Oracle Java SE vulnerabilities

Vulnerability in Oracle Java SE (component: JavaFX). Affects version 8u491. An unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (partial DOS).

A vulnerability in the ImageIO component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access to compromise data integrity, resulting in unauthorized update, insert, or delete access.

Vulnerability in Oracle Java SE (component: JSSE) in multiple versions including 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 and GraalVM. Difficult to exploit, an unauthenticated attacker via TLS can gain unauthorized access to critical data (creation, deletion, modification).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JSSE) allows an unauthenticated attacker with network access via TLS to cause a partial denial of service (partial DOS). The attack is easy to exploit.

Vulnerability in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated remote attacker can cause a hang or frequent crash (DOS).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). A difficult-to-exploit flaw allows an unauthenticated attacker with logon to the infrastructure to gain unauthorized read access to a subset of data.

A vulnerability was found in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in the Libraries component. A difficult-to-exploit network attack can allow an unauthenticated attacker to cause a partial denial of service (partial DoS). The vulnerability affects specific versions and can be exploited through APIs in the component, e.g., via a web service supplying data to the APIs.

Vulnerability in the JAXP component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can easily exploit this flaw to gain unauthorized access to critical data or all accessible data in these products.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (component: JGSS) in the listed versions. A difficult-to-exploit flaw requires user interaction and allows an unauthenticated attacker with network access to gain unauthorized access to critical data; it mainly affects clients running untrusted code in a sandbox.

A vulnerability in Oracle Java SE Libraries (version 25.0.1) allows an unauthenticated attacker with network access to update, insert, or delete some accessible data. It is difficult to exploit and primarily affects client deployments running untrusted code in a sandbox (e.g., applets, Web Start), not servers running trusted code.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). A difficult-to-exploit flaw allows an unauthenticated attacker with logon to the infrastructure to gain unauthorized read access to a subset of data.

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u481 and 8u481-b50; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 6.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H).

A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security) allows an unauthenticated attacker with network access to cause a complete denial of service (DOS) via a hang or frequently repeatable crash. Affected versions include Java SE 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1 and corresponding GraalVM versions.

Vulnerability in the AWT and JavaFX component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit this flaw via multiple protocols, requiring user interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition (component: Libraries). Supported versions affected: Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise these products. Successful attacks can result in unauthorized update, insert or delete access to some data. CVSS 3.1 Base Score 3.7 (Integrity impacts).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JAXP). Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise these products. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data. This vulnerability also applies to Java deployments, typically clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code and rely on the Java sandbox for security.

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.

An unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. The vulnerability affects outdated Java SE versions.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.