CVE-2015-4803

OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-4760

ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.0% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4748

OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

CVSS 2.0 · 7.6 High EPSS 44.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-4734

OpenJDK: kerberos realm name leak (JGSS, 8048030)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

CVSS 2.0 · 5.0 Medium EPSS 4.1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4732

OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.

CVSS 2.0 · 10.0 Critical EPSS 6.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-4731

OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-2664

JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 2 more

CVE-2015-2638

JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Javafx Jdk Jre and 3 more

CVE-2015-2637

JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Oracle Redhat

Products

Javafx Jdk Jre and 3 more

CVE-2015-2628

OpenJDK: IIOPInputStream type confusion vulnerability (CORBA, 8076376)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 1 more

CVE-2015-2627

JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Install)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.

CVSS 2.0 · 2.6 Low EPSS 2.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras Oracle Java

CVE-2015-2625

OpenJDK: name for reverse DNS lookup used in certificate identity check (JSSE, 8067694)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.

CVSS 2.0 · 2.6 Low EPSS 3.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-2621

OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2015-2601

OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 2.0 · 5.0 Medium EPSS 3.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 4 more

CVE-2015-0469

ICU: layout engine glyphStorage off-by-one (OpenJDK 2D, 8067699)

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Enterprise Linux and 3 more

CVE-2022-29824

libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Active Iq Unified Manager and 23 more

CVE-2022-27778

curl: removes wrong file on error

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed

Vendors

Haxx Netapp Oracle and 1 more

Products

Curl Active Iq Unified Manager Bh500s Firmware and 16 more

CVE-2022-25315

expat: Integer overflow in storeRawNames()

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed

Vendors

Debian Fedoraproject Libexpat Project and 3 more

Products

Debian Linux Fedora Libexpat and 9 more

CVE-2022-25314

expat: Integer overflow in copyString()

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

CVSS 3.1 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Debian Fedoraproject Libexpat Project and 3 more

Products

Debian Linux Fedora Libexpat and 5 more

CVE-2022-25313

expat: Stack exhaustion in doctype parsing

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

CVSS 3.1 · 6.5 Medium EPSS 3.3% KEV · Not listed

Vendors

Debian Fedoraproject Libexpat Project and 3 more

Products

Debian Linux Fedora Libexpat and 5 more