Skip to content
OpenAdvisories
Unscored Public exploit CVE-2014-6593 EUVD-2014-6472GHSA-fpfc-8gg5-hw57

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allo…

Published Jan 21, 2015 · Updated Aug 6, 2024 · Assigned by oracle

Package: openjdk-6 Package: openjdk-7 Ecosystem: Ubuntu

Description

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 7 openjdk-6 6b34-1.13.6-1~deb7u1 DSA-3147-1
Debian 7 openjdk-7 7u75-2.5.4-1~deb7u1 DSA-3144-1
Debian 6.0 openjdk-6 6b34-1.13.6-1~deb6u1 DLA-157-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS openjdk-6 6b34-1.13.6-1ubuntu0.14.04.1 —
Ubuntu 14.04 LTS openjdk-7 7u75-2.5.4-1~trusty1 USN-2487-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 java-1.6.0-openjdk +4 1:1.6.0.34-1.13.6.1.el7_0 RHSA-2015:0085
RHEL 7 java-1.7.0-openjdk +6 1:1.7.0.75-2.5.4.2.el7_0 RHSA-2015:0067
RHEL 7 java-1.7.1-ibm +5 1:1.7.1.2.10-1jpp.3.el7_0 RHSA-2015:0133
RHEL 6 java-1.5.0-ibm +6 1:1.5.0.16.9-1jpp.1.el6_6 RHSA-2015:0136
RHEL 6 java-1.6.0-ibm +6 1:1.6.0.16.3-1jpp.1.el6_6 RHSA-2015:0135
RHEL 6 java-1.6.0-openjdk +4 1:1.6.0.34-1.13.6.1.el6_6 RHSA-2015:0085
RHEL 6 java-1.7.0-openjdk +4 1:1.7.0.75-2.5.4.0.el6_6 RHSA-2015:0067
RHEL 6 java-1.7.1-ibm +5 1:1.7.1.2.10-1jpp.3.el6_6 RHSA-2015:0133
RHEL 6 java-1.8.0-openjdk +5 1:1.8.0.31-1.b13.el6_6 RHSA-2015:0069
RHEL 5 java-1.5.0-ibm +7 1:1.5.0.16.9-1jpp.1.el5 RHSA-2015:0136
RHEL 5 java-1.6.0-ibm +7 1:1.6.0.16.3-1jpp.1.el5 RHSA-2015:0135
RHEL 5 java-1.6.0-openjdk +4 1:1.6.0.34-1.13.6.1.el5_11 RHSA-2015:0085
RHEL 5 java-1.7.0-ibm +5 1:1.7.0.8.10-1jpp.4.el5 RHSA-2015:0134
RHEL 5 java-1.7.0-openjdk +4 1:1.7.0.75-2.5.4.0.el5_11 RHSA-2015:0068
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Extras Oracle Java 7 java-1.6.0-sun +5 1:1.6.0.91-1jpp.1.el7 RHSA-2015:0086
Red Hat Rhel Extras Oracle Java 7 java-1.7.0-oracle +5 1:1.7.0.75-1jpp.2.el7 RHSA-2015:0079
Red Hat Rhel Extras Oracle Java 6 java-1.6.0-sun +5 1:1.6.0.91-1jpp.1.el6 RHSA-2015:0086
Red Hat Rhel Extras Oracle Java 6 java-1.7.0-oracle +5 1:1.7.0.75-1jpp.1.el6 RHSA-2015:0079
Red Hat Rhel Extras Oracle Java 6 java-1.8.0-oracle +5 1:1.8.0.31-1jpp.1.el6 RHSA-2015:0080
Red Hat Rhel Extras Oracle Java 5 java-1.6.0-sun +5 1:1.6.0.91-1jpp.1.el5_11 RHSA-2015:0086
Red Hat Rhel Extras Oracle Java 5 java-1.7.0-oracle +5 1:1.7.0.75-1jpp.1.el5_11 RHSA-2015:0079
Red Hat Network Satellite 5 java-1.6.0-ibm +1 1:1.6.0.16.3-1jpp.1.el5 RHSA-2015:0264, RHSA-2015:0263

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 java-1_7_0-openjdk 1.7.0.75-11.3 SUSE-SU-2015:0503-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 java-1_7_0-openjdk 1.7.0.75-11.3 SUSE-SU-2015:0503-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-1_7_0-openjdk 1.7.0.121-1.1 openSUSE-SU-2024:10534-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 java-1.6.0-openjdk +4 1:1.6.0.34-1.13.6.1.0.1.el5_11 ELSA-2015-0085
Oracle Linux 7 java-1.7.0-openjdk +6 1:1.7.0.75-2.5.4.2.0.1.el7_0 ELSA-2015-0067

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 22

References