CVE-2015-4760
published 2015-07-16CVE-2015-4760: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown…
PriorityP353critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
7.03%
93.5th percentile
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | icu | < icu 52.1-10 (bookworm) | icu 52.1-10 (bookworm) |
| debian | openjdk-8 | < icu 52.1-10 (bookworm) | icu 52.1-10 (bookworm) |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r4j6-f9x3-8g4r: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via un
ghsa_unreviewed·2022-05-13
CVE-2015-4760 [HIGH] GHSA-r4j6-f9x3-8g4r: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via un
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
OSV
icu vulnerabilities
osv·2015-09-16·CVSS 6.8
CVE-2015-1270 [MEDIUM] icu vulnerabilities
icu vulnerabilities
Atte Kettunen discovered that ICU incorrectly handled certain converter
names. If an application using ICU processed crafted data, a remote
attacker could possibly cause it to crash. (CVE-2015-1270)
It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2015-2632, CVE-2015-4760)
OSV
openjdk-7 vulnerabilities
osv·2015-07-30·CVSS 9.8
CVE-2015-2590 [CRITICAL] openjdk-7 vulnerabilities
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service or expose sensitive
data over the network. (CVE-2015-2590, CVE-2015-2628, CVE-2015-4731,
CVE-2015-4732, CVE-2015-4733, CVE-2015-4760, CVE-2015-4748)
Several vulnerabilities were discovered in the cryptographic components
of the OpenJDK JRE. An attacker could exploit these to expose sensitive
data over the network. (CVE-2015-2601, CVE-2015-2808, CVE-2015-4000,
CVE-2015-2625, CVE-2015-2613)
As a security improvement, this update modifies OpenJDK behavior to
disable RC4 TLS/SSL cipher suites by default.
As a security improvement, this update modifies OpenJDK behavior to
reject
OSV
CVE-2015-4760: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via un
osv·2015-07-16·CVSS 10.0
CVE-2015-4760 [CRITICAL] CVE-2015-4760: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via un
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Ubuntu
ICU vulnerabilities
vendor_ubuntu·2015-09-16·CVSS 6.8
CVE-2015-1270 [MEDIUM] ICU vulnerabilities
Title: ICU vulnerabilities
Summary: Several security issues were fixed in ICU.
Atte Kettunen discovered that ICU incorrectly handled certain converter
names. If an application using ICU processed crafted data, a remote
attacker could possibly cause it to crash. (CVE-2015-1270)
It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2015-2632, CVE-2015-4760)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2015-08-06·CVSS 9.8
CVE-2015-2590 [CRITICAL] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 6.
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service or expose sensitive
data over the network. (CVE-2015-2590, CVE-2015-2628, CVE-2015-4731,
CVE-2015-4732, CVE-2015-4733, CVE-2015-4760, CVE-2015-4748)
Several vulnerabilities were discovered in the cryptographic components
of the OpenJDK JRE. An attacker could exploit these to expose sensitive
data over the network. (CVE-2015-2601, CVE-2015-2808, CVE-2015-4000,
CVE-2015-2625, CVE-2015-2613)
As a security improvement, this update modifies OpenJDK behavior to
disable RC4 TLS/SSL cipher suites by default.
As a secu
Ubuntu
OpenJDK 7 vulnerabilities
vendor_ubuntu·2015-07-30·CVSS 9.8
CVE-2015-2808 [CRITICAL] OpenJDK 7 vulnerabilities
Title: OpenJDK 7 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 7.
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service or expose sensitive
data over the network. (CVE-2015-2590, CVE-2015-2628, CVE-2015-4731,
CVE-2015-4732, CVE-2015-4733, CVE-2015-4760, CVE-2015-4748)
Several vulnerabilities were discovered in the cryptographic components
of the OpenJDK JRE. An attacker could exploit these to expose sensitive
data over the network. (CVE-2015-2601, CVE-2015-2808, CVE-2015-4000,
CVE-2015-2625, CVE-2015-2613)
As a security improvement, this update modifies OpenJDK behavior to
disable RC4 TLS/SSL cipher suites by default.
As a secu
Ubuntu
OpenJDK 7 vulnerabilities
vendor_ubuntu·2015-07-30·CVSS 9.8
CVE-2015-2613 [CRITICAL] OpenJDK 7 vulnerabilities
Title: OpenJDK 7 vulnerabilities
Summary: openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service or expose sensitive
data over the network. (CVE-2015-2590, CVE-2015-2628, CVE-2015-4731,
CVE-2015-4732, CVE-2015-4733, CVE-2015-4760, CVE-2015-4748)
Several vulnerabilities were discovered in the cryptographic components
of the OpenJDK JRE. An attacker could exploit these to expose sensitive
data over the network. (CVE-2015-2601, CVE-2015-2808, CVE-2015-4000,
CVE-2015-2625, CVE-2015-2613)
As a security improvement, this update modifies OpenJDK behavior to
disable RC4 TLS/SSL cipher suites by default.
As a security improvement, this
Red Hat
ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715)
vendor_redhat·2015-07-14·CVSS 10.0
CVE-2015-4760 [CRITICAL] CWE-787 ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715)
ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715)
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Package: icu (Red Hat Enterprise Linux 5) - Will not fix
Package: icu (Red Hat Enterprise Linux 6) - Will not fix
Package: icu (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2015-4760: icu - Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote a...
vendor_debian·2015·CVSS 10.0
CVE-2015-4760 [CRITICAL] CVE-2015-4760: icu - Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote a...
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Scope: local
bookworm: resolved (fixed in 52.1-10)
bullseye: resolved (fixed in 52.1-10)
forky: resolved (fixed in 52.1-10)
sid: resolved (fixed in 52.1-10)
trixie: resolved (fixed in 52.1-10)
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1228.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1229.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1230.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1241.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1242.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1243.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1485.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1486.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1488.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1526.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1544.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1604.htmlhttp://www.debian.org/security/2015/dsa-3316http://www.debian.org/security/2015/dsa-3323http://www.debian.org/security/2015/dsa-3339http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.securityfocus.com/bid/75784http://www.securitytracker.com/id/1032910http://www.ubuntu.com/usn/USN-2696-1http://www.ubuntu.com/usn/USN-2706-1http://www.ubuntu.com/usn/USN-2740-1https://security.gentoo.org/glsa/201603-11https://security.gentoo.org/glsa/201603-14http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1228.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1229.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1230.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1241.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1242.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1243.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1485.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1486.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1488.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1526.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1544.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1604.htmlhttp://www.debian.org/security/2015/dsa-3316http://www.debian.org/security/2015/dsa-3323http://www.debian.org/security/2015/dsa-3339http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.securityfocus.com/bid/75784http://www.securitytracker.com/id/1032910http://www.ubuntu.com/usn/USN-2696-1http://www.ubuntu.com/usn/USN-2706-1http://www.ubuntu.com/usn/USN-2740-1https://security.gentoo.org/glsa/201603-11https://security.gentoo.org/glsa/201603-14
2015-07-16
Published