rpm package
suse/java-1_7_1-ibm&distro=SUSE Linux Enterprise Software Development Kit 11 SP4
pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4
Vulnerabilities (166)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-1289 | Hig | 8.2 | < 1.7.1_sr4.5-25.1 | 1.7.1_sr4.5-25.1 | May 22, 2017 | IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150. | |
| CVE-2017-3544 | Low | 3.7 | < 1.7.1_sr4.5-25.1 | 1.7.1_sr4.5-25.1 | Apr 24, 2017 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthen | |
| CVE-2017-3539 | Low | 3.1 | < 1.7.1_sr4.5-25.1 | 1.7.1_sr4.5-25.1 | Apr 24, 2017 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network | |
| CVE-2017-3533 | Low | 3.7 | < 1.7.1_sr4.5-25.1 | 1.7.1_sr4.5-25.1 | Apr 24, 2017 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthen | |
| CVE-2017-3511 | Hig | 7.7 | < 1.7.1_sr4.5-25.1 | 1.7.1_sr4.5-25.1 | Apr 24, 2017 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attack | |
| CVE-2017-3509 | Med | 4.2 | < 1.7.1_sr4.5-25.1 | 1.7.1_sr4.5-25.1 | Apr 24, 2017 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with networ | |
| CVE-2016-10165 | Hig | 7.1 | < 1.7.1_sr4.15-26.8.1 | 1.7.1_sr4.15-26.8.1 | Feb 3, 2017 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read. | |
| CVE-2016-5597 | Med | 5.9 | < 1.7.1_sr3.60-19.2 | 1.7.1_sr3.60-19.2 | Oct 25, 2016 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking. | |
| CVE-2016-5573 | Hig | 8.3 | < 1.7.1_sr3.60-19.2 | 1.7.1_sr3.60-19.2 | Oct 25, 2016 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582. | |
| CVE-2016-5568 | Cri | 9.6 | < 1.7.1_sr3.60-19.2 | 1.7.1_sr3.60-19.2 | Oct 25, 2016 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. | |
| CVE-2016-5556 | Cri | 9.6 | < 1.7.1_sr3.60-19.2 | 1.7.1_sr3.60-19.2 | Oct 25, 2016 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. | |
| CVE-2016-5554 | Med | 4.3 | < 1.7.1_sr3.60-19.2 | 1.7.1_sr3.60-19.2 | Oct 25, 2016 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX. | |
| CVE-2016-5542 | Low | 3.1 | < 1.7.1_sr3.60-19.2 | 1.7.1_sr3.60-19.2 | Oct 25, 2016 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries. | |
| CVE-2016-2183 | Hig | 7.5 | < 1.7.1_sr4.1-22.1 | 1.7.1_sr4.1-22.1 | Sep 1, 2016 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-dura | |
| CVE-2016-3598 | Cri | 9.6 | < 1.7.1_sr3.50-16.1 | 1.7.1_sr3.50-16.1 | Jul 21, 2016 | Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610. | |
| CVE-2016-3511 | Hig | 7.7 | < 1.7.1_sr3.50-16.1 | 1.7.1_sr3.50-16.1 | Jul 21, 2016 | Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment. | |
| CVE-2016-3485 | Low | 2.9 | < 1.7.1_sr3.50-16.1 | 1.7.1_sr3.50-16.1 | Jul 21, 2016 | Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking. | |
| CVE-2015-5041 | Cri | 9.1 | < 1.7.1_sr3.30-9.1 | 1.7.1_sr3.30-9.1 | Jun 6, 2016 | The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods. | |
| CVE-2016-0376 | Hig | 8.1 | < 1.7.1_sr3.40-13.1 | 1.7.1_sr3.40-13.1 | Jun 3, 2016 | The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in | |
| CVE-2016-0363 | Hig | 8.1 | < 1.7.1_sr3.40-13.1 | 1.7.1_sr3.40-13.1 | Jun 3, 2016 | The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.refle |
- affected < 1.7.1_sr4.5-25.1fixed 1.7.1_sr4.5-25.1
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.
- affected < 1.7.1_sr4.5-25.1fixed 1.7.1_sr4.5-25.1
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthen
- affected < 1.7.1_sr4.5-25.1fixed 1.7.1_sr4.5-25.1
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network
- affected < 1.7.1_sr4.5-25.1fixed 1.7.1_sr4.5-25.1
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthen
- affected < 1.7.1_sr4.5-25.1fixed 1.7.1_sr4.5-25.1
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attack
- affected < 1.7.1_sr4.5-25.1fixed 1.7.1_sr4.5-25.1
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with networ
- affected < 1.7.1_sr4.15-26.8.1fixed 1.7.1_sr4.15-26.8.1
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
- affected < 1.7.1_sr3.60-19.2fixed 1.7.1_sr3.60-19.2
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking.
- affected < 1.7.1_sr3.60-19.2fixed 1.7.1_sr3.60-19.2
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582.
- affected < 1.7.1_sr3.60-19.2fixed 1.7.1_sr3.60-19.2
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.
- affected < 1.7.1_sr3.60-19.2fixed 1.7.1_sr3.60-19.2
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.
- affected < 1.7.1_sr3.60-19.2fixed 1.7.1_sr3.60-19.2
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX.
- affected < 1.7.1_sr3.60-19.2fixed 1.7.1_sr3.60-19.2
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.
- affected < 1.7.1_sr4.1-22.1fixed 1.7.1_sr4.1-22.1
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-dura
- affected < 1.7.1_sr3.50-16.1fixed 1.7.1_sr3.50-16.1
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.
- affected < 1.7.1_sr3.50-16.1fixed 1.7.1_sr3.50-16.1
Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.
- affected < 1.7.1_sr3.50-16.1fixed 1.7.1_sr3.50-16.1
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.
- affected < 1.7.1_sr3.30-9.1fixed 1.7.1_sr3.30-9.1
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
- affected < 1.7.1_sr3.40-13.1fixed 1.7.1_sr3.40-13.1
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in
- affected < 1.7.1_sr3.40-13.1fixed 1.7.1_sr3.40-13.1
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.refle
Page 5 of 9