ID CVE-2015-0412
Summary Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. As per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
References
Vulnerable Configurations
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*
    cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*
    cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.6.0:update_85:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.6.0:update_85:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update_72:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update_72:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.8.0:update_25:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.8.0:update_25:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.6.0:update_85:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.6.0:update_85:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update_72:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update_72:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.8.0:update_25:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.8.0:update_25:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 22-04-2019 - 17:48)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
redhat via4
advisories
  • bugzilla
    id 1183715
    title CVE-2014-6587 OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264)
    oval
    OR
    • AND
      • OR
        • comment Red Hat Enterprise Linux 7 Client is installed
          oval oval:com.redhat.rhba:tst:20150364001
        • comment Red Hat Enterprise Linux 7 Server is installed
          oval oval:com.redhat.rhba:tst:20150364002
        • comment Red Hat Enterprise Linux 7 Workstation is installed
          oval oval:com.redhat.rhba:tst:20150364003
        • comment Red Hat Enterprise Linux 7 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20150364004
      • OR
        • AND
          • comment java-1.7.0-openjdk is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067005
          • comment java-1.7.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009006
        • AND
          • comment java-1.7.0-openjdk-accessibility is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067007
          • comment java-1.7.0-openjdk-accessibility is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20140675018
        • AND
          • comment java-1.7.0-openjdk-demo is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067015
          • comment java-1.7.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009010
        • AND
          • comment java-1.7.0-openjdk-devel is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067011
          • comment java-1.7.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009008
        • AND
          • comment java-1.7.0-openjdk-headless is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067013
          • comment java-1.7.0-openjdk-headless is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20140675012
        • AND
          • comment java-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067017
          • comment java-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009012
        • AND
          • comment java-1.7.0-openjdk-src is earlier than 1:1.7.0.75-2.5.4.2.el7_0
            oval oval:com.redhat.rhsa:tst:20150067009
          • comment java-1.7.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009014
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhba:tst:20111656001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhba:tst:20111656002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhba:tst:20111656003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20111656004
      • OR
        • AND
          • comment java-1.7.0-openjdk is earlier than 1:1.7.0.75-2.5.4.0.el6_6
            oval oval:com.redhat.rhsa:tst:20150067023
          • comment java-1.7.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009006
        • AND
          • comment java-1.7.0-openjdk-demo is earlier than 1:1.7.0.75-2.5.4.0.el6_6
            oval oval:com.redhat.rhsa:tst:20150067024
          • comment java-1.7.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009010
        • AND
          • comment java-1.7.0-openjdk-devel is earlier than 1:1.7.0.75-2.5.4.0.el6_6
            oval oval:com.redhat.rhsa:tst:20150067027
          • comment java-1.7.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009008
        • AND
          • comment java-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.75-2.5.4.0.el6_6
            oval oval:com.redhat.rhsa:tst:20150067026
          • comment java-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009012
        • AND
          • comment java-1.7.0-openjdk-src is earlier than 1:1.7.0.75-2.5.4.0.el6_6
            oval oval:com.redhat.rhsa:tst:20150067025
          • comment java-1.7.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20121009014
    rhsa
    id RHSA-2015:0067
    released 2015-01-21
    severity Critical
    title RHSA-2015:0067: java-1.7.0-openjdk security update (Critical)
  • bugzilla
    id 1183715
    title CVE-2014-6587 OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264)
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment java-1.7.0-openjdk is earlier than 1:1.7.0.75-2.5.4.0.el5_11
          oval oval:com.redhat.rhsa:tst:20150068002
        • comment java-1.7.0-openjdk is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165017
      • AND
        • comment java-1.7.0-openjdk-demo is earlier than 1:1.7.0.75-2.5.4.0.el5_11
          oval oval:com.redhat.rhsa:tst:20150068010
        • comment java-1.7.0-openjdk-demo is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165025
      • AND
        • comment java-1.7.0-openjdk-devel is earlier than 1:1.7.0.75-2.5.4.0.el5_11
          oval oval:com.redhat.rhsa:tst:20150068006
        • comment java-1.7.0-openjdk-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165023
      • AND
        • comment java-1.7.0-openjdk-javadoc is earlier than 1:1.7.0.75-2.5.4.0.el5_11
          oval oval:com.redhat.rhsa:tst:20150068004
        • comment java-1.7.0-openjdk-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165021
      • AND
        • comment java-1.7.0-openjdk-src is earlier than 1:1.7.0.75-2.5.4.0.el5_11
          oval oval:com.redhat.rhsa:tst:20150068008
        • comment java-1.7.0-openjdk-src is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130165019
    rhsa
    id RHSA-2015:0068
    released 2015-01-20
    severity Important
    title RHSA-2015:0068: java-1.7.0-openjdk security update (Important)
  • bugzilla
    id 1183715
    title CVE-2014-6587 OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.34-1.13.6.1.el5_11
            oval oval:com.redhat.rhsa:tst:20150085002
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377003
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.34-1.13.6.1.el5_11
            oval oval:com.redhat.rhsa:tst:20150085006
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377011
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.34-1.13.6.1.el5_11
            oval oval:com.redhat.rhsa:tst:20150085010
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377005
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.34-1.13.6.1.el5_11
            oval oval:com.redhat.rhsa:tst:20150085008
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377007
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.34-1.13.6.1.el5_11
            oval oval:com.redhat.rhsa:tst:20150085004
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20090377009
    • AND
      • OR
        • comment Red Hat Enterprise Linux 7 Client is installed
          oval oval:com.redhat.rhba:tst:20150364001
        • comment Red Hat Enterprise Linux 7 Server is installed
          oval oval:com.redhat.rhba:tst:20150364002
        • comment Red Hat Enterprise Linux 7 Workstation is installed
          oval oval:com.redhat.rhba:tst:20150364003
        • comment Red Hat Enterprise Linux 7 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20150364004
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.34-1.13.6.1.el7_0
            oval oval:com.redhat.rhsa:tst:20150085016
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865006
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.34-1.13.6.1.el7_0
            oval oval:com.redhat.rhsa:tst:20150085022
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865010
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.34-1.13.6.1.el7_0
            oval oval:com.redhat.rhsa:tst:20150085020
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865008
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.34-1.13.6.1.el7_0
            oval oval:com.redhat.rhsa:tst:20150085024
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865014
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.34-1.13.6.1.el7_0
            oval oval:com.redhat.rhsa:tst:20150085018
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865012
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhba:tst:20111656001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhba:tst:20111656002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhba:tst:20111656003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhba:tst:20111656004
      • OR
        • AND
          • comment java-1.6.0-openjdk is earlier than 1:1.6.0.34-1.13.6.1.el6_6
            oval oval:com.redhat.rhsa:tst:20150085030
          • comment java-1.6.0-openjdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865006
        • AND
          • comment java-1.6.0-openjdk-demo is earlier than 1:1.6.0.34-1.13.6.1.el6_6
            oval oval:com.redhat.rhsa:tst:20150085033
          • comment java-1.6.0-openjdk-demo is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865010
        • AND
          • comment java-1.6.0-openjdk-devel is earlier than 1:1.6.0.34-1.13.6.1.el6_6
            oval oval:com.redhat.rhsa:tst:20150085032
          • comment java-1.6.0-openjdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865008
        • AND
          • comment java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.34-1.13.6.1.el6_6
            oval oval:com.redhat.rhsa:tst:20150085034
          • comment java-1.6.0-openjdk-javadoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865014
        • AND
          • comment java-1.6.0-openjdk-src is earlier than 1:1.6.0.34-1.13.6.1.el6_6
            oval oval:com.redhat.rhsa:tst:20150085031
          • comment java-1.6.0-openjdk-src is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100865012
    rhsa
    id RHSA-2015:0085
    released 2015-01-26
    severity Important
    title RHSA-2015:0085: java-1.6.0-openjdk security update (Important)
  • rhsa
    id RHSA-2015:0079
  • rhsa
    id RHSA-2015:0080
  • rhsa
    id RHSA-2015:0086
  • rhsa
    id RHSA-2015:0264
rpms
  • java-1.7.0-openjdk-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-accessibility-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-demo-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-devel-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-headless-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-javadoc-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-src-1:1.7.0.75-2.5.4.2.el7_0
  • java-1.7.0-openjdk-1:1.7.0.75-2.5.4.0.el6_6
  • java-1.7.0-openjdk-demo-1:1.7.0.75-2.5.4.0.el6_6
  • java-1.7.0-openjdk-devel-1:1.7.0.75-2.5.4.0.el6_6
  • java-1.7.0-openjdk-javadoc-1:1.7.0.75-2.5.4.0.el6_6
  • java-1.7.0-openjdk-src-1:1.7.0.75-2.5.4.0.el6_6
  • java-1.7.0-openjdk-1:1.7.0.75-2.5.4.0.el5_11
  • java-1.7.0-openjdk-demo-1:1.7.0.75-2.5.4.0.el5_11
  • java-1.7.0-openjdk-devel-1:1.7.0.75-2.5.4.0.el5_11
  • java-1.7.0-openjdk-javadoc-1:1.7.0.75-2.5.4.0.el5_11
  • java-1.7.0-openjdk-src-1:1.7.0.75-2.5.4.0.el5_11
  • java-1.8.0-openjdk-1:1.8.0.31-1.b13.el6_6
  • java-1.8.0-openjdk-demo-1:1.8.0.31-1.b13.el6_6
  • java-1.8.0-openjdk-devel-1:1.8.0.31-1.b13.el6_6
  • java-1.8.0-openjdk-headless-1:1.8.0.31-1.b13.el6_6
  • java-1.8.0-openjdk-javadoc-1:1.8.0.31-1.b13.el6_6
  • java-1.8.0-openjdk-src-1:1.8.0.31-1.b13.el6_6
  • java-1.6.0-openjdk-1:1.6.0.34-1.13.6.1.el5_11
  • java-1.6.0-openjdk-demo-1:1.6.0.34-1.13.6.1.el5_11
  • java-1.6.0-openjdk-devel-1:1.6.0.34-1.13.6.1.el5_11
  • java-1.6.0-openjdk-javadoc-1:1.6.0.34-1.13.6.1.el5_11
  • java-1.6.0-openjdk-src-1:1.6.0.34-1.13.6.1.el5_11
  • java-1.6.0-openjdk-1:1.6.0.34-1.13.6.1.el7_0
  • java-1.6.0-openjdk-demo-1:1.6.0.34-1.13.6.1.el7_0
  • java-1.6.0-openjdk-devel-1:1.6.0.34-1.13.6.1.el7_0
  • java-1.6.0-openjdk-javadoc-1:1.6.0.34-1.13.6.1.el7_0
  • java-1.6.0-openjdk-src-1:1.6.0.34-1.13.6.1.el7_0
  • java-1.6.0-openjdk-1:1.6.0.34-1.13.6.1.el6_6
  • java-1.6.0-openjdk-demo-1:1.6.0.34-1.13.6.1.el6_6
  • java-1.6.0-openjdk-devel-1:1.6.0.34-1.13.6.1.el6_6
  • java-1.6.0-openjdk-javadoc-1:1.6.0.34-1.13.6.1.el6_6
  • java-1.6.0-openjdk-src-1:1.6.0.34-1.13.6.1.el6_6
refmap via4
bid 72136
confirm
debian
  • DSA-3144
  • DSA-3147
gentoo
  • GLSA-201507-14
  • GLSA-201603-14
hp
  • HPSBUX03273
  • HPSBUX03281
  • SSRT101951
  • SSRT101968
sectrack 1031580
suse
  • SUSE-SU-2015:0336
  • SUSE-SU-2015:0503
  • openSUSE-SU-2015:0190
ubuntu
  • USN-2486-1
  • USN-2487-1
xf oracle-cpujan2015-cve20150412(100140)
Last major update 22-04-2019 - 17:48
Published 21-01-2015 - 19:59
Back to Top