CVE-2015-8472

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.

CVSS 3.0 · 7.3 High EPSS 6.1% KEV · Not listed

Vendors

Apple Libpng Redhat

Products

Mac Os X Libpng Enterprise Linux and 3 more

CVE-2016-0636

OpenJDK: missing type safety checks for MethodHandle calls across class loaders, incorrect CVE-2013-5838 fix (Hotspot, 8151666)

Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.

CVSS 3.0 · 8.1 High EPSS 5.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 6 more

CVE-2016-0686

OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.

CVSS 3.0 · 9.6 Critical EPSS 4.7% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2016-0687

OpenJDK: insufficient byte type checks (Hotspot, 8132051)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

CVSS 3.0 · 9.6 Critical EPSS 4.7% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2016-0695

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 11 more

CVE-2016-3422

JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect availability via vectors related to 2D.

CVSS 3.0 · 4.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2016-3425

OpenJDK: incorrect handling of surrogate pairs in XML attribute values (JAXP, 8143167)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP.

CVSS 3.0 · 4.3 Medium EPSS 3.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 2 more

CVE-2016-3426

OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945)

Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 3.0 · 3.1 Low EPSS 2.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2016-3443

JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read.

CVSS 3.0 · 9.6 Critical EPSS 5.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2016-3449

JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.

CVSS 3.0 · 8.3 High EPSS 4.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2016-3458

OpenJDK: insufficient restrictions on the use of custom ValueHandler (CORBA, 8079718)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.

CVSS 3.0 · 4.3 Medium EPSS 3.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3498

JDK: unspecified vulnerability fixed in 7u111 and 8u101 (JavaFX)

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows remote attackers to affect availability via vectors related to JavaFX.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras Oracle Java

CVE-2016-3500

OpenJDK: maximum XML name limit not applied to namespace URIs (JAXP, 8148872)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 3 more

CVE-2016-3503

JDK: unspecified vulnerability fixed in 6u121, 7u111, and 8u101 (Install)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

CVSS 3.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras Oracle Java

CVE-2016-3508

OpenJDK: missing entity replacement limits (JAXP, 8149962)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 3 more

CVE-2016-3511

JDK: unspecified vulnerability fixed in 7u111 and 8u101 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.

CVSS 3.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2016-3550

OpenJDK: integer overflows in bytecode streams (Hotspot, 8152479)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.

CVSS 3.0 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3552

JDK: unspecified vulnerability fixed in 8u101 (Install)

Unspecified vulnerability in Oracle Java SE 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

CVSS 3.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras Oracle Java

CVE-2016-3587

OpenJDK: insufficient protection of MethodHandle.invokeBasic() (Hotspot, 8154475)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

CVSS 3.0 · 9.6 Critical EPSS 5.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 2 more

CVE-2016-3598

OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.

CVSS 3.0 · 9.6 Critical EPSS 6.7% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Linux and 4 more