5.3Orta KEV

CVE-2015-4902Oracle Java SE Integrity Check Vulnerability

oracle jdk; oracle jre; redhat satellite; redhat enterprise linux desktop Yayım: 2015-10-22 02:00 (11 yıl önce)

Aktif olarak istismar ediliyor — Oracle Java SE Integrity Check Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 24.03.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2015-4902

Açıklama

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

Zayıflık türü (CWE): CWE-284

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
opensuse	leap	42.1
opensuse	opensuse	13.2
oracle	jdk	1.6.0
oracle	jre	1.6.0
redhat	enterprise linux desktop	5.0
redhat	enterprise linux eus	6.7
redhat	enterprise linux eus compute node	7.2
redhat	enterprise linux for ibm z systems	5.0_s390x
redhat	enterprise linux for ibm z systems eus	6.7_s390x
redhat	enterprise linux for power big endian	5.0_ppc
redhat	enterprise linux for power big endian eus	6.7_ppc64
redhat	enterprise linux for power little endian	7.0_ppc64le
redhat	enterprise linux for power little endian eus	7.2_ppc64le
redhat	enterprise linux for scientific computing	6.0
redhat	enterprise linux server	5.0
redhat	enterprise linux server from rhui	5.0
redhat	enterprise linux workstation	5.0
redhat	satellite	5.6
suse	linux enterprise module for legacy	12
suse	linux enterprise server	10
suse	linux enterprise software development kit	11

Kaynaklar ve yamalar

SUSE-SU-2015:2182 vendor-advisoryThird Party Advisory
openSUSE-SU-2015:1905 vendor-advisoryThird Party Advisory
SUSE-SU-2015:2192 vendor-advisoryThird Party Advisory
RHSA-2015:2507 vendor-advisoryThird Party Advisory
RHSA-2015:1928 vendor-advisoryThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html PatchVendor Advisory
RHSA-2016:1430 vendor-advisoryThird Party Advisory
RHSA-2015:2506 vendor-advisoryThird Party Advisory
RHSA-2015:2509 vendor-advisoryThird Party Advisory
1033884 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
SUSE-SU-2015:2166 vendor-advisoryThird Party Advisory
openSUSE-SU-2016:0270 vendor-advisoryThird Party Advisory
77241 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
GLSA-201603-11 vendor-advisoryThird Party Advisory
RHSA-2015:2518 vendor-advisoryThird Party Advisory
SUSE-SU-2015:2216 vendor-advisoryThird Party Advisory
RHSA-2015:1927 vendor-advisoryThird Party Advisory
SUSE-SU-2015:2268 vendor-advisoryThird Party Advisory
SUSE-SU-2015:2168 vendor-advisoryThird Party Advisory
RHSA-2015:1926 vendor-advisoryThird Party Advisory
RHSA-2015:2508 vendor-advisoryThird Party Advisory
SUSE-SU-2016:0113 vendor-advisoryThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4902 US Government Resource

CPE eşleşmeleri (NVD) (60)

cpe:2.3:a:oracle:jdk:1.6.0:update101:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update85:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update60:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update101:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update85:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update60:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0_ppc:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_module_for_legacy:12:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*

CVSS puanı

5.3Orta

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tüm puanlar (3)

CISA-ADP	CVSS 3.1	5.3Orta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.3Orta
nvd	CVSS 2.0	5.0Orta

EPSS (30 günde istismar olasılığı)

13.60%

tüm CVE'lerin %96'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: yes
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2015-06-24
Yayımlandı2015-10-22 02:00
IP-DB'ye ulaştı2026-10-24 23:34
KEV'e eklendi2022-03-03
Son güncelleme2026-06-17 03:28

Numarayı veren (CNA): oracle
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Java SE / OpenJDK

9.1Kritik

CVE-2026-114820 12 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.…

9.1Kritik

CVE-2026-91403 14 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1;…

4.8Orta

CVE-2026-91487 15 gün önce

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21…

7.5Yüksek

CVE-2026-91484 15 gün önce

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE …

5.9Orta

CVE-2026-91462 15 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,…

5.3Orta

CVE-2026-91463 15 gün önce

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition