| Description: | Summary:
Oracle Java SE JRE is prone to multiple unspecified vulnerabilities.
Vulnerability Insight:
Multiple unspecified flaws exist:
- An error in the JMX subcomponent related to
share/classes/com/sun/jmx/remote/security/SubjectDelegator.java
- An error related to the Hotspot subcomponent in
share/vm/classfile/classFileParser.hpp
- An error in the Libraries subcomponent related to
share/classes/java/lang/reflect/Proxy.java and handling of interfaces passed to
proxy methods.
- An error within the Swing subcomponent related to missing access restrictions
imposed by the file choosers.
- An error in the Security subcomponent related to
share/classes/java/security/Provider.java and instantiation of security services
with non-public constructors.
- An error in the Diffie-Hellman key agreement within the Security subcomponent
related to 'validateDHPublicKey' function in
share/classes/sun/security/util/KeyUtil.java
- An error in Libraries subcomponent within 'AtomicReferenceFieldUpdaterImpl'
function in /java/util/concurrent/atomic/AtomicReferenceFieldUpdater.java
- An error in the Security subcomponent related to
share/classes/sun/security/rsa/RSACore.java and RSA 'blinding'.
Vulnerability Impact:
Successful exploitation will allow remote attackers to update,
insert, or delete certain data, execute arbitrary code, conduct a denial of
service and disclosure of potentially sensitive information.
Affected Software/OS:
Oracle Java SE 5 update 65 and prior, 6 update 75 and prior, 7 update 60 and
prior, and 8 update 5 and prior on Windows.
Solution:
Apply the patch from the referenced advisory.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
