Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2020-03866

Опубликовано: 15 июл. 2020
Источник: fstec
CVSS3: 8.3
CVSS2: 7.6
EPSS Низкий

Описание

Уязвимость компонента Libraries программных платформ Oracle Java SE и Oracle Java SE Embedded связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность, конфиденциальность и доступность защищаемой информации

Вендор

Сообщество свободного программного обеспечения
Canonical Ltd.
Novell Inc.
Fedora Project
Oracle Corp.
АО «НТЦ ИТ РОСА»
АО «Концерн ВНИИНС»

Наименование ПО

Debian GNU/Linux
Ubuntu
OpenSUSE Leap
Fedora
GraalVM Enterprise Edition
Java SE
Java SE Embedded
РОСА Кобальт
ОС ОН «Стрелец»

Версия ПО

9 (Debian GNU/Linux)
18.04 LTS (Ubuntu)
15.1 (OpenSUSE Leap)
10 (Debian GNU/Linux)
31 (Fedora)
32 (Fedora)
20.04 LTS (Ubuntu)
19.3.2 (GraalVM Enterprise Edition)
20.1.0 (GraalVM Enterprise Edition)
8u251 (Java SE)
7u261 (Java SE)
11.0.7 (Java SE)
14.0.1 (Java SE)
8u251 (Java SE Embedded)
7.9 (РОСА Кобальт)
до 16.01.2023 (ОС ОН «Стрелец»)

Тип ПО

Операционная система
Прикладное ПО информационных систем
ПО виртуализации/ПО виртуального программно-аппаратного средства

Операционные системы и аппаратные платформы

Сообщество свободного программного обеспечения Debian GNU/Linux 9
Canonical Ltd. Ubuntu 18.04 LTS
Novell Inc. OpenSUSE Leap 15.1
Сообщество свободного программного обеспечения Debian GNU/Linux 10
Fedora Project Fedora 31
Fedora Project Fedora 32
Canonical Ltd. Ubuntu 20.04 LTS
АО «НТЦ ИТ РОСА» РОСА Кобальт 7.9
АО «Концерн ВНИИНС» ОС ОН «Стрелец» до 16.01.2023

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,6)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,3)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Oracle Corp.:
https://www.oracle.com/security-alerts/cpujul2020.html
Для Ubuntu:
https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-14583.html
Для Fedora Project:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2020-14583/
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2020-14583
Для ОС ОН «Стрелец»:
Обновление программного обеспечения openjdk-8 до версии 8u292-b10-repack1-0+deb9u1.osnova11
Для ОС РОСА "КОБАЛЬТ": https://abf.rosalinux.ru/advisories/ROSA-SA-2023-2315

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 77%
0.01118
Низкий

8.3 High

CVSS3

7.6 High

CVSS2

Связанные уязвимости

CVSS3: 8.3
ubuntu
почти 5 лет назад

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that l...

CVSS3: 8.3
redhat
почти 5 лет назад

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that l...

CVSS3: 8.3
nvd
почти 5 лет назад

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load

CVSS3: 8.3
debian
почти 5 лет назад

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java ...

CVSS3: 8.3
github
около 3 лет назад

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that l...

EPSS

Процентиль: 77%
0.01118
Низкий

8.3 High

CVSS3

7.6 High

CVSS2