CVE-2015-8126

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

CVSS 2.0 · 7.5 High EPSS 10.3% KEV · Not listed

Vendors

Apple Canonical Debian and 6 more

Products

Mac Os X Ubuntu Linux Debian Linux and 21 more

CVE-2015-7575

TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

CVSS 3.0 · 5.9 Medium EPSS 2.9% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Network Security Services and 6 more

CVE-2015-4911

OpenJDK: incomplete supportDTD enforcement (JAXP, 8130078)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 2 more

CVE-2015-4903

OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4893

OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-4883

OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4882

OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4881

OpenJDK: missing type checks in IIOPInputStream (CORBA, 8076392)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2015-4872

OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-4860

OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4844

ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4843

OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 8.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4842

OpenJDK: leak of user.dir location (JAXP, 8078427)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

CVSS 2.0 · 5.0 Medium EPSS 4.1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4840

OpenJDK: OOB access in CMS code (2D, 8086092)

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4835

OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4806

OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVSS 2.0 · 6.4 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4805

OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4803

OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-4760

ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4748

OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

CVSS 2.0 · 7.6 High EPSS 44.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more