CVE-2016-0475
published 2016-01-21CVE-2016-0475: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows…
PriorityP431medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
3.66%
88.4th percentile
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-8 | < openjdk-8 8u72-b15-1 (sid) | openjdk-8 8u72-b15-1 (sid) |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jrockit | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
vendor_debian5.8MEDIUM
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cjg9-h8wq-j253: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28
ghsa_unreviewed·2022-05-13
CVE-2016-0475 [MEDIUM] GHSA-cjg9-h8wq-j253: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
OSV
CVE-2016-0475: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28
osv·2016-01-21·CVSS 5.8
CVE-2016-0475 [MEDIUM] CVE-2016-0475: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Red Hat
OpenJDK: PBE incorrect key lengths (Libraries, 8138589)
vendor_redhat·2016-01-19·CVSS 5.8
CVE-2016-0475 [MEDIUM] OpenJDK: PBE incorrect key lengths (Libraries, 8138589)
OpenJDK: PBE incorrect key lengths (Libraries, 8138589)
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
It was discovered that the password-based encryption (PBE) implementation in the Libraries component in OpenJDK used an incorrect key length. This could, in certain cases, lead to generation of keys that were weaker than expected.
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.7.0-openjdk (Red Hat Enterprise Linux 5) - Not affected
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 6) - Not affected
Package: java-1.7.0-openjdk (Red Ha
Debian
CVE-2016-0475: openjdk-8 - Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit componen...
vendor_debian·2016·CVSS 5.8
CVE-2016-0475 [MEDIUM] CVE-2016-0475: openjdk-8 - Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit componen...
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Scope: local
sid: resolved (fixed in 8u72-b15-1)
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0049.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0050.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0055.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securitytracker.com/id/1034715https://kc.mcafee.com/corporate/index?page=content&id=SB10148https://security.gentoo.org/glsa/201610-08http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0049.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0050.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0055.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securitytracker.com/id/1034715https://kc.mcafee.com/corporate/index?page=content&id=SB10148https://security.gentoo.org/glsa/201610-08
2016-01-21
Published