CVE-2014-0432

JDK: unspecified vulnerability fixed in 7u55 and 8u5 (Libraries)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras and 1 more

CVE-2016-1659

chromium-browser: various fixes from internal audits

Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Canonical Debian Google and 3 more

Products

Ubuntu Linux Debian Linux Chrome and 3 more

CVE-2016-4110

flash-plugin: multiple code execution issues fixed in APSB16-15

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

CVSS 3.0 · 7.5 High EPSS 8.4% KEV · Not listed

Vendors

Adobe Microsoft Redhat

Products

Flash Player Edge Internet Explorer and 1 more

CVE-2016-4114

flash-plugin: multiple code execution issues fixed in APSB16-15

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

CVSS 3.0 · 7.5 High EPSS 8.4% KEV · Not listed

Vendors

Adobe Microsoft Redhat

Products

Flash Player Edge Internet Explorer and 1 more

CVE-2014-0429

OpenJDK: Incorrect mlib/raster image validation (2D, 8027841)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.4% KEV · Not listed

Vendors

Canonical Debian Ibm and 4 more

Products

Ubuntu Linux Debian Linux Forms Viewer and 9 more

CVE-2016-1663

chromium-browser: use-after-free in blink's v8 bindings

The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.94, mishandles certain array-buffer data structures, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more

CVE-2016-3610

OpenJDK: insufficient value count check in MethodHandles.filterReturnValue() (Libraries, 8158571)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598.

CVSS 3.0 · 9.6 Critical EPSS 5.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3672

kernel: unlimiting the stack disables ASLR

The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits.

CVSS 3.0 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Canonical Linux Novell and 1 more

Products

Ubuntu Linux Linux Kernel Suse Linux Enterprise Desktop and 8 more

CVE-2016-3598

OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.

CVSS 3.0 · 9.6 Critical EPSS 6.7% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 4 more

CVE-2016-3606

OpenJDK: insufficient bytecode verification (Hotspot, 8155981)

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

CVSS 3.0 · 9.6 Critical EPSS 3.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3679

chromium-browser: multiple unspecified vulnerabilities

Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Canonical Google Opensuse and 1 more

Products

Ubuntu Linux Chrome V8 and 2 more

CVE-2016-3550

OpenJDK: integer overflows in bytecode streams (Hotspot, 8152479)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.

CVSS 3.0 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3552

JDK: unspecified vulnerability fixed in 8u101 (Install)

Unspecified vulnerability in Oracle Java SE 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

CVSS 3.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras Oracle Java

CVE-2016-3508

OpenJDK: missing entity replacement limits (JAXP, 8149962)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 3 more

CVE-2016-3511

JDK: unspecified vulnerability fixed in 7u111 and 8u101 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.

CVSS 3.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2016-3587

OpenJDK: insufficient protection of MethodHandle.invokeBasic() (Hotspot, 8154475)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

CVSS 3.0 · 9.6 Critical EPSS 5.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3697

docker: privilege escalation via confusion of usernames and UIDs

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Docker Linuxfoundation Opensuse and 1 more

Products

Docker Runc Opensuse and 1 more

CVE-2016-3458

OpenJDK: insufficient restrictions on the use of custom ValueHandler (CORBA, 8079718)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.

CVSS 3.0 · 4.3 Medium EPSS 3.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3498

JDK: unspecified vulnerability fixed in 7u111 and 8u101 (JavaFX)

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows remote attackers to affect availability via vectors related to JavaFX.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras Oracle Java

CVE-2016-3443

JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read.

CVSS 3.0 · 9.6 Critical EPSS 5.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more