CVE-2015-4748 — Improper Check for Certificate Revocation in Oracle JDK

CWE-299 — Improper Check for Certificate Revocation11 documents8 sources

Severity

7.6HIGHNVD

OSV9.8

EPSS

7.3%

top 8.34%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oracle JDK Oracle JRE Oracle Jrockit

Timeline

PublishedJul 16

Latest updateMay 13

Description

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

CVSS vector

AV:N/AC:H/C:C/I:C/A:CExploitability: 4.9 | Impact: 10.0

Affected Packages3 packages

▶NVDoracle/jrockitr28.3.6

▶NVDoracle/jdk1.6.0, 1.7.0, 1.8.0+2

▶NVDoracle/jre1.6.0, 1.7.0, 1.8.0+2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-fvmj-2grm-x9mr: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28↗2022-05-13

▶

OSV

openjdk-7 vulnerabilities↗2015-07-30

▶

CVEList

CVE-2015-4748: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28↗2015-07-16

▶

OSV

CVE-2015-4748: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28↗2015-07-16

▶

📋Vendor Advisories

Ubuntu

OpenJDK 6 vulnerabilities↗2015-08-06

▶

Ubuntu

OpenJDK 7 vulnerabilities↗2015-07-30

▶

Ubuntu

OpenJDK 7 vulnerabilities↗2015-07-30

▶

Red Hat

OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374)↗2015-07-14

▶

Debian

CVE-2015-4748: openjdk-8 - Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3....↗2015

▶

💬Community

Bugzilla

CVE-2015-4748 OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374)↗2015-07-12

▶