CVE Vulnerability Advisory Database

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] Systems running Oracle Java SE 6u101, 7u85, 8u60, and prior versions utilizing the Deployment component

[Impact] Unauthenticated remote attackers can compromise system data integrity and cause unexpected application behavior via network vectors

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) to upgrade Java SE, and disable Java browser plugins and Web Start execution

[Affected Scope] Oracle Java SE 6u95, 7u80, 8u45, and Java SE Embedded 7u75, 8u33 and prior

[Impact] Remote attackers can completely bypass the Java security sandbox and execute arbitrary code with the privileges of the running process

[Mitigation] Apply the latest Oracle Java SE security updates, disable Java browser plugins, and restrict untrusted Java applet execution

[Affected Scope] Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update 45 and earlier, and OpenJDK 7.

[Impact] Remote attackers can completely bypass the Java security sandbox and execute arbitrary code on the host system via malicious 2D image rendering.

[Mitigation] Immediately upgrade to Java SE 7u25 or later, apply OpenJDK security patches, and disable Java browser plugins.

[Affected Scope] Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7

[Impact] Remote attackers can bypass permission checks via MethodHandles, modify arbitrary public final fields using reflection and type confusion, and disable the Security Manager to compromise system integrity

[Mitigation] Immediately upgrade to Oracle Java SE 7 Update 21 or apply the latest OpenJDK 7 patches

[Affected Scope] Oracle Java SE 7 through Update 11, and OpenJDK 7.

[Impact] Remote attackers can bypass the Java security sandbox and execute arbitrary code with elevated privileges.

[Mitigation] Apply the latest Java SE/OpenJDK security updates and disable Java browser plugins immediately.

[Affected Scope] Oracle Java SE 7 Update 7 and earlier versions of the JRE (Java Runtime Environment)

[Impact] Unauthenticated remote attackers can completely compromise system confidentiality, integrity, and availability, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to Java SE 7 Update 9 or later, and restrict JAX-WS class loading in legacy environments

[Affected Scope] Oracle Java SE 7 Update 6 and earlier JRE (Java Runtime Environment) versions

[Impact] Remote attackers can completely bypass SecurityManager restrictions and execute arbitrary code with elevated privileges via a crafted malicious applet

[Mitigation] Immediately upgrade to Java SE 7 Update 7 or later, or disable the Java browser plugin across all endpoints

[Affected Scope] Oracle Java SE 7 Update 4 and earlier, 6 Update 32 and earlier, 5.0 Update 35 and earlier, and SDK 1.4.2_37 and earlier

[Impact] Remote attackers can bypass the Java sandbox environment and execute arbitrary code with the privileges of the running user via malicious Java Applets

[Mitigation] Immediately upgrade to the latest secure Java SE release, disable Java browser plugins, and restrict access to legacy Java environments

[Affected Scope] Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier

[Impact] Remote attackers can completely bypass the JVM sandbox restrictions to execute arbitrary OS commands or cause a denial of service (JVM crash) via a specially crafted Java applet

[Mitigation] Immediately upgrade to patched Java versions (Java 7 Update 3, Java 6 Update 31 or higher) and disable Java browser plugins in legacy environments

[Affected Scope] Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier

[Impact] Remote untrusted Java Web Start applications and untrusted Java applets can bypass sandbox security boundaries to execute arbitrary code with full system privileges

[Mitigation] Immediately upgrade to a patched Java version, and disable Java browser plugins and Web Start execution across the enterprise

[Affected Scope] Oracle Java SE and Java for Business 6 Update 18 and earlier, 5.0 Update 23 and earlier, and 1.4.2_25 and earlier

[Impact] Remote attackers can completely bypass Java sandbox restrictions and execute arbitrary code with the privileges of the running process, compromising confidentiality, integrity, and availability

[Mitigation] Immediately upgrade to the latest patched Java SE versions, disable Java browser plugins, and decommission unsupported legacy JRE environments