| Description: | Summary:
Oracle Java SE JRE is prone to multiple unspecified vulnerabilities.
Vulnerability Insight:
Multiple flaws exist due to:
- An error in the Java Cryptography Extension (JCE) subcomponent's RSA signature
implementation.
- An error in the JSSE subcomponent that is triggered when checking X.509
certificate options.
- An error in the 'ReferenceProcessor::process_discovered_references' function
in share/vm/memory/referenceProcessor.cpp script.
- Two unspecified errors related to the 2D subcomponent.
- An error in the Beans subcomponent related to permissions and resource
loading.
- An off-by-one overflow condition in the functions
'LigatureSubstitutionProcessor::processStateEntry' and
'LigatureSubstitutionProcessor2::processStateEntry' within LigatureSubstProc.cpp
and LigatureSubstProc2.cpp scripts respectively.
- An unspecified error.
Vulnerability Impact:
Successful exploitation will allow attackers
to gain knowledge of potentially sensitive information, conduct
denial-of-service attacks, execute arbitrary code and other unspecified impact.
Affected Software/OS:
Oracle Java SE 5.0 update 81 and prior,
6 update 91 and prior, 7 update 76 and prior, and 8 update 40 and prior on
Linux.
Solution:
Apply the patch from the referenced advisory.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
