RHSA-2016:1430: java-1.7.0-ibm and java-1.7.1-ibm security update

TI-2016-02888 CVE-2016-3427 · GHSA-php4-mj74-f79r

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77…

CRITICAL 100KEV

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.92334 Published 2016-04-21 Fixed CWE-284

TI-2015-04118 CVE-2015-4902 · GHSA-69xw-2hhx-gvfg

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers…

HIGH 81KEV

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.13603 Published 2015-10-21 Fixed CWE-284

TI-2016-00436 CVE-2016-0483 · GHSA-7xjq-3wg8-c44c

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65…

MEDIUM 64

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.14714 Published 2016-01-21 Fixed

TI-2015-04063 CVE-2015-4843 · GHSA-5hrw-33cx-6w79

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 60

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.08934 Published 2015-10-21 Fixed

TI-2016-00447 CVE-2016-0494 · GHSA-2rw6-f687-5qwg

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java…

MEDIUM 59

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability vi…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07211 Published 2016-01-21 Fixed

TI-2015-04064 CVE-2015-4844 · GHSA-2rrf-qm4c-8229

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 59

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07514 Published 2015-10-21 Partial fix

TI-2015-04055 CVE-2015-4835 · GHSA-hw42-jfwx-84h9

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 58

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulne…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06416 Published 2015-10-21 Partial fix

TI-2015-04101 CVE-2015-4883 · GHSA-vw5f-vf9g-7xvr

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnera…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2015-04078 CVE-2015-4860 · GHSA-x59v-wff7-pprc

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnera…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2015-04027 CVE-2015-4805 · GHSA-cq64-ppmj-mrvv

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 57

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05611 Published 2015-10-21 Fixed

TI-2016-02903 CVE-2016-3443 · GHSA-wf68-w3c3-xjhm

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers…

MEDIUM 51

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.05479 Published 2016-04-21 Fixed

TI-2016-00616 CVE-2016-0687 · GHSA-xvgm-5834-vp34

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded…

MEDIUM 50

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.0472 Published 2016-04-21 Fixed

TI-2016-00615 CVE-2016-0686 · GHSA-99gg-jjjf-pjc8

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded…

MEDIUM 50

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.0472 Published 2016-04-21 Fixed

TI-2015-07025 CVE-2015-8540 · GHSA-7qhq-6293-wrx3

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through…

MEDIUM 47

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote atta…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.06484 Published 2016-04-14 Partial fix CWE-189

TI-2015-04228 CVE-2015-5041 · GHSA-7v4m-8wwx-8xgc

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20…

MEDIUM 46

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.03901 Published 2016-06-06 Fixed CWE-200

TI-2016-02909 CVE-2016-3449 · GHSA-v7xg-gp2r-hx5f

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers…

MEDIUM 45

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.

CVSS 3.0HIGH 8.3 Network No auth User interaction EPSS 0.04009 Published 2016-04-21 Fixed

TI-2015-06751 CVE-2015-8126 · GHSA-rr6q-q2jh-948f

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in…

MEDIUM 45

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow r…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.10339 Published 2015-11-13 Partial fix CWE-120

TI-2016-00334 CVE-2016-0376 · GHSA-j9hc-g284-326f

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6…

MEDIUM 44

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 be…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.05695 Published 2016-06-03 Fixed

TI-2016-00322 CVE-2016-0363 · GHSA-p824-48mj-5qcc

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before…

MEDIUM 42

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.03983 Published 2016-06-03 Fixed CWE-20

TI-2015-04028 CVE-2015-4806 · GHSA-wp67-hpr4-56mq

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

MEDIUM 42

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03412 Published 2015-10-21 Fixed

TI-2015-06985 CVE-2015-8472 · GHSA-h5hh-r95x-mmfq

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x…

MEDIUM 41

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of s…

CVSS 3.0HIGH 7.3 Network No auth No interaction EPSS 0.06054 Published 2016-01-21 Partial fix CWE-119

TI-2016-00419 CVE-2016-0466 · GHSA-v75m-88cc-6483

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in…

LOW 37

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via ve…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05453 Published 2016-01-21 Fixed

TI-2016-00356 CVE-2016-0402 · GHSA-hfgr-56jc-3hcm

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java…

LOW 36

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networ…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04644 Published 2016-01-21 Fixed

TI-2015-04110 CVE-2015-4893 · GHSA-g9px-7f52-qj47

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04637 Published 2015-10-21 Partial fix

TI-2015-04062 CVE-2015-4842 · GHSA-phv4-p2cw-7frr

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04082 Published 2015-10-21 Partial fix

TI-2015-04025 CVE-2015-4803 · GHSA-8p8r-6fqw-9vx7

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04637 Published 2015-10-21 Partial fix

TI-2015-03956 CVE-2015-4734 · GHSA-w858-6895-v667

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded…

LOW 36

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04116 Published 2015-10-21 Partial fix

TI-2015-04119 CVE-2015-4903 · GHSA-wx9q-j373-mc8m

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03438 Published 2015-10-21 Fixed

TI-2015-04100 CVE-2015-4882 · GHSA-rpc4-6m39-x2wh

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03875 Published 2015-10-21 Partial fix

TI-2015-04090 CVE-2015-4872 · GHSA-hvr5-v3pf-2jmv

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51…

LOW 35

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03218 Published 2015-10-21 Fixed

TI-2015-04060 CVE-2015-4840 · GHSA-24cm-p92g-3mhv

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51…

LOW 35

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03438 Published 2015-10-21 Partial fix

TI-2016-00232 CVE-2016-0264 · GHSA-3p6j-59jx-xr88

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6…

LOW 32

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8…

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.03925 Published 2016-05-24 Fixed CWE-119

TI-2015-06633 CVE-2015-7981 · GHSA-fr3h-2jww-582m

The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before…

LOW 32

The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06359 Published 2015-11-24 Partial fix CWE-200

TI-2015-06299 CVE-2015-7575 · GHSA-7x7m-5xcm-74v2

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before…

LOW 32

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Prot…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02904 Published 2016-01-09 Partial fix CWE-19

TI-2015-04089 CVE-2015-4871 · GHSA-gq58-crwm-qgwh

Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect…

LOW 32

Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.0304 Published 2015-10-21 Fixed

TI-2015-04032 CVE-2015-4810 · GHSA-f4x8-385p-3m28

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60 allows local users to affect…

LOW 31

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00412 Published 2015-10-21 Fixed

TI-2016-02883 CVE-2016-3422 · GHSA-c95q-vf7r-wm72

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers…

LOW 25

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect availability via vectors related to 2D.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.02802 Published 2016-04-21 Fixed

TI-2016-00401 CVE-2016-0448 · GHSA-4wfm-8gw8-6vq9

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java…

LOW 25

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.03531 Published 2016-01-21 Fixed

TI-2016-02887 CVE-2016-3426 · GHSA-3mj4-w4vq-39pp

Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote…

LOW 20

Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.

CVSS 3.0LOW 3.1 Network No auth User interaction EPSS 0.02795 Published 2016-04-21 Fixed

TI-2015-04203 CVE-2015-5006 · GHSA-rm84-76qf-3pxc

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1…

LOW 12

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3 FP20, 7 before SR9 FP20, 6 R1 before SR8 FP15, and 6 before SR16 FP15 allow physically proximate attackers to obtain sensitiv…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00482 Published 2015-12-07 Partial fix CWE-200

RHSA-2016:1430

Fixed in

Fixes 40 records