Oracle Java SE vulnerabilities

Vulnerability in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. A difficult-to-exploit flaw allows an unauthenticated attacker with network access to cause a hang or frequently repeatable crash (DoS) and to gain unauthorized read and update access to some accessible data. It can be exploited via APIs in the component, e.g., through a web service supplying data to the APIs, and also affects deployments running untrusted code in the Java sandbox.

Vulnerability in the JGSS component of Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. A difficult-to-exploit attack can cause a hang or repeatable crash (complete DoS) and unauthorized data modification.

Vulnerability in the Libraries component of Oracle Java SE. An unauthenticated attacker with network access can cause a partial denial of service (partial DoS).

Vulnerability in Oracle Java SE (component: Networking) version 27. A difficult to exploit flaw allows an unauthenticated network attacker to cause partial denial of service; exploitable via component APIs, e.g., a web service, and applies to sandboxed Java clients.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (component: Sound). A difficult to exploit flaw allows an unauthenticated network attacker to cause partial denial of service, requiring user interaction; applies to sandboxed Java clients.

Vulnerability in the Networking component of Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. A difficult-to-exploit attack via SOCKS5 can lead to unauthorized creation, deletion or modification of critical data, with possible impact on additional products.

Vulnerability in the Serviceability component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is difficult to exploit, requires logon to the infrastructure and human interaction, and can lead to unauthorized update, insert or delete access to data and partial denial of service.

Vulnerability in the Utility component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit it to cause unauthorized data modification and partial denial of service.

Vulnerability in the Utility component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit it to cause unauthorized data modification and partial denial of service.

Vulnerability in the Networking component of Oracle Java SE and Oracle GraalVM for JDK. A difficult-to-exploit flaw allows an unauthenticated attacker with network access to gain unauthorized access to critical data or all Java-accessible data.

Vulnerability in the JSSE component of Oracle Java SE allows an unauthenticated network attacker via TLS to easily exploit it. This can cause a partial denial of service (partial DoS) of Oracle Java SE.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (AWT component) across multiple versions. A difficult-to-exploit flaw allows a low-privileged network attacker to read a subset of data, but requires user interaction; applies to sandboxed Java clients.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (ImageIO component) across multiple versions. A difficult-to-exploit flaw allows an unauthenticated network attacker to read a subset of data; also applies to sandboxed Java clients.

Vulnerability in Oracle Java SE (Security component) affecting versions 21.0.12.1, 25.0.4.1, and 27. A difficult-to-exploit flaw allows an unauthenticated network attacker to modify, insert, or delete some data; also applies to sandboxed Java clients.

Vulnerability in the Networking component of Oracle Java SE. An unauthenticated attacker with network access can perform unauthorized update, insert, or delete operations on some Java SE accessible data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JAXP) affecting the listed versions. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 3.7.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (Security component) in the listed versions. An unauthenticated attacker with network access can perform unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in Oracle Java SE (RMI component) affecting versions 8u503 and 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. An unauthenticated attacker with network access can perform unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data; attacks may impact additional products (scope change).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (component Networking). Affects multiple listed versions, including Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27. A difficult-to-exploit flaw allows an unauthenticated network attacker to cause unauthorized data modification.

Vulnerability in Oracle Java SE (Networking component) affecting versions 21.0.12.1, 25.0.4.1 and 27. An unauthenticated attacker with network access can gain unauthorized read access to a subset of data accessible in the product.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (JAXP component) in the listed versions. A difficult-to-exploit unauthenticated network attack can lead to unauthorized access to critical data or all data accessible in the product.

Vulnerability in Oracle Java SE (component Compiler). Affects versions 25.0.4.1 and 27. A difficult-to-exploit flaw allows an unauthenticated network attacker to gain unauthorized read access to a subset of Java SE accessible data.

Vulnerability in the JAXP component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can cause a partial denial of service (partial DoS). The vulnerability also applies to Java deployments running untrusted code in a sandbox.

Vulnerability in the Networking component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can perform unauthorized data modification and cause a partial denial of service. The vulnerability also applies to Java deployments running untrusted code in a sandbox.

Vulnerability in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can gain unauthorized access to critical data; exploitation is difficult. The vulnerability also applies to Java deployments running untrusted code in a sandbox.

Vulnerability in Oracle Java SE (component: Security) affects versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition 21.3.19.1.1. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JAAS) affects versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition 21.3.19.1.1. An easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read access to a subset of data.

Vulnerability in Oracle Java SE (component: Compiler) affects versions 21.0.12.1, 25.0.4.1, and 27. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. A difficult to exploit flaw allows an unauthenticated attacker with network access via TLS to perform unauthorized update, insert, or delete access to some accessible data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security) affects versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition 21.3.19.1.1. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized creation, deletion, or modification of critical data.

Vulnerability in Oracle Java SE (component: Compiler) affects version 26.0.2. A difficult-to-exploit attack by an unauthenticated attacker with network access via multiple protocols can cause a hang or frequently repeatable crash (complete DoS). The vulnerability can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (availability impact).

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JSSE). An unauthenticated attacker over the network (TLS) can cause a partial denial of service (partial DoS).

Vulnerability in Oracle Java SE (component: 2D) versions 25.0.4 and 26.0.2. An unauthenticated attacker with network access via multiple protocols can cause a hang or frequently repeatable crash (complete DoS) of Java SE. The vulnerability can be exploited via APIs in the component, e.g., through a web service supplying data to APIs, and also applies to Java deployments running sandboxed applications.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Networking). Affects multiple versions. Difficult to exploit by an unauthenticated attacker over HTTP, may impact other products (scope change) and allows unauthorized access to critical data or complete access to all data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). Affects multiple versions, including Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; GraalVM for JDK 17.0.20 and 21.0.12; GraalVM Enterprise Edition 21.3.19. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks can result in unauthorized read access to a subset of data.

Vulnerability in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. A low-privileged attacker with local access can take over the system.

Vulnerability in Oracle Java SE (component: Installation) in versions 8u491 and 8u491-perf. A low-privileged attacker with local access, after user interaction, can take over the Java SE environment.

Vulnerability in Oracle Java SE (component: JavaFX) version 8u491. Difficult to exploit, requires user interaction and network access. Successful attack may lead to unauthorized read access to a subset of data.

Oracle Java SE version 8u491 has a vulnerability in the JavaFX component. This difficult-to-exploit flaw allows an unauthenticated attacker with network access to perform unauthorized read access to a subset of data, requiring user interaction.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security) in multiple versions. Easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to unauthorizedly update, insert, delete, or read a subset of data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Libraries). An unauthenticated attacker via network can compromise data integrity, gaining unauthorized access to create, delete, or modify critical data.

Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: 2D) in multiple versions have a difficult-to-exploit vulnerability that allows an unauthenticated attacker with network access to cause a partial denial of service (partial DOS). This vulnerability primarily affects clients running Java Web Start applets.

Vulnerability in Oracle Java SE (component: Scripting). Affected versions are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized access to critical data and modify it.

Vulnerability in the Scripting component of Oracle Java SE allows an unauthenticated attacker to remotely cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. The attack is easily exploitable over network via multiple protocols.

A vulnerability in Oracle Java SE 8u491, component JavaFX, allows an unauthenticated attacker with network access to compromise data integrity via unauthorized update, insert, or delete access. The attack requires user interaction and is difficult to exploit. It applies to sandboxed Java deployments like applets or Web Start.

Vulnerability in Oracle Java SE in the JavaFX component. Version 8u491 is affected. The attack is difficult to exploit, requires user interaction and network access. It may lead to unauthorized data modification.

Vulnerability in Oracle Java SE in the JavaFX component. Version 8u491 is affected. The attack is difficult to exploit, requires user interaction and network access. It may lead to unauthorized data modification.

Vulnerability in Oracle Java SE (component: Libraries) allows an unauthenticated attacker with network access to cause a partial denial of service (partial DOS). The attack is easy to exploit and can be triggered via APIs, e.g., through a web service.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: 2D). Affects multiple versions. An unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (partial DOS).