2013-5809
Id:
CVE-2013-5809
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-5829.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=1019113 (CONFIRM)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56249 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21660987 (CONFIRM)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
63118 (BID)
oval:org.mitre.oval:def:18504 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5814
CVE: CVE-2013-5814
Id:
CVE-2013-5814
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=1019117 (CONFIRM)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63143 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19185 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5817
CVE: CVE-2013-5817
Id:
CVE-2013-5817
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1019118 (CONFIRM)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63146 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19024 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5820
CVE: CVE-2013-5820
Id:
CVE-2013-5820
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to JAX-WS.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63133 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19206 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5823
CVE: CVE-2013-5823
Id:
CVE-2013-5823
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via unknown vectors related to Security.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:18783 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5825
CVE: CVE-2013-5825
Id:
CVE-2013-5825
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JAXP.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
63101 (BID)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19046 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5829
CVE: CVE-2013-5829
Id:
CVE-2013-5829
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-5809.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
63137 (BID)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=1019115 (CONFIRM)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19189 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5830
CVE: CVE-2013-5830
Id:
CVE-2013-5830
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
63121 (BID)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=1019110 (CONFIRM)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19096 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5840
CVE: CVE-2013-5840
Id:
CVE-2013-5840
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
63148 (BID)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1018831 (CONFIRM)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:18990 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5842
CVE: CVE-2013-5842
Id:
CVE-2013-5842
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5850.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
RHSA-2013:1451 (REDHAT)
RHSA-2013:1447 (REDHAT)
http://www.zerodayinitiative.com/advisories/ZDI-13-246/ (MISC)
98532 (OSVDB)
63150 (BID)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=1019123 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:18436 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5849
CVE: CVE-2013-5849
Id:
CVE-2013-5849
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to AWT.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
63106 (BID)
RHSA-2013:1451 (REDHAT)
98564 (OSVDB)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=1018750 (CONFIRM)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
RHSA-2013:1509 (REDHAT)
HPSBUX02944 (HP)
HPSBUX02943 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oracle-cpuoct2013-cve20135849(88003) (XF)
oval:org.mitre.oval:def:18971 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5850
CVE: CVE-2013-5850
Id:
CVE-2013-5850
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850
Comment
: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5842.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
RHSA-2013:1440 (REDHAT)
63153 (BID)
RHSA-2013:1451 (REDHAT)
98535 (OSVDB)
RHSA-2013:1447 (REDHAT)
http://support.apple.com/kb/HT5982 (CONFIRM)
APPLE-SA-2013-10-15-1 (APPLE)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21655201 (CONFIRM)
openSUSE-SU-2013:1663 (SUSE)
SUSE-SU-2013:1666 (SUSE)
RHSA-2013:1507 (REDHAT)
RHSA-2013:1505 (REDHAT)
SUSE-SU-2013:1677 (SUSE)
RHSA-2013:1508 (REDHAT)
USN-2033-1 (UBUNTU)
RHSA-2013:1793 (REDHAT)
HPSBUX02944 (HP)
56338 (SECUNIA)
USN-2089-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19150 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-0424
CVE: CVE-2013-0424
Id:
CVE-2013-0424
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0424
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=906813 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e173569e1e7 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
GLSA-201406-32 (GENTOO)
57715 (BID)
oval:org.mitre.oval:def:19522 (OVAL)
oval:org.mitre.oval:def:19423 (OVAL)
oval:org.mitre.oval:def:19131 (OVAL)
oval:org.mitre.oval:def:16519 (OVAL)
CVE: CVE-2013-0425
CVE: CVE-2013-0425
Id:
CVE-2013-0425
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0425
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907344 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57709 (BID)
oval:org.mitre.oval:def:19503 (OVAL)
oval:org.mitre.oval:def:19502 (OVAL)
oval:org.mitre.oval:def:19483 (OVAL)
oval:org.mitre.oval:def:16058 (OVAL)
CVE: CVE-2013-0426
CVE: CVE-2013-0426
Id:
CVE-2013-0426
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0426
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907346 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57711 (BID)
oval:org.mitre.oval:def:19484 (OVAL)
oval:org.mitre.oval:def:19471 (OVAL)
oval:org.mitre.oval:def:19261 (OVAL)
oval:org.mitre.oval:def:15888 (OVAL)
CVE: CVE-2013-0427
CVE: CVE-2013-0427
Id:
CVE-2013-0427
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0427
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907455 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/87d135824bdf (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57724 (BID)
oval:org.mitre.oval:def:19488 (OVAL)
oval:org.mitre.oval:def:19245 (OVAL)
oval:org.mitre.oval:def:18641 (OVAL)
oval:org.mitre.oval:def:16013 (OVAL)
CVE: CVE-2013-0428
CVE: CVE-2013-0428
Id:
CVE-2013-0428
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0428
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=907207 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c9534e095b37 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57713 (BID)
oval:org.mitre.oval:def:19491 (OVAL)
oval:org.mitre.oval:def:19480 (OVAL)
oval:org.mitre.oval:def:19474 (OVAL)
oval:org.mitre.oval:def:16496 (OVAL)
CVE: CVE-2013-0429
CVE: CVE-2013-0429
Id:
CVE-2013-0429
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0429
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.
CVSSv2 Score:
7.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907460 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/c1ed8145c1b8 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57710 (BID)
oval:org.mitre.oval:def:19457 (OVAL)
oval:org.mitre.oval:def:19342 (OVAL)
oval:org.mitre.oval:def:19300 (OVAL)
oval:org.mitre.oval:def:16649 (OVAL)
CVE: CVE-2013-0432
CVE: CVE-2013-0432
Id:
CVE-2013-0432
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0432
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907219 (CONFIRM)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/e46d557465da (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57727 (BID)
oval:org.mitre.oval:def:19489 (OVAL)
oval:org.mitre.oval:def:19426 (OVAL)
oval:org.mitre.oval:def:19181 (OVAL)
oval:org.mitre.oval:def:16567 (OVAL)
CVE: CVE-2013-0433
CVE: CVE-2013-0433
Id:
CVE-2013-0433
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0433
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ab011765c4e8 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=907456 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57719 (BID)
oval:org.mitre.oval:def:19468 (OVAL)
oval:org.mitre.oval:def:19459 (OVAL)
oval:org.mitre.oval:def:19405 (OVAL)
oval:org.mitre.oval:def:16537 (OVAL)
CVE: CVE-2013-0434
CVE: CVE-2013-0434
Id:
CVE-2013-0434
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0434
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jaxp/rev/91fcc41a0b4b (CONFIRM)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907453 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57730 (BID)
oval:org.mitre.oval:def:19505 (OVAL)
oval:org.mitre.oval:def:19430 (OVAL)
oval:org.mitre.oval:def:19272 (OVAL)
oval:org.mitre.oval:def:16528 (OVAL)
CVE: CVE-2013-0435
CVE: CVE-2013-0435
Id:
CVE-2013-0435
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0435
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c1fa21042291 (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906892 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
GLSA-201406-32 (GENTOO)
57729 (BID)
oval:org.mitre.oval:def:19520 (OVAL)
oval:org.mitre.oval:def:19078 (OVAL)
oval:org.mitre.oval:def:16489 (OVAL)
CVE: CVE-2013-0440
CVE: CVE-2013-0440
Id:
CVE-2013-0440
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0440
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
https://bugzilla.redhat.com/show_bug.cgi?id=859140 (CONFIRM)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/5c1e8b779c65 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57712 (BID)
oval:org.mitre.oval:def:19397 (OVAL)
oval:org.mitre.oval:def:19285 (OVAL)
oval:org.mitre.oval:def:19229 (OVAL)
oval:org.mitre.oval:def:16558 (OVAL)
CVE: CVE-2013-0441
CVE: CVE-2013-0441
Id:
CVE-2013-0441
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0441
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907458 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/307ddc7799c7 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57692 (BID)
oval:org.mitre.oval:def:19509 (OVAL)
oval:org.mitre.oval:def:19289 (OVAL)
oval:org.mitre.oval:def:19266 (OVAL)
oval:org.mitre.oval:def:16566 (OVAL)
CVE: CVE-2013-0442
CVE: CVE-2013-0442
Id:
CVE-2013-0442
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0442
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69 (CONFIRM)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906899 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57687 (BID)
oval:org.mitre.oval:def:19434 (OVAL)
oval:org.mitre.oval:def:19126 (OVAL)
oval:org.mitre.oval:def:18597 (OVAL)
oval:org.mitre.oval:def:16035 (OVAL)
CVE: CVE-2013-0443
CVE: CVE-2013-0443
Id:
CVE-2013-0443
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0443
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/496bced2d275 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=907340 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
GLSA-201406-32 (GENTOO)
57702 (BID)
oval:org.mitre.oval:def:19437 (OVAL)
oval:org.mitre.oval:def:19382 (OVAL)
oval:org.mitre.oval:def:19010 (OVAL)
oval:org.mitre.oval:def:15832 (OVAL)
CVE: CVE-2013-0445
CVE: CVE-2013-0445
Id:
CVE-2013-0445
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0445
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=906900 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69 (CONFIRM)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
57689 (BID)
oval:org.mitre.oval:def:19372 (OVAL)
oval:org.mitre.oval:def:19304 (OVAL)
oval:org.mitre.oval:def:19282 (OVAL)
oval:org.mitre.oval:def:16680 (OVAL)
CVE: CVE-2013-0450
CVE: CVE-2013-0450
Id:
CVE-2013-0450
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0450
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e0d9f4942af (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=906911 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57703 (BID)
oval:org.mitre.oval:def:19572 (OVAL)
oval:org.mitre.oval:def:19363 (OVAL)
oval:org.mitre.oval:def:19286 (OVAL)
oval:org.mitre.oval:def:16550 (OVAL)
CVE: CVE-2013-1475
CVE: CVE-2013-1475
Id:
CVE-2013-1475
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1475
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=860652 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/127e4c348a71 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
http://www-01.ibm.com/support/docview.wss?uid=swg21631786 (CONFIRM)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57694 (BID)
oval:org.mitre.oval:def:19593 (OVAL)
oval:org.mitre.oval:def:19325 (OVAL)
oval:org.mitre.oval:def:19238 (OVAL)
oval:org.mitre.oval:def:16613 (OVAL)
CVE: CVE-2013-1476
CVE: CVE-2013-1476
Id:
CVE-2013-1476
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1476
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/5116fe321210 (CONFIRM)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907457 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
openSUSE-SU-2013:0312 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57696 (BID)
oval:org.mitre.oval:def:19507 (OVAL)
oval:org.mitre.oval:def:19475 (OVAL)
oval:org.mitre.oval:def:19466 (OVAL)
oval:org.mitre.oval:def:16652 (OVAL)
CVE: CVE-2013-1478
CVE: CVE-2013-1478
Id:
CVE-2013-1478
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1478
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=906894 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/d89bd26ac435 (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21645566 (CONFIRM)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
GLSA-201406-32 (GENTOO)
57686 (BID)
oval:org.mitre.oval:def:19529 (OVAL)
oval:org.mitre.oval:def:19454 (OVAL)
oval:org.mitre.oval:def:19429 (OVAL)
oval:org.mitre.oval:def:15733 (OVAL)
CVE: CVE-2013-1480
CVE: CVE-2013-1480
Id:
CVE-2013-1480
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1480
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (CONFIRM)
RHSA-2013:0237 (REDHAT)
RHSA-2013:0236 (REDHAT)
TA13-032A (CERT)
VU#858729 (CERT-VN)
RHSA-2013:0245 (REDHAT)
RHSA-2013:0247 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS (CONFIRM)
RHSA-2013:0246 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=906904 (CONFIRM)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/50e268c1fb1f (CONFIRM)
openSUSE-SU-2013:0377 (SUSE)
SUSE-SU-2013:0478 (SUSE)
HPSBUX02857 (HP)
SSRT101156 (HP)
HPSBMU02874 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
GLSA-201406-32 (GENTOO)
57691 (BID)
oval:org.mitre.oval:def:19504 (OVAL)
oval:org.mitre.oval:def:19351 (OVAL)
oval:org.mitre.oval:def:18845 (OVAL)
oval:org.mitre.oval:def:16045 (OVAL)
CVE: CVE-2013-1500
CVE: CVE-2013-1500
Id:
CVE-2013-1500
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1500
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory.
CVSSv2 Score:
3.6
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://twitter.com/timb_machine/status/347110990124568577 (MISC)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/1111f9acb96b (MISC)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=975148 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21644197 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
SUSE-SU-2013:1305 (SUSE)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60627 (BID)
oval:org.mitre.oval:def:19726 (OVAL)
oval:org.mitre.oval:def:19663 (OVAL)
oval:org.mitre.oval:def:17221 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-1571
CVE: CVE-2013-1571
Id:
CVE-2013-1571
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1571
Comment
: Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=973474 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/langtools/rev/17ee569d0c01 (MISC)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21644197 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
VU#225657 (CERT-VN)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60634 (BID)
oval:org.mitre.oval:def:19718 (OVAL)
oval:org.mitre.oval:def:19667 (OVAL)
oval:org.mitre.oval:def:19518 (OVAL)
oval:org.mitre.oval:def:17215 (OVAL)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ ()
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ ()
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ ()
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ ()
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ ()
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ ()
[openoffice-commits] 20200305 svn commit: r1874832 - in /openoffice/ooo-site/trunk/content: download/checksums.html download/globalvars.js download/test/globalvars.js security/cves/CVE-2012-0037.html security/cves/CVE-2013-1571.html ()
CVE: CVE-2013-2407
CVE: CVE-2013-2407
Id:
CVE-2013-2407
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2407
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "XML security and the class loader."
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/c82ed89b21bc (MISC)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/0e80792291c0 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975127 (CONFIRM)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
SUSE-SU-2013:1256 (SUSE)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60653 (BID)
oval:org.mitre.oval:def:19568 (OVAL)
oval:org.mitre.oval:def:18622 (OVAL)
oval:org.mitre.oval:def:17195 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2412
CVE: CVE-2013-2412
Id:
CVE-2013-2412
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2412
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient indication of an SSL connection failure by JConsole, related to RMI connection dialog box.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/3927a18bbcbf (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975144 (CONFIRM)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60618 (BID)
oval:org.mitre.oval:def:19633 (OVAL)
oval:org.mitre.oval:def:19375 (OVAL)
oval:org.mitre.oval:def:17098 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2443
CVE: CVE-2013-2443
Id:
CVE-2013-2443
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2443
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2452 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect "checking order" within the AccessControlContext class.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/f6dce3552285 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975137 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/0344da726f70 (MISC)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21644197 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60646 (BID)
oval:org.mitre.oval:def:19299 (OVAL)
oval:org.mitre.oval:def:17230 (OVAL)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2444
CVE: CVE-2013-2444
Id:
CVE-2013-2444
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2444
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not "properly manage and restrict certain resources related to the processing of fonts," possibly involving temporary files.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/09c14ca57ff0 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975131 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60633 (BID)
oval:org.mitre.oval:def:19602 (OVAL)
oval:org.mitre.oval:def:19476 (OVAL)
oval:org.mitre.oval:def:19307 (OVAL)
oval:org.mitre.oval:def:16851 (OVAL)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2445
CVE: CVE-2013-2445
Id:
CVE-2013-2445
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2445
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Hotspot. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "handling of memory allocation errors."
CVSSv2 Score:
7.8
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/hotspot/rev/ed3ac73a70ab (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975124 (CONFIRM)
54154 (SECUNIA)
SSRT101305 (HP)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60639 (BID)
oval:org.mitre.oval:def:19516 (OVAL)
oval:org.mitre.oval:def:19190 (OVAL)
oval:org.mitre.oval:def:19059 (OVAL)
oval:org.mitre.oval:def:17090 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2446
CVE: CVE-2013-2446
Id:
CVE-2013-2446
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2446
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue does not properly enforce access restrictions for CORBA output streams.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975132 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/corba/rev/161ec4dd450d (MISC)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60620 (BID)
oval:org.mitre.oval:def:19658 (OVAL)
oval:org.mitre.oval:def:19225 (OVAL)
oval:org.mitre.oval:def:19062 (OVAL)
oval:org.mitre.oval:def:16311 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2447
CVE: CVE-2013-2447
Id:
CVE-2013-2447
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2447
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to obtain a socket's local address via vectors involving inconsistencies between Socket.getLocalAddress and InetAddress.getLocalHost.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/cc656d61e713 (MISC)
RHSA-2013:0963 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=975140 (CONFIRM)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60629 (BID)
oval:org.mitre.oval:def:19324 (OVAL)
oval:org.mitre.oval:def:19252 (OVAL)
oval:org.mitre.oval:def:18699 (OVAL)
oval:org.mitre.oval:def:16770 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2448
CVE: CVE-2013-2448
Id:
CVE-2013-2448
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2448
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to insufficient "access restrictions" and "robustness of sound classes."
CVSSv2 Score:
7.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/91ce9432f88d (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975125 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60640 (BID)
oval:org.mitre.oval:def:19692 (OVAL)
oval:org.mitre.oval:def:19669 (OVAL)
oval:org.mitre.oval:def:19632 (OVAL)
oval:org.mitre.oval:def:17052 (OVAL)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2450
CVE: CVE-2013-2450
Id:
CVE-2013-2450
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2450
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper handling of circular references in ObjectStreamClass.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975141 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/285765be3123 (MISC)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60638 (BID)
oval:org.mitre.oval:def:19645 (OVAL)
oval:org.mitre.oval:def:19562 (OVAL)
oval:org.mitre.oval:def:19290 (OVAL)
oval:org.mitre.oval:def:17176 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2452
CVE: CVE-2013-2452
Id:
CVE-2013-2452
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2452
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "network address handling in virtual machine identifiers" and the lack of "unique and unpredictable IDs" in the java.rmi.dgc.VMID class.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/25ebac17c3cb (MISC)
RHSA-2013:0963 (REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=975138 (CONFIRM)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60617 (BID)
oval:org.mitre.oval:def:19665 (OVAL)
oval:org.mitre.oval:def:19231 (OVAL)
oval:org.mitre.oval:def:19213 (OVAL)
oval:org.mitre.oval:def:16580 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2453
CVE: CVE-2013-2453
Id:
CVE-2013-2453
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2453
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to a missing check for "package access" by the MBeanServer Introspector.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/c14aa930b032 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975134 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1255 (SUSE)
SUSE-SU-2013:1256 (SUSE)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60644 (BID)
oval:org.mitre.oval:def:19611 (OVAL)
oval:org.mitre.oval:def:19588 (OVAL)
oval:org.mitre.oval:def:16545 (OVAL)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2455
CVE: CVE-2013-2455
Id:
CVE-2013-2455
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2455
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2452. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect access checks by the (1) getEnclosingClass, (2) getEnclosingMethod, and (3) getEnclosingConstructor methods.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/5d5ca338574f (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975139 (CONFIRM)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21644197 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
SUSE-SU-2013:1305 (SUSE)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60619 (BID)
oval:org.mitre.oval:def:19622 (OVAL)
oval:org.mitre.oval:def:19560 (OVAL)
oval:org.mitre.oval:def:19435 (OVAL)
oval:org.mitre.oval:def:17214 (OVAL)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2456
CVE: CVE-2013-2456
Id:
CVE-2013-2456
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2456
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serialization. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper access checks for subclasses in the ObjectOutputStream class.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/141facdacbf0 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975142 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60641 (BID)
oval:org.mitre.oval:def:19676 (OVAL)
oval:org.mitre.oval:def:19643 (OVAL)
oval:org.mitre.oval:def:19267 (OVAL)
oval:org.mitre.oval:def:17294 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2457
CVE: CVE-2013-2457
Id:
CVE-2013-2457
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2457
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to JMX. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect implementation of "certain class checks" that allows remote attackers to bypass intended class restrictions.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975133 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/ffef9e05564e (MISC)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60632 (BID)
oval:org.mitre.oval:def:19696 (OVAL)
oval:org.mitre.oval:def:19638 (OVAL)
oval:org.mitre.oval:def:19276 (OVAL)
oval:org.mitre.oval:def:17256 (OVAL)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2459
CVE: CVE-2013-2459
Id:
CVE-2013-2459
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2459
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "integer overflow checks."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975121 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/c98afec1bf86 (MISC)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60647 (BID)
oval:org.mitre.oval:def:19741 (OVAL)
oval:org.mitre.oval:def:19587 (OVAL)
oval:org.mitre.oval:def:19310 (OVAL)
oval:org.mitre.oval:def:17181 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2461
CVE: CVE-2013-2461
Id:
CVE-2013-2461
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2461
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm."
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975126 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2 (MISC)
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html (CONFIRM)
54154 (SECUNIA)
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html (CONFIRM)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
GLSA-201406-32 (GENTOO)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
60645 (BID)
oval:org.mitre.oval:def:19582 (OVAL)
oval:org.mitre.oval:def:19565 (OVAL)
oval:org.mitre.oval:def:16887 (OVAL)
RHSA-2014:0414 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2013-2463
CVE: CVE-2013-2463
Id:
CVE-2013-2463
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2463
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975115 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b79d56eee18e (MISC)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
http://www.informationweek.com/security/vulnerabilities/hackers-target-java-6-with-security-expl/240160443 (MISC)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60655 (BID)
oval:org.mitre.oval:def:19685 (OVAL)
oval:org.mitre.oval:def:19620 (OVAL)
oval:org.mitre.oval:def:19373 (OVAL)
oval:org.mitre.oval:def:17149 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2465
CVE: CVE-2013-2465
Id:
CVE-2013-2465
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2465
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975118 (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 (MISC)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60657 (BID)
oval:org.mitre.oval:def:19703 (OVAL)
oval:org.mitre.oval:def:19455 (OVAL)
oval:org.mitre.oval:def:19074 (OVAL)
oval:org.mitre.oval:def:17106 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2469
CVE: CVE-2013-2469
Id:
CVE-2013-2469
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2469
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image layout verification" in 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/64055b403176 (MISC)
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=975120 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60658 (BID)
oval:org.mitre.oval:def:19713 (OVAL)
oval:org.mitre.oval:def:19552 (OVAL)
oval:org.mitre.oval:def:19314 (OVAL)
oval:org.mitre.oval:def:17042 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2470
CVE: CVE-2013-2470
Id:
CVE-2013-2470
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2470
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/89d9ec9e80c1 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975099 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60651 (BID)
oval:org.mitre.oval:def:19655 (OVAL)
oval:org.mitre.oval:def:19517 (OVAL)
oval:org.mitre.oval:def:19348 (OVAL)
oval:org.mitre.oval:def:16806 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2471
CVE: CVE-2013-2471
Id:
CVE-2013-2471
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2471
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/4c3d38927a26 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975102 (CONFIRM)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60659 (BID)
oval:org.mitre.oval:def:19441 (OVAL)
oval:org.mitre.oval:def:19413 (OVAL)
oval:org.mitre.oval:def:19295 (OVAL)
oval:org.mitre.oval:def:16840 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2472
CVE: CVE-2013-2472
Id:
CVE-2013-2472
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2472
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
RHSA-2013:0963 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/3cd4bec64e31 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=975107 (CONFIRM)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
RHSA-2013:1059 (REDHAT)
MDVSA-2013:183 (MANDRIVA)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60656 (BID)
oval:org.mitre.oval:def:19543 (OVAL)
oval:org.mitre.oval:def:18846 (OVAL)
oval:org.mitre.oval:def:18742 (OVAL)
oval:org.mitre.oval:def:16712 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-2473
CVE: CVE-2013-2473
Id:
CVE-2013-2473
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2473
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=975110 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/259d4998ce2f (MISC)
RHSA-2013:0963 (REDHAT)
54154 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21642336 (CONFIRM)
SUSE-SU-2013:1293 (SUSE)
SUSE-SU-2013:1305 (SUSE)
SUSE-SU-2013:1256 (SUSE)
SUSE-SU-2013:1255 (SUSE)
RHSA-2013:1081 (REDHAT)
RHSA-2013:1060 (REDHAT)
SUSE-SU-2013:1257 (SUSE)
SSRT101305 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
TA13-169A (CERT)
HPSBUX02908 (HP)
HPSBUX02907 (HP)
MDVSA-2013:183 (MANDRIVA)
RHSA-2013:1059 (REDHAT)
http://advisories.mageia.org/MGASA-2013-0185.html (CONFIRM)
GLSA-201406-32 (GENTOO)
60623 (BID)
oval:org.mitre.oval:def:19652 (OVAL)
oval:org.mitre.oval:def:19600 (OVAL)
oval:org.mitre.oval:def:18888 (OVAL)
oval:org.mitre.oval:def:17189 (OVAL)
SUSE-SU-2013:1264 (SUSE)
SUSE-SU-2013:1263 (SUSE)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-0169
CVE: CVE-2013-0169
Id:
CVE-2013-0169
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169
Comment
: The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE:
310 (Cryptographic Issues)
References:
http://www.openssl.org/news/secadv_20130204.txt (CONFIRM)
https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released (CONFIRM)
[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (MLIST)
http://www.isg.rhul.ac.uk/tls/TLStiming.pdf (MISC)
http://www.matrixssl.org/news.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html (CONFIRM)
USN-1735-1 (UBUNTU)
openSUSE-SU-2013:0375 (SUSE)
DSA-2621 (DEBIAN)
SUSE-SU-2013:0328 (SUSE)
RHSA-2013:0587 (REDHAT)
DSA-2622 (DEBIAN)
openSUSE-SU-2013:0378 (SUSE)
TA13-051A (CERT)
RHSA-2013:0783 (REDHAT)
HPSBUX02856 (HP)
HPSBUX02857 (HP)
HPSBMU02874 (HP)
RHSA-2013:0782 (REDHAT)
http://www-01.ibm.com/support/docview.wss?uid=swg21644047 (CONFIRM)
VU#737740 (CERT-VN)
APPLE-SA-2013-09-12-1 (APPLE)
http://support.apple.com/kb/HT5880 (CONFIRM)
55139 (SECUNIA)
55108 (SECUNIA)
55351 (SECUNIA)
55350 (SECUNIA)
1029190 (SECTRACK)
55322 (SECUNIA)
RHSA-2013:1455 (REDHAT)
RHSA-2013:0833 (REDHAT)
RHSA-2013:1456 (REDHAT)
FEDORA-2013-4403 (FEDORA)
SSRT101289 (HP)
SUSE-SU-2013:0701 (SUSE)
http://www.splunk.com/view/SP-CAAAHXG (CONFIRM)
53623 (SECUNIA)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084 (CONFIRM)
http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/ (MISC)
SUSE-SU-2014:0320 (SUSE)
GLSA-201406-32 (GENTOO)
SUSE-SU-2015:0578 (SUSE)
SSRT101108 (HP)
57778 (BID)
openSUSE-SU-2016:0640 (SUSE)
oval:org.mitre.oval:def:19608 (OVAL)
oval:org.mitre.oval:def:19540 (OVAL)
oval:org.mitre.oval:def:19424 (OVAL)
oval:org.mitre.oval:def:19016 (OVAL)
oval:org.mitre.oval:def:18841 (OVAL)
https://puppet.com/security/cve/cve-2013-0169 (CONFIRM)
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001 (CONFIRM)
[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update (MLIST)
https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf (CONFIRM)
CVE: CVE-2013-1486
CVE: CVE-2013-1486
Id:
CVE-2013-1486
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1486
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html (CONFIRM)
openSUSE-SU-2013:0375 (SUSE)
SUSE-SU-2013:0328 (SUSE)
USN-1735-1 (UBUNTU)
openSUSE-SU-2013:0378 (SUSE)
TA13-051A (CERT)
HPSBMU02874 (HP)
HPSBUX02857 (HP)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
MDVSA-2013:095 (MANDRIVA)
http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/ (MISC)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084 (CONFIRM)
GLSA-201406-32 (GENTOO)
58029 (BID)
oval:org.mitre.oval:def:19469 (OVAL)
oval:org.mitre.oval:def:19402 (OVAL)
CVE: CVE-2013-0401
CVE: CVE-2013-0401
Id:
CVE-2013-0401
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0401
Comment
: The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE:
94 (Improper Control of Generation of Code ('Code Injection'))
References:
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 (MISC)
https://twitter.com/thezdi/status/309784608508100608 (MISC)
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ (MISC)
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
USN-1806-1 (UBUNTU)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
openSUSE-SU-2013:0777 (SUSE)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=920245 (MISC)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:19641 (OVAL)
oval:org.mitre.oval:def:19463 (OVAL)
oval:org.mitre.oval:def:16297 (OVAL)
CVE: CVE-2013-1488
CVE: CVE-2013-1488
Id:
CVE-2013-1488
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1488
Comment
: The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE:
94 (Improper Control of Generation of Code ('Code Injection'))
References:
https://twitter.com/thezdi/status/309425888188043264 (MISC)
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ (MISC)
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 (MISC)
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=920247 (MISC)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb (MISC)
RHSA-2013:0752 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
TA13-107A (CERT)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:16511 (OVAL)
CVE: CVE-2013-1518
CVE: CVE-2013-1518
Id:
CVE-2013-1518
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1518
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jaxp/rev/38d4d23d167c (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952646 (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59141 (BID)
oval:org.mitre.oval:def:19705 (OVAL)
oval:org.mitre.oval:def:19451 (OVAL)
oval:org.mitre.oval:def:16702 (OVAL)
CVE: CVE-2013-1537
CVE: CVE-2013-1537
Id:
CVE-2013-1537
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1537
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
USN-1806-1 (UBUNTU)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/096ed306159f (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
openSUSE-SU-2013:0777 (SUSE)
http://www.oracle.com/technetwork/java/javase/7u21-relnotes-1932873.html#rmichanges (MISC)
http://www.security-explorations.com/en/SE-2012-01-details.html (MISC)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/f098e2297ff1 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952387 (MISC)
SUSE-SU-2013:0814 (SUSE)
20130205 Re: [SE-2012-01] Details of issues fixed by Feb 2013 Java SE CPU (FULLDISC)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
MDVSA-2013:150 (MANDRIVA)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59194 (BID)
oval:org.mitre.oval:def:19550 (OVAL)
oval:org.mitre.oval:def:19385 (OVAL)
oval:org.mitre.oval:def:16578 (OVAL)
CVE: CVE-2013-1557
CVE: CVE-2013-1557
Id:
CVE-2013-1557
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1557
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
USN-1806-1 (UBUNTU)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/76eb3fb80740 (MISC)
RHSA-2013:0757 (REDHAT)
IV40772 (AIXAPAR)
openSUSE-SU-2013:0777 (SUSE)
SUSE-SU-2013:0814 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952648 (MISC)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21645566 (CONFIRM)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59170 (BID)
oval:org.mitre.oval:def:19672 (OVAL)
oval:org.mitre.oval:def:19294 (OVAL)
oval:org.mitre.oval:def:16688 (OVAL)
CVE: CVE-2013-1558
CVE: CVE-2013-1558
Id:
CVE-2013-1558
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1558
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
RHSA-2013:0757 (REDHAT)
SSRT101252 (HP)
TA13-107A (CERT)
APPLE-SA-2013-04-16-2 (APPLE)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
59219 (BID)
oval:org.mitre.oval:def:19158 (OVAL)
oval:org.mitre.oval:def:16543 (OVAL)
CVE: CVE-2013-1569
CVE: CVE-2013-1569
Id:
CVE-2013-1569
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1569
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
USN-1806-1 (UBUNTU)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
openSUSE-SU-2013:0777 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952711 (MISC)
http://site.icu-project.org/download/51#TOC-Known-Issues (CONFIRM)
SUSE-SU-2013:0814 (SUSE)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/6784c9903db7 (MISC)
http://bugs.icu-project.org/trac/ticket/10107 (CONFIRM)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59166 (BID)
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html (CONFIRM)
oval:org.mitre.oval:def:19556 (OVAL)
oval:org.mitre.oval:def:19327 (OVAL)
oval:org.mitre.oval:def:16697 (OVAL)
CVE: CVE-2013-2383
CVE: CVE-2013-2383
Id:
CVE-2013-2383
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2383
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2384, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "handling of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
USN-1806-1 (UBUNTU)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
openSUSE-SU-2013:0777 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952708 (MISC)
http://site.icu-project.org/download/51#TOC-Known-Issues (CONFIRM)
SUSE-SU-2013:0814 (SUSE)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/6784c9903db7 (MISC)
http://bugs.icu-project.org/trac/ticket/10107 (CONFIRM)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59190 (BID)
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html (CONFIRM)
oval:org.mitre.oval:def:19725 (OVAL)
oval:org.mitre.oval:def:19291 (OVAL)
oval:org.mitre.oval:def:16564 (OVAL)
CVE: CVE-2013-2384
CVE: CVE-2013-2384
Id:
CVE-2013-2384
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2384
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2383, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font layout" in the International Components for Unicode (ICU) Layout Engine before 51.2.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
USN-1806-1 (UBUNTU)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
openSUSE-SU-2013:0777 (SUSE)
http://site.icu-project.org/download/51#TOC-Known-Issues (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952709 (MISC)
SUSE-SU-2013:0814 (SUSE)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/6784c9903db7 (MISC)
http://bugs.icu-project.org/trac/ticket/10107 (CONFIRM)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59179 (BID)
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html (CONFIRM)
oval:org.mitre.oval:def:19549 (OVAL)
oval:org.mitre.oval:def:19341 (OVAL)
oval:org.mitre.oval:def:16549 (OVAL)
CVE: CVE-2013-2415
CVE: CVE-2013-2415
Id:
CVE-2013-2415
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2415
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows local users to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "processing of MTOM attachments" and the creation of temporary files with weak permissions.
CVSSv2 Score:
2.1
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
USN-1806-1 (UBUNTU)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jaxws/rev/e07c518282ba (MISC)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952389 (MISC)
openSUSE-SU-2013:0964 (SUSE)
MDVSA-2013:150 (MANDRIVA)
TA13-107A (CERT)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:16011 (OVAL)
CVE: CVE-2013-2417
CVE: CVE-2013-2417
Id:
CVE-2013-2417
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2417
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to Networking. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an information leak involving InetAddress serialization. CVE has not investigated the apparent discrepancy between vendor reports regarding the impact of this issue.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952657 (MISC)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/7ca8a40795d8 (MISC)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59187 (BID)
oval:org.mitre.oval:def:19570 (OVAL)
oval:org.mitre.oval:def:19524 (OVAL)
oval:org.mitre.oval:def:16446 (OVAL)
CVE: CVE-2013-2419
CVE: CVE-2013-2419
Id:
CVE-2013-2419
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2419
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952656 (CONFIRM)
RHSA-2013:0758 (REDHAT)
RHSA-2013:0752 (REDHAT)
USN-1806-1 (UBUNTU)
http://site.icu-project.org/download/51#TOC-Known-Issues (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
http://bugs.icu-project.org/trac/ticket/10107 (CONFIRM)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59131 (BID)
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html (CONFIRM)
oval:org.mitre.oval:def:19526 (OVAL)
oval:org.mitre.oval:def:19386 (OVAL)
oval:org.mitre.oval:def:16527 (OVAL)
CVE: CVE-2013-2420
CVE: CVE-2013-2420
Id:
CVE-2013-2420
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2420
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient "validation of images" in share/native/sun/awt/image/awt_ImageRep.c, possibly involving offsets.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/cf93d3828aa8 (MISC)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952638 (MISC)
openSUSE-SU-2013:0777 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59167 (BID)
oval:org.mitre.oval:def:19704 (OVAL)
oval:org.mitre.oval:def:19354 (OVAL)
oval:org.mitre.oval:def:16597 (OVAL)
CVE: CVE-2013-2421
CVE: CVE-2013-2421
Id:
CVE-2013-2421
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2421
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect MethodHandle lookups, which allows remote attackers to bypass Java sandbox restrictions.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952649 (MISC)
RHSA-2013:0752 (REDHAT)
USN-1806-1 (UBUNTU)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/hotspot/rev/663b5c744e82 (MISC)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
TA13-107A (CERT)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:16258 (OVAL)
CVE: CVE-2013-2422
CVE: CVE-2013-2422
Id:
CVE-2013-2422
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2422
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper method-invocation restrictions by the MethodUtil trampoline class, which allows remote attackers to bypass the Java sandbox.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952642 (MISC)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2899c3dbf5e8 (MISC)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
SUSE-SU-2013:0871 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
SSRT101252 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59228 (BID)
oval:org.mitre.oval:def:19087 (OVAL)
oval:org.mitre.oval:def:16561 (OVAL)
CVE: CVE-2013-2424
CVE: CVE-2013-2424
Id:
CVE-2013-2424
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2424
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality via vectors related to JMX. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient class access checks" when "creating new instances" using MBeanInstantiator.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/da1867780fc9 (MISC)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952509 (MISC)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59159 (BID)
oval:org.mitre.oval:def:19656 (OVAL)
oval:org.mitre.oval:def:19594 (OVAL)
oval:org.mitre.oval:def:16314 (OVAL)
CVE: CVE-2013-2426
CVE: CVE-2013-2426
Id:
CVE-2013-2426
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2426
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect invocation of the defaultReadObject method in the ConcurrentHashMap class, which allows remote attackers to bypass the Java sandbox.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
USN-1806-1 (UBUNTU)
https://bugzilla.redhat.com/show_bug.cgi?id=952653 (MISC)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/98ad2f1e25d1 (MISC)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
TA13-107A (CERT)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:16683 (OVAL)
CVE: CVE-2013-2429
CVE: CVE-2013-2429
Id:
CVE-2013-2429
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2429
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageWriter state corruption" when using native code, which triggers memory corruption.
CVSSv2 Score:
7.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/90c9f1577a0b (MISC)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
https://bugzilla.redhat.com/show_bug.cgi?id=952521 (MISC)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
SUSE-SU-2013:0871 (SUSE)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59184 (BID)
oval:org.mitre.oval:def:19203 (OVAL)
oval:org.mitre.oval:def:19107 (OVAL)
CVE: CVE-2013-2430
CVE: CVE-2013-2430
Id:
CVE-2013-2430
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2430
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; JavaFX 2.2.7 and earlier; and OpenJDK 6 and 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageReader state corruption" when using native code.
CVSSv2 Score:
7.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
RHSA-2013:0752 (REDHAT)
RHSA-2013:0758 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
SUSE-SU-2013:0835 (SUSE)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952524 (MISC)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/d868fe7c7618 (MISC)
openSUSE-SU-2013:0964 (SUSE)
SUSE-SU-2013:0871 (SUSE)
SUSE-SU-2013:0934 (SUSE)
SSRT101252 (HP)
SSRT101305 (HP)
TA13-107A (CERT)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
APPLE-SA-2013-04-16-2 (APPLE)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
MDVSA-2013:161 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
59243 (BID)
oval:org.mitre.oval:def:19715 (OVAL)
oval:org.mitre.oval:def:19536 (OVAL)
oval:org.mitre.oval:def:15708 (OVAL)
CVE: CVE-2013-2431
CVE: CVE-2013-2431
Id:
CVE-2013-2431
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2431
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to bypassing the Java sandbox using "method handle intrinsic frames."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=952645 (MISC)
RHSA-2013:0752 (REDHAT)
USN-1806-1 (UBUNTU)
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/ (CONFIRM)
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ (CONFIRM)
RHSA-2013:0757 (REDHAT)
SUSE-SU-2013:0814 (SUSE)
openSUSE-SU-2013:0777 (SUSE)
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/hotspot/rev/c954aab38a7f (MISC)
openSUSE-SU-2013:0964 (SUSE)
TA13-107A (CERT)
MDVSA-2013:161 (MANDRIVA)
MDVSA-2013:145 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 (CONFIRM)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 (CONFIRM)
[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released! (MLIST)
GLSA-201406-32 (GENTOO)
oval:org.mitre.oval:def:16410 (OVAL)
CVE: CVE-2013-0809
CVE: CVE-2013-0809
Id:
CVE-2013-0809
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0809
Comment
: Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
USN-1755-2 (UBUNTU)
RHSA-2013:0601 (REDHAT)
RHSA-2013:0604 (REDHAT)
RHSA-2013:0603 (REDHAT)
SUSE-SU-2013:0434 (SUSE)
openSUSE-SU-2013:0430 (SUSE)
openSUSE-SU-2013:0438 (SUSE)
TA13-064A (CERT)
HPSBUX02857 (HP)
SSRT101156 (HP)
[distro-pkg-dev] 20130304 [SECURITY] IcedTea6 1.11.9 and 1.12.4 Released! (MLIST)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
SUSE-SU-2013:0701 (SUSE)
http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html (CONFIRM)
VU#688246 (CERT-VN)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0088 (CONFIRM)
GLSA-201406-32 (GENTOO)
58296 (BID)
oval:org.mitre.oval:def:19479 (OVAL)
oval:org.mitre.oval:def:19320 (OVAL)
oval:org.mitre.oval:def:19076 (OVAL)
http://www.oracle.com/ocom/groups/public/%40otn/documents/webcontent/1915099.xml ()
CVE: CVE-2013-1493
CVE: CVE-2013-1493
Id:
CVE-2013-1493
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1493
Comment
: The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE:
119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
References:
http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html (MISC)
http://www.symantec.com/connect/blogs/latest-java-zero-day-shares-connections-bit9-security-incident (MISC)
https://krebsonsecurity.com/2013/03/new-java-0-day-attack-echoes-bit9-breach/ (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=917553 (CONFIRM)
https://twitter.com/jduck1337/status/307629902574800897 (MISC)
USN-1755-2 (UBUNTU)
RHSA-2013:0604 (REDHAT)
SUSE-SU-2013:0434 (SUSE)
openSUSE-SU-2013:0438 (SUSE)
RHSA-2013:0601 (REDHAT)
RHSA-2013:0603 (REDHAT)
openSUSE-SU-2013:0430 (SUSE)
TA13-064A (CERT)
HPSBUX02857 (HP)
SSRT101156 (HP)
[distro-pkg-dev] 20130304 [SECURITY] IcedTea6 1.11.9 and 1.12.4 Released! (MLIST)
RHSA-2013:1455 (REDHAT)
RHSA-2013:1456 (REDHAT)
24904 (EXPLOIT-DB)
SUSE-SU-2013:0701 (SUSE)
VU#688246 (CERT-VN)
http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html (CONFIRM)
MDVSA-2013:095 (MANDRIVA)
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0088 (CONFIRM)
GLSA-201406-32 (GENTOO)
HPSBMU02964 (HP)
1029803 (SECTRACK)
58238 (BID)
oval:org.mitre.oval:def:19477 (OVAL)
oval:org.mitre.oval:def:19246 (OVAL)
http://www.oracle.com/ocom/groups/public/%40otn/documents/webcontent/1915099.xml ()
CVE: CVE-2010-4448
CVE: CVE-2010-4448
Id:
CVE-2010-4448
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4448
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves "DNS cache poisoning by untrusted applets."
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
43350 (SECUNIA)
FEDORA-2011-1645 (FEDORA)
FEDORA-2011-1631 (FEDORA)
RHSA-2011:0282 (REDHAT)
RHSA-2011:0281 (REDHAT)
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (CONFIRM)
RHSA-2011:0880 (REDHAT)
DSA-2224 (DEBIAN)
MDVSA-2011:054 (MANDRIVA)
SUSE-SA:2011:024 (SUSE)
SUSE-SU-2011:0823 (SUSE)
44954 (SECUNIA)
49198 (SECUNIA)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
HPSBUX02777 (HP)
oval:org.mitre.oval:def:14045 (OVAL)
oval:org.mitre.oval:def:12906 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2010-4450
CVE: CVE-2010-4450
Id:
CVE-2010-4450
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4450
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier for Solaris and Linux; 5.0 Update 27 and earlier for Solaris and Linux; and 1.4.2_29 and earlier for Solaris and Linux allows local standalone applications to affect confidentiality, integrity, and availability via unknown vectors related to Launcher. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is an untrusted search path vulnerability involving an empty LD_LIBRARY_PATH environment variable.
CVSSv2 Score:
3.7
Access vector:
LOCAL
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:L/AC:H/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
43350 (SECUNIA)
FEDORA-2011-1645 (FEDORA)
http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/ (CONFIRM)
FEDORA-2011-1631 (FEDORA)
46397 (BID)
RHSA-2011:0281 (REDHAT)
RHSA-2011:0282 (REDHAT)
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (CONFIRM)
DSA-2224 (DEBIAN)
MDVSA-2011:054 (MANDRIVA)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
oracle-java-launcher-code-exec(65406) (XF)
oval:org.mitre.oval:def:14135 (OVAL)
oval:org.mitre.oval:def:12420 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2010-4465
CVE: CVE-2010-4465
Id:
CVE-2010-4465
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4465
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Swing. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to the lack of framework support by AWT event dispatch, and/or "clipboard access in Applets."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
FEDORA-2011-1645 (FEDORA)
FEDORA-2011-1631 (FEDORA)
43350 (SECUNIA)
RHSA-2011:0281 (REDHAT)
RHSA-2011:0282 (REDHAT)
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (CONFIRM)
RHSA-2011:0880 (REDHAT)
DSA-2224 (DEBIAN)
MDVSA-2011:054 (MANDRIVA)
SUSE-SA:2011:024 (SUSE)
SUSE-SU-2011:0823 (SUSE)
44954 (SECUNIA)
49198 (SECUNIA)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
HPSBUX02777 (HP)
oval:org.mitre.oval:def:14034 (OVAL)
oval:org.mitre.oval:def:12925 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2010-4469
CVE: CVE-2010-4469
Id:
CVE-2010-4469
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4469
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is heap corruption related to the Verifier and "backward jsrs."
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
FEDORA-2011-1645 (FEDORA)
43350 (SECUNIA)
FEDORA-2011-1631 (FEDORA)
RHSA-2011:0282 (REDHAT)
46400 (BID)
RHSA-2011:0281 (REDHAT)
DSA-2224 (DEBIAN)
MDVSA-2011:054 (MANDRIVA)
49198 (SECUNIA)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
HPSBUX02777 (HP)
oracle-hotspot-code-exec(65399) (XF)
oval:org.mitre.oval:def:13639 (OVAL)
oval:org.mitre.oval:def:12833 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2010-4470
CVE: CVE-2010-4470
Id:
CVE-2010-4470
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4470
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue is related to "Features set on SchemaFactory not inherited by Validator."
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
FEDORA-2011-1645 (FEDORA)
43350 (SECUNIA)
FEDORA-2011-1631 (FEDORA)
RHSA-2011:0281 (REDHAT)
46387 (BID)
RHSA-2011:0282 (REDHAT)
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (CONFIRM)
DSA-2224 (DEBIAN)
MDVSA-2011:054 (MANDRIVA)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
oracle-runtime-dos(65404) (XF)
oval:org.mitre.oval:def:14076 (OVAL)
oval:org.mitre.oval:def:12887 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2010-4472
CVE: CVE-2010-4472
Id:
CVE-2010-4472
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4472
Comment
: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect availability, related to XML Digital Signature and unspecified APIs. NOTE: the previous information was obtained from the February 2011 CPU. Oracle has not commented on claims from a downstream vendor that this issue involves the replacement of the "XML DSig Transform or C14N algorithm implementations."
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
FEDORA-2011-1631 (FEDORA)
43350 (SECUNIA)
FEDORA-2011-1645 (FEDORA)
46404 (BID)
RHSA-2011:0281 (REDHAT)
RHSA-2011:0282 (REDHAT)
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (CONFIRM)
DSA-2224 (DEBIAN)
MDVSA-2011:054 (MANDRIVA)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
oracle-java-xml-dos(65411) (XF)
oval:org.mitre.oval:def:14118 (OVAL)
oval:org.mitre.oval:def:12903 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2010-4476
CVE: CVE-2010-4476
Id:
CVE-2010-4476
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476
Comment
: The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE:
CWE-Other ()
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html (CONFIRM)
RHSA-2011:0214 (REDHAT)
PM31983 (AIXAPAR)
FEDORA-2011-1231 (FEDORA)
DSA-2161 (DEBIAN)
RHSA-2011:0282 (REDHAT)
43400 (SECUNIA)
ADV-2011-0422 (VUPEN)
RHSA-2011:0211 (REDHAT)
IZ94423 (AIXAPAR)
ADV-2011-0434 (VUPEN)
RHSA-2011:0213 (REDHAT)
43280 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21468358 (CONFIRM)
FEDORA-2011-1263 (FEDORA)
HPSBNS02633 (HP)
ADV-2011-0365 (VUPEN)
43378 (SECUNIA)
43304 (SECUNIA)
43295 (SECUNIA)
ADV-2011-0379 (VUPEN)
RHSA-2011:0212 (REDHAT)
http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html (CONFIRM)
1025062 (SECTRACK)
ADV-2011-0377 (VUPEN)
RHSA-2011:0210 (REDHAT)
http://blog.fortify.com/blog/2011/02/08/Double-Trouble (MISC)
43048 (SECUNIA)
43333 (SECUNIA)
http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html (CONFIRM)
http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ (MISC)
RHSA-2011:0334 (REDHAT)
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (CONFIRM)
RHSA-2011:0333 (REDHAT)
45555 (SECUNIA)
http://www.ibm.com/support/docview.wss?uid=swg24029498 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg24029497 (CONFIRM)
RHSA-2011:0880 (REDHAT)
HPSBMA02642 (HP)
MDVSA-2011:054 (MANDRIVA)
HPSBMU02690 (HP)
ADV-2011-0605 (VUPEN)
SSRT100412 (HP)
SUSE-SA:2011:024 (SUSE)
SUSE-SU-2011:0823 (SUSE)
43659 (SECUNIA)
44954 (SECUNIA)
45022 (SECUNIA)
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html (CONFIRM)
49198 (SECUNIA)
SSRT100627 (HP)
HPSBUX02860 (HP)
GLSA-201406-32 (GENTOO)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-003/index.html (CONFIRM)
SSRT100867 (HP)
HPSBUX02642 (HP)
HPSBTU02684 (HP)
HPSBOV02762 (HP)
HPSBOV02634 (HP)
SSRT100387 (HP)
HPSBUX02777 (HP)
HPSBUX02645 (HP)
oval:org.mitre.oval:def:19493 (OVAL)
oval:org.mitre.oval:def:14589 (OVAL)
oval:org.mitre.oval:def:14328 (OVAL)
oval:org.mitre.oval:def:12745 (OVAL)
oval:org.mitre.oval:def:12662 (OVAL)
HPSBMU02799 (HP)
CVE: CVE-2011-3389
CVE: CVE-2011-3389
Id:
CVE-2011-3389
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389
Comment
: The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE:
326 (Inadequate Encryption Strength)
References:
http://www.opera.com/docs/changelogs/unix/1151/ (CONFIRM)
49388 (BID)
http://www.opera.com/docs/changelogs/windows/1151/ (CONFIRM)
http://www.opera.com/docs/changelogs/mac/1151/ (CONFIRM)
74829 (OSVDB)
45791 (SECUNIA)
1025997 (SECTRACK)
http://eprint.iacr.org/2004/111 (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=737506 (CONFIRM)
http://ekoparty.org/2011/juliano-rizzo.php (MISC)
http://www.imperialviolet.org/2011/09/23/chromeandbeast.html (CONFIRM)
https://bugzilla.novell.com/show_bug.cgi?id=719047 (CONFIRM)
http://www.insecure.cl/Beast-SSL.rar (MISC)
http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html (MISC)
http://eprint.iacr.org/2006/136 (MISC)
http://isc.sans.edu/diary/SSL+TLS+part+3+/11635 (MISC)
http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue (CONFIRM)
http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/ (CONFIRM)
http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx (CONFIRM)
http://technet.microsoft.com/security/advisory/2588513 (CONFIRM)
http://support.apple.com/kb/HT4999 (CONFIRM)
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
http://support.apple.com/kb/HT5001 (CONFIRM)
APPLE-SA-2011-10-12-1 (APPLE)
APPLE-SA-2011-10-12-2 (APPLE)
1026103 (SECTRACK)
49778 (BID)
http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx (CONFIRM)
RHSA-2011:1384 (REDHAT)
http://vnhacker.blogspot.com/2011/09/beast.html (MISC)
VU#864643 (CERT-VN)
http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html (CONFIRM)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
http://www.opera.com/docs/changelogs/windows/1160/ (CONFIRM)
http://www.opera.com/docs/changelogs/mac/1160/ (CONFIRM)
http://www.opera.com/support/kb/view/1004/ (CONFIRM)
http://www.opera.com/docs/changelogs/unix/1160/ (CONFIRM)
RHSA-2012:0006 (REDHAT)
http://support.apple.com/kb/HT5130 (CONFIRM)
APPLE-SA-2012-02-01-1 (APPLE)
SSRT100740 (HP)
http://support.apple.com/kb/HT5281 (CONFIRM)
APPLE-SA-2012-05-09-1 (APPLE)
APPLE-SA-2012-07-25-2 (APPLE)
http://support.apple.com/kb/HT5501 (CONFIRM)
APPLE-SA-2012-09-19-2 (APPLE)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
openSUSE-SU-2012:0063 (SUSE)
openSUSE-SU-2012:0030 (SUSE)
SUSE-SU-2012:0114 (SUSE)
HPSBUX02730 (HP)
48692 (SECUNIA)
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail (CONFIRM)
48948 (SECUNIA)
48915 (SECUNIA)
TA12-010A (CERT)
HPSBMU02900 (HP)
55351 (SECUNIA)
55322 (SECUNIA)
55350 (SECUNIA)
1029190 (SECTRACK)
RHSA-2013:1455 (REDHAT)
APPLE-SA-2013-10-22-3 (APPLE)
USN-1263-1 (UBUNTU)
http://support.apple.com/kb/HT6150 (CONFIRM)
GLSA-201406-32 (GENTOO)
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html (CONFIRM)
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html (CONFIRM)
http://downloads.asterisk.org/pub/security/AST-2016-001.html (CONFIRM)
SSRT100867 (HP)
SSRT100805 (HP)
HPSBUX02777 (HP)
http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf (CONFIRM)
oval:org.mitre.oval:def:14752 (OVAL)
HPSBMU02799 (HP)
MDVSA-2012:058 (MANDRIVA)
RHSA-2012:0508 (REDHAT)
SUSE-SU-2012:0602 (SUSE)
GLSA-201203-02 (GENTOO)
48256 (SECUNIA)
1026704 (SECTRACK)
47998 (SECUNIA)
DSA-2398 (DEBIAN)
http://curl.haxx.se/docs/adv_20120124B.html (CONFIRM)
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 (MISC)
MS12-006 (MS)
https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf (CONFIRM)
openSUSE-SU-2020:0086 (SUSE)
CVE: CVE-2011-3521
CVE: CVE-2011-3521
Id:
CVE-2011-3521
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3521
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE, 7, 6 Update 27 and earlier, and 5.0 Update 31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deserialization.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
1026215 (SECTRACK)
48692 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
SSRT100805 (HP)
50215 (BID)
oracle-jre-deserialization-unspecified(70850) (XF)
oval:org.mitre.oval:def:13662 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3544
CVE: CVE-2011-3544
Id:
CVE-2011-3544
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50218 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
1026215 (SECTRACK)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
oracle-jre-scripting-unspecified(70849) (XF)
oval:org.mitre.oval:def:13947 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3547
CVE: CVE-2011-3547
Id:
CVE-2011-3547
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3547
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Networking.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50243 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2011:1478 (REDHAT)
RHSA-2012:0006 (REDHAT)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
1026215 (SECTRACK)
76511 (OSVDB)
SUSE-SU-2012:0114 (SUSE)
48692 (SECUNIA)
HPSBUX02730 (HP)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
HPSBUX02777 (HP)
SSRT100805 (HP)
jre-networking-info-disclosure(70846) (XF)
oval:org.mitre.oval:def:14339 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3548
CVE: CVE-2011-3548
Id:
CVE-2011-3548
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50211 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2011:1478 (REDHAT)
RHSA-2012:0006 (REDHAT)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
1026215 (SECTRACK)
HPSBUX02730 (HP)
76495 (OSVDB)
SUSE-SU-2012:0114 (SUSE)
48692 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
HPSBUX02777 (HP)
SSRT100805 (HP)
jre-awt-unspecified(70845) (XF)
oval:org.mitre.oval:def:14492 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3551
CVE: CVE-2011-3551
Id:
CVE-2011-3551
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3551
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50224 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
1026215 (SECTRACK)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
oracle-jre-2d-unspecified(70842) (XF)
oval:org.mitre.oval:def:14318 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3552
CVE: CVE-2011-3552
Id:
CVE-2011-3552
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote attackers to affect integrity via unknown vectors related to Networking.
CVSSv2 Score:
2.6
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2011:1478 (REDHAT)
RHSA-2012:0006 (REDHAT)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
1026215 (SECTRACK)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
48692 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
HPSBUX02777 (HP)
SSRT100805 (HP)
50248 (BID)
oracle-jre-networking-unspecified(70841) (XF)
oval:org.mitre.oval:def:14465 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3553
CVE: CVE-2011-3553
Id:
CVE-2011-3553
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3553
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JRockit R28.1.4 and earlier allows remote authenticated users to affect confidentiality, related to JAXWS.
CVSSv2 Score:
3.5
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
SINGLE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:S/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50246 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
76512 (OSVDB)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
1026215 (SECTRACK)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
oracle-jre-jaxws-info-disc(70840) (XF)
oval:org.mitre.oval:def:14311 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3554
CVE: CVE-2011-3554
Id:
CVE-2011-3554
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3554
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50216 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2011:1478 (REDHAT)
76498 (OSVDB)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
1026215 (SECTRACK)
48692 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
SSRT100805 (HP)
oracle-java-jre-unspecified(70839) (XF)
oval:org.mitre.oval:def:14524 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3556
CVE: CVE-2011-3556
Id:
CVE-2011-3556
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3556
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50231 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2011:1478 (REDHAT)
RHSA-2012:0006 (REDHAT)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
76505 (OSVDB)
1026215 (SECTRACK)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
48692 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
HPSBUX02777 (HP)
SSRT100805 (HP)
jre-rmi-unspecified(70837) (XF)
oval:org.mitre.oval:def:14316 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
VU#597809 (CERT-VN)
CVE: CVE-2011-3557
CVE: CVE-2011-3557
Id:
CVE-2011-3557
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3557
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
CVSSv2 Score:
6.8
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50234 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2012:0006 (REDHAT)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
76506 (OSVDB)
1026215 (SECTRACK)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
48692 (SECUNIA)
48948 (SECUNIA)
48915 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
HPSBUX02777 (HP)
SSRT100805 (HP)
oracle-jre-rmi-unspecified(70836) (XF)
oval:org.mitre.oval:def:14373 (OVAL)
HPSBMU02799 (HP)
RHSA-2012:0508 (REDHAT)
SUSE-SU-2012:0602 (SUSE)
48308 (SECUNIA)
CVE: CVE-2011-3558
CVE: CVE-2011-3558
Id:
CVE-2011-3558
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3558
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to HotSpot.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50242 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
76510 (OSVDB)
HPSBUX02730 (HP)
1026215 (SECTRACK)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
oracle-java-hotspot-info-disc(70835) (XF)
oval:org.mitre.oval:def:13475 (OVAL)
HPSBMU02799 (HP)
48308 (SECUNIA)
CVE: CVE-2011-3560
CVE: CVE-2011-3560
Id:
CVE-2011-3560
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3560
Comment
: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity, related to JSSE.
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html (CONFIRM)
RHSA-2011:1384 (REDHAT)
50236 (BID)
http://www.ibm.com/developerworks/java/jdk/alerts/ (CONFIRM)
RHSA-2012:0006 (REDHAT)
49198 (SECUNIA)
SUSE-SU-2012:0122 (SUSE)
76507 (OSVDB)
1026215 (SECTRACK)
HPSBUX02730 (HP)
SUSE-SU-2012:0114 (SUSE)
48692 (SECUNIA)
48948 (SECUNIA)
48915 (SECUNIA)
RHSA-2013:1455 (REDHAT)
USN-1263-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
SSRT100867 (HP)
HPSBUX02777 (HP)
SSRT100805 (HP)
oracle-jre-jsse-unspecified(70834) (XF)
oval:org.mitre.oval:def:14394 (OVAL)
HPSBMU02799 (HP)
RHSA-2012:0508 (REDHAT)
SUSE-SU-2012:0602 (SUSE)
48308 (SECUNIA)
CVE: CVE-2013-5878
CVE: CVE-2013-5878
Id:
CVE-2013-5878
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878
Comment
: Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the Security component does not properly handle null XML namespace (xmlns) attributes during XML document canonicalization, which allows attackers to escape the sandbox.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1051823 (CONFIRM)
1029608 (SECTRACK)
64927 (BID)
102005 (OSVDB)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
USN-2089-1 (UBUNTU)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
USN-2124-1 (UBUNTU)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5884
CVE: CVE-2013-5884
Id:
CVE-2013-5884
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an incorrect check for code permissions by CORBA stub factories.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1051911 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/b1548473f261 (MISC)
102016 (OSVDB)
1029608 (SECTRACK)
64924 (BID)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
USN-2089-1 (UBUNTU)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
USN-2124-1 (UBUNTU)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
oracle-cpujan2014-cve20135884(90348) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5896
CVE: CVE-2013-5896
Id:
CVE-2013-5896
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that com.sun.corba.se and its sub-packages are not included on the restricted package list.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
1029608 (SECTRACK)
64926 (BID)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/694ad155b344 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=1053266 (CONFIRM)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
102015 (OSVDB)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
SUSE-SU-2014:0266 (SUSE)
RHSA-2014:0097 (REDHAT)
openSUSE-SU-2014:0174 (SUSE)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
USN-2089-1 (UBUNTU)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
USN-2124-1 (UBUNTU)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
oracle-cpujan2014-cve20135896(90347) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5907
CVE: CVE-2013-5907
Id:
CVE-2013-5907
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1052915 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/9d29c19f1de1 (MISC)
1029608 (SECTRACK)
56487 (SECUNIA)
64894 (BID)
101995 (OSVDB)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0134 (REDHAT)
USN-2089-1 (UBUNTU)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
USN-2124-1 (UBUNTU)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2013-5910
CVE: CVE-2013-5910
Id:
CVE-2013-5910
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910
Comment
: Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that CanonicalizerBase.java in the XML canonicalizer allows untrusted code to access mutable byte arrays.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
1029608 (SECTRACK)
https://bugzilla.redhat.com/show_bug.cgi?id=1052942 (CONFIRM)
102021 (OSVDB)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/07004bb53c3c (CONFIRM)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
64933 (BID)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
SUSE-SU-2014:0266 (SUSE)
RHSA-2014:0097 (REDHAT)
openSUSE-SU-2014:0174 (SUSE)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
USN-2089-1 (UBUNTU)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
USN-2124-1 (UBUNTU)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
oracle-cpujan2014-cve20135910(90352) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0368
CVE: CVE-2014-0368
Id:
CVE-2014-0368
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1052919 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5 (MISC)
64930 (BID)
1029608 (SECTRACK)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
SUSE-SU-2014:0266 (SUSE)
RHSA-2014:0097 (REDHAT)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676978 (CONFIRM)
59339 (SECUNIA)
59235 (SECUNIA)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0373
CVE: CVE-2014-0373
Id:
CVE-2014-0373
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1051699 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec (MISC)
1029608 (SECTRACK)
64922 (BID)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
SUSE-SU-2014:0266 (SUSE)
RHSA-2014:0097 (REDHAT)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0376
CVE: CVE-2014-0376
Id:
CVE-2014-0376
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736 (MISC)
http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab (MISC)
https://bugzilla.redhat.com/show_bug.cgi?id=1051923 (CONFIRM)
1029608 (SECTRACK)
64907 (BID)
102018 (OSVDB)
56535 (SECUNIA)
56485 (SECUNIA)
56432 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
oracle-cpujan2014-cve20140376(90350) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0411
CVE: CVE-2014-0411
Id:
CVE-2014-0411
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc (CONFIRM)
56487 (SECUNIA)
64918 (BID)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
1029608 (SECTRACK)
102028 (OSVDB)
https://bugzilla.redhat.com/show_bug.cgi?id=1053010 (CONFIRM)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
59254 (SECUNIA)
59082 (SECUNIA)
https://www.ibm.com/support/docview.wss?uid=swg21675223 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21672078 (CONFIRM)
59071 (SECUNIA)
59251 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004656 (CONFIRM)
59704 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21669519 (CONFIRM)
59872 (SECUNIA)
https://www.ibm.com/support/docview.wss?uid=swg21677913 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21675938 (CONFIRM)
59037 (SECUNIA)
http://www.ibm.com/support/docview.wss?uid=ssg1S1004745 (CONFIRM)
57809 (SECUNIA)
59665 (SECUNIA)
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132 (CONFIRM)
60498 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21680234 (CONFIRM)
60005 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21680387 (CONFIRM)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21682904 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21682671 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21682670 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21682669 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21682668 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21677388 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676978 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676373 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676190 (CONFIRM)
60836 (SECUNIA)
60835 (SECUNIA)
60833 (SECUNIA)
59705 (SECUNIA)
59339 (SECUNIA)
59324 (SECUNIA)
59283 (SECUNIA)
59235 (SECUNIA)
59194 (SECUNIA)
oracle-cpujan2014-cve20140411(90357) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0416
CVE: CVE-2014-0416
Id:
CVE-2014-0416
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1051912 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb (MISC)
1029608 (SECTRACK)
64937 (BID)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
102017 (OSVDB)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21679287 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21677388 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21677294 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676978 (CONFIRM)
60568 (SECUNIA)
59339 (SECUNIA)
59307 (SECUNIA)
59283 (SECUNIA)
59235 (SECUNIA)
oracle-cpujan2014-cve20140416(90349) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0422
CVE: CVE-2014-0422
Id:
CVE-2014-0422
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1051528 (CONFIRM)
1029608 (SECTRACK)
101997 (OSVDB)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
64921 (BID)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0423
CVE: CVE-2014-0423
Id:
CVE-2014-0423
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.
CVSSv2 Score:
5.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
SINGLE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:P/I:N/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1053066 (CONFIRM)
1029608 (SECTRACK)
56487 (SECUNIA)
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5 (CONFIRM)
64914 (BID)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21679287 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21677388 (CONFIRM)
60568 (SECUNIA)
59283 (SECUNIA)
oracle-cpujan2014-cve20140423(90340) (XF)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0428
CVE: CVE-2014-0428
Id:
CVE-2014-0428
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html (CONFIRM)
64758 (BID)
https://bugzilla.redhat.com/show_bug.cgi?id=1051519 (CONFIRM)
http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698 (MISC)
1029608 (SECTRACK)
64935 (BID)
101996 (OSVDB)
56432 (SECUNIA)
56485 (SECUNIA)
56535 (SECUNIA)
56486 (SECUNIA)
openSUSE-SU-2014:0177 (SUSE)
USN-2089-1 (UBUNTU)
RHSA-2014:0097 (REDHAT)
SUSE-SU-2014:0266 (SUSE)
openSUSE-SU-2014:0174 (SUSE)
USN-2124-1 (UBUNTU)
SUSE-SU-2014:0246 (SUSE)
RHSA-2014:0136 (REDHAT)
RHSA-2014:0134 (REDHAT)
RHSA-2014:0027 (REDHAT)
RHSA-2014:0026 (REDHAT)
openSUSE-SU-2014:0180 (SUSE)
RHSA-2014:0135 (REDHAT)
RHSA-2014:0030 (REDHAT)
SSRT101454 (HP)
SSRT101455 (HP)
SUSE-SU-2014:0451 (SUSE)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 (CONFIRM)
RHSA-2014:0414 (REDHAT)
CVE: CVE-2014-0429
CVE: CVE-2014-0429
Id:
CVE-2014-0429
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0429
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
58974 (SECUNIA)
https://www.ibm.com/support/docview.wss?uid=swg21675973 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 (CONFIRM)
SSRT101668 (HP)
66856 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0446
CVE: CVE-2014-0446
Id:
CVE-2014-0446
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0446
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66903 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0451
CVE: CVE-2014-0451
Id:
CVE-2014-0451
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0451
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66879 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0452
CVE: CVE-2014-0452
Id:
CVE-2014-0452
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0452
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66891 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0453
CVE: CVE-2014-0453
Id:
CVE-2014-0453
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0453
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
59104 (SECUNIA)
59255 (SECUNIA)
http://www.ibm.com/support/docview.wss?uid=swg21675343 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21675588 (CONFIRM)
59250 (SECUNIA)
59071 (SECUNIA)
https://www.ibm.com/support/docview.wss?uid=swg21674530 (CONFIRM)
59082 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
66914 (BID)
59438 (SECUNIA)
59733 (SECUNIA)
59022 (SECUNIA)
59722 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21674539 (CONFIRM)
59023 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676703 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21675945 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21673836 (CONFIRM)
59675 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21678113 (CONFIRM)
60003 (SECUNIA)
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132 (CONFIRM)
60498 (SECUNIA)
59653 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21681047 (CONFIRM)
60111 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21681018 (CONFIRM)
60117 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21679713 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21681256 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21677387 (CONFIRM)
GLSA-201406-32 (GENTOO)
http://www-01.ibm.com/support/docview.wss?uid=swg21680387 (CONFIRM)
61050 (SECUNIA)
GLSA-201502-12 (GENTOO)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 (CONFIRM)
SSRT101668 (HP)
SSRT101667 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21683484 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21680750 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21679610 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21677294 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676672 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676373 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676190 (CONFIRM)
61264 (SECUNIA)
60580 (SECUNIA)
60574 (SECUNIA)
59436 (SECUNIA)
59324 (SECUNIA)
59307 (SECUNIA)
59194 (SECUNIA)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0456
CVE: CVE-2014-0456
Id:
CVE-2014-0456
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0456
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 (CONFIRM)
SSRT101668 (HP)
SSRT101667 (HP)
66877 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0457
CVE: CVE-2014-0457
Id:
CVE-2014-0457
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0457
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
58974 (SECUNIA)
https://www.ibm.com/support/docview.wss?uid=swg21675973 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
66866 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0458
CVE: CVE-2014-0458
Id:
CVE-2014-0458
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0458
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66883 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0460
CVE: CVE-2014-0460
Id:
CVE-2014-0460
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0460
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI.
CVSSv2 Score:
5.8
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
59255 (SECUNIA)
http://www.ibm.com/support/docview.wss?uid=swg21675343 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21675588 (CONFIRM)
59250 (SECUNIA)
59071 (SECUNIA)
59082 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59704 (SECUNIA)
59022 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676315 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21674539 (CONFIRM)
59023 (SECUNIA)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21673836 (CONFIRM)
60003 (SECUNIA)
60111 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21681018 (CONFIRM)
60117 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21679713 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21681256 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21677387 (CONFIRM)
GLSA-201406-32 (GENTOO)
59642 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686717 (CONFIRM)
GLSA-201502-12 (GENTOO)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 (CONFIRM)
SSRT101668 (HP)
SSRT101667 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21683484 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21677294 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21676672 (CONFIRM)
66916 (BID)
61264 (SECUNIA)
59706 (SECUNIA)
59705 (SECUNIA)
59516 (SECUNIA)
59436 (SECUNIA)
59307 (SECUNIA)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-0461
CVE: CVE-2014-0461
Id:
CVE-2014-0461
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0461
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
58974 (SECUNIA)
https://www.ibm.com/support/docview.wss?uid=swg21675973 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66902 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-1876
CVE: CVE-2014-1876
Id:
CVE-2014-1876
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1876
Comment
: The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
CVSSv2 Score:
4.4
Access vector:
LOCAL
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE:
59 (Improper Link Resolution Before File Access ('Link Following'))
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1060907 (MISC)
[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) (MLIST)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562 (MISC)
102808 (OSVDB)
[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) (MLIST)
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
65568 (BID)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21679713 (CONFIRM)
GLSA-201406-32 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2397
CVE: CVE-2014-2397
Id:
CVE-2014-2397
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2397
Comment
: Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101667 (HP)
66893 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2398
CVE: CVE-2014-2398
Id:
CVE-2014-2398
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2398
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.
CVSSv2 Score:
3.5
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
SINGLE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:M/Au:S/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
66920 (BID)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2403
CVE: CVE-2014-2403
Id:
CVE-2014-2403
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2403
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66918 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2412
CVE: CVE-2014-2412
Id:
CVE-2014-2412
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2412
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
66873 (BID)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2414
CVE: CVE-2014-2414
Id:
CVE-2014-2414
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2414
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
66894 (BID)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2421
CVE: CVE-2014-2421
Id:
CVE-2014-2421
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2421
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVSSv2 Score:
10
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
66881 (BID)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
59058 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2423
CVE: CVE-2014-2423
Id:
CVE-2014-2423
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2423
Comment
: Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
66887 (BID)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-2427
CVE: CVE-2014-2427
Id:
CVE-2014-2427
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2427
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.
CVSSv2 Score:
7.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html (CONFIRM)
DSA-2912 (DEBIAN)
USN-2191-1 (UBUNTU)
58415 (SECUNIA)
USN-2187-1 (UBUNTU)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080 (CONFIRM)
GLSA-201406-32 (GENTOO)
GLSA-201502-12 (GENTOO)
SSRT101668 (HP)
SSRT101667 (HP)
66909 (BID)
RHSA-2014:0685 (REDHAT)
RHSA-2014:0675 (REDHAT)
RHSA-2014:0414 (REDHAT)
RHSA-2014:0413 (REDHAT)
CVE: CVE-2014-4252
CVE: CVE-2014-4252
Id:
CVE-2014-4252
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68642 (BID)
60245 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61577 (SECUNIA)
61640 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144252(94600) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4262
CVE: CVE-2014-4262
Id:
CVE-2014-4262
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSSv2 Score:
9.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
COMPLETE
Integrity impact:
COMPLETE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68599 (BID)
60245 (SECUNIA)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61577 (SECUNIA)
61640 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144262(94595) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4263
CVE: CVE-2014-4263
Id:
CVE-2014-4263
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
Comment
: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement."
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
HIGH
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:H/Au:N/C:P/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68636 (BID)
59503 (SECUNIA)
60245 (SECUNIA)
https://kc.mcafee.com/corporate/index?page=content&id=SB10083 (CONFIRM)
60831 (SECUNIA)
60326 (SECUNIA)
60890 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21681966 (CONFIRM)
61215 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685178 (CONFIRM)
61469 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686142 (CONFIRM)
61293 (SECUNIA)
61846 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21683429 (CONFIRM)
61278 (SECUNIA)
61294 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685242 (CONFIRM)
58830 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21685122 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21685121 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21683438 (CONFIRM)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61640 (SECUNIA)
61577 (SECUNIA)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
http://www-01.ibm.com/support/docview.wss?uid=swg21688893 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21689593 (CONFIRM)
62319 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21691089 (CONFIRM)
60180 (SECUNIA)
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096529 (CONFIRM)
60846 (SECUNIA)
62314 (SECUNIA)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
SUSE-SU-2015:0392 (SUSE)
SUSE-SU-2015:0376 (SUSE)
RHSA-2015:0264 (REDHAT)
HPSBUX03092 (HP)
HPSBUX03091 (HP)
https://www.ibm.com/support/docview.wss?uid=swg21680418 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21683484 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21683338 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21681379 (CONFIRM)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
http://www.ibm.com/support/docview.wss?uid=swg21683518 (CONFIRM)
http://www.ibm.com/support/docview.wss?uid=swg21681644 (CONFIRM)
61264 (SECUNIA)
61254 (SECUNIA)
60839 (SECUNIA)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60497 (SECUNIA)
60485 (SECUNIA)
60335 (SECUNIA)
60129 (SECUNIA)
60032 (SECUNIA)
60031 (SECUNIA)
60002 (SECUNIA)
59987 (SECUNIA)
59986 (SECUNIA)
59985 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
59404 (SECUNIA)
oracle-cpujul2014-cve20144263(94606) (XF)
RHSA-2014:0908 (REDHAT)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
CVE: CVE-2014-4266
CVE: CVE-2014-4266
Id:
CVE-2014-4266
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
Comment
: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (CONFIRM)
68596 (BID)
DSA-2980 (DEBIAN)
DSA-2987 (DEBIAN)
61577 (SECUNIA)
61640 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686824 (CONFIRM)
60081 (SECUNIA)
http://www-01.ibm.com/support/docview.wss?uid=swg21686383 (CONFIRM)
60317 (SECUNIA)
http://www.vmware.com/security/advisories/VMSA-2014-0012.html (CONFIRM)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (FULLDISC)
GLSA-201502-12 (GENTOO)
SUSE-SU-2015:0344 (SUSE)
HPSBUX03091 (HP)
http://www-01.ibm.com/support/docview.wss?uid=swg21680334 (CONFIRM)
1030577 (SECTRACK)
60817 (SECUNIA)
60812 (SECUNIA)
60622 (SECUNIA)
60485 (SECUNIA)
60129 (SECUNIA)
59987 (SECUNIA)
59924 (SECUNIA)
59680 (SECUNIA)
oracle-cpujul2014-cve20144266(94601) (XF)
RHSA-2014:0902 (REDHAT)
20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (BUGTRAQ)
Content available only for registered users!
ovaldb@altx-soft.com