CVE-2015-2628 — Type Confusion in Oracle JDK

CWE-843 — Type Confusion CWE-287 — Improper Authentication13 documents8 sources

Severity

10.0CRITICALNVD

OSV9.8

EPSS

8.1%

top 7.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oracle JDK Oracle JRE

Timeline

PublishedJul 16

Latest updateMay 13

Description

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages2 packages

▶NVDoracle/jdk1.6.0, 1.7.0, 1.8.0+2

▶NVDoracle/jre1.6.0, 1.7.0, 1.8.0+2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-f6p6-pp87-87wp: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality↗2022-05-13

▶

OSV

openjdk-7 vulnerabilities↗2015-07-30

▶

CVEList

CVE-2015-2628: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality↗2015-07-16

▶

OSV

CVE-2015-2628: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality↗2015-07-16

▶

📋Vendor Advisories

Red Hat

curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)↗2017-03-29

▶

Ubuntu

OpenJDK 6 vulnerabilities↗2015-08-06

▶

Ubuntu

OpenJDK 7 vulnerabilities↗2015-07-30

▶

Ubuntu

OpenJDK 7 vulnerabilities↗2015-07-30

▶

Red Hat

OpenJDK: IIOPInputStream type confusion vulnerability (CORBA, 8076376)↗2015-07-14

▶

💬Community

Bugzilla

CVE-2017-2628 curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)↗2017-02-15

▶

Bugzilla

CVE-2015-2628 OpenJDK: IIOPInputStream type confusion vulnerability (CORBA, 8076376)↗2015-07-12

▶