CVE-2015-2628

CVE-2015-2628

High · published July 16, 2015

CVSS v2.0
10.0
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

⚠️ A mysterious vulnerability haunts Oracle Java SE, lurking in specific versions like a shadowy figure in a dark alley! 🌑 Imagine a high-stakes poker game where someone can peek at your hand without you knowing — that’s what this vulnerability allows! It creates an opportunity for remote attackers to manipulate the integrity and confidentiality of your Java applications, much like a sneaky card shark rigging the game. If exploited, this could lead to remote attackers gaining unauthorized access, potentially compromising sensitive data or causing disruptions to services. Think of it as an invisible hand stirring the pot, altering the game without anyone realizing it. While the impact isn’t categorically severe, it’s still a leaky canoe that could sink without repair!

Put simply

Imagine a high-stakes poker game where someone can peek at your hand without you knowing — that’s what this vulnerability allows! It creates an opportunity for remote attackers to manipulate the integrity and confidentiality of your Java applications, much like a sneaky card shark rigging the game. This unspecified vulnerability in Oracle Java SE versions 6u95, 7u80, and 8u45 involves the Common Object Request Broker Architecture (CORBA), which could be used to affect system confidentiality, integrity, and availability through targeted attacks.

What to do

If exploited, this could lead to remote attackers gaining unauthorized access, potentially compromising sensitive data or causing disruptions to services. Think of it as an invisible hand stirring the pot, altering the game without anyone realizing it. While the impact isn’t categorically severe, it’s still a leaky canoe that could sink without repair! To mitigate this vulnerability, it’s crucial to update to the latest versions of Java SE to ensure you're protected against any potential threats. Regularly monitor your systems for updates and consider implementing additional security measures to safeguard your applications. You've got this! Follow these steps and you'll be well on your way to fortifying your systems! 🛡️

The record
Technical detail
CVSS v2.0
10.0 · HIGH
Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v4.0
Not supplied
EPSS
0.06242 · 93.5th percentile
Published
2015-07-16T14:59Z
Affected products (10)
ProductVersionsFixed in
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
References (40)
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1228.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1229.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1230.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1241.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1242.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1243.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1526.html · [email protected]http://www.debian.org/security/2015/dsa-3316 · [email protected]http://www.debian.org/security/2015/dsa-3339 · [email protected]http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html · [email protected]http://www.securityfocus.com/bid/75796 · [email protected]http://www.securitytracker.com/id/1032910 · [email protected]http://www.ubuntu.com/usn/USN-2696-1 · [email protected]http://www.ubuntu.com/usn/USN-2706-1 · [email protected]https://security.gentoo.org/glsa/201603-11 · [email protected]https://security.gentoo.org/glsa/201603-14 · [email protected]http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1228.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1229.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1230.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1241.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1242.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1243.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1526.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3316 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3339 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/75796 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1032910 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2696-1 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2706-1 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201603-11 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201603-14 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 16 JUL 10:00Z
    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality…
    cvelistv5