PT-2014-5059 · Ibm+2 · Java Runtime Environment+3

Published 2014-10-26 · Updated 2015-03-18 · CVE-2014-3065

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Java Runtime Environment (JRE) versions 7.0.0 through 7.1.2.0 IBM Java Runtime Environment (JRE) versions 7.0.0 through 7.0.8.0 IBM Java Runtime Environment (JRE) versions 6.0.0 through 6.1.8.2 IBM Java Runtime Environment (JRE) versions 6.0.0 through 6.0.16.2 IBM Java Runtime Environment (JRE) versions 5.0.0 through 5.0.16.8

Description The issue allows local users to execute arbitrary code via vectors related to the shared classes cache. It is also related to the POODLE SSLv3 vulnerability and an additional unspecified vulnerability.

Recommendations For versions 7.0.0 through 7.1.2.0, update to a version after 7.1.2.0. For versions 7.0.0 through 7.0.8.0, update to a version after 7.0.8.0. For versions 6.0.0 through 6.1.8.2, update to a version after 6.1.8.2. For versions 6.0.0 through 6.0.16.2, update to a version after 6.0.16.2. For versions 5.0.0 through 5.0.16.8, update to a version after 5.0.16.8.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-3065

RHSA-2014:1876

RHSA-2014:1877

RHSA-2014:1880

RHSA-2014:1881

RHSA-2014:1882

RHSA-2014_1877

RHSA-2014_1880

RHSA-2014_1881

RHSA-2014_1882

RHSA-2015:0264

SUSE-SU-2014_1526-1

SUSE-SU-2014_1541-1

SUSE-SU-2014_1549-1

Affected Products

Ibm Aix

Java Runtime Environment

Red Hat

Suse

References · 126

• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• https://bdu.fstec.ru/vul/2015-00548 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6531 · Security Note
• https://bdu.fstec.ru/vul/2015-00591 · Security Note
• https://bdu.fstec.ru/vul/2015-00558 · Security Note
• https://bdu.fstec.ru/vul/2015-00590 · Security Note
• https://bdu.fstec.ru/vul/2015-00642 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4288 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6503 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6558 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6511 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6513 · Security Note
• https://bdu.fstec.ru/vul/2015-00587 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566 · Security Note