Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, …
Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and 23. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
https://cwe.mitre.org/data/definitions/190.html →Open in CWE collection →The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
https://cwe.mitre.org/data/definitions/203.html →Open in CWE collection →This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
https://capec.mitre.org/data/definitions/92.html →Open in CAPEC collection →An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.
https://capec.mitre.org/data/definitions/189.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| Tracked | ||
| Tracked | ||
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-1.8.0-openjdk | Tracked | |
| java-11-openjdk | Tracked | |
| java-11-openjdk | Tracked | |
| java-11-openjdk | Tracked | |
| java-11-openjdk | Tracked | |
| java-11-openjdk | Tracked |