Security Alert (A15-10-05): Multiple Vulnerabilities in Oracle Java and Oracle Products (October 2015)
22 October 2015
Oracle has released Critical Patch Update (CPU) Advisory with collections of patches for multiple security vulnerabilities found in Java SE and various Oracle products.
There are 25 vulnerabilities identified in Java affecting multiple sub-components including 2D, CORBA, Deployment, JavaFX, JAXP, JGSS, Libraries, RMI, Security and Serialization. 24 of them could be remotely exploitable without authentication and 5 of them could affect server deployment of Java (e.g. through a web service).
For vulnerabilities identified in those Oracle products, they can be remotely exploited through various protocols including HTTP, HTTPS, LDAP, Memcached, MySQL Protocol, Oracle Net, SQLNet and SSL/TLS over a network.
There are multiple attack vectors. For Java, an attacker could entice a user to open a specially crafted web page containing un-trusted Java applet or Java Web Start application with malicious content, or to launch executables using the Java launcher. For other Oracle products, a remote attacker could send specially crafted network packets to the affected system to exploit the vulnerabilities.
Fusion Applications & Middleware
Oracle and Sun Systems Products Suite
Oracle Communications Applications
Oracle Java SE
Oracle Linux and Virtualization
Oracle MySQL Product Suite
Oracle Retail Applications Suite
Oracle Supply Chain Products Suite
For details of affected products, please refer to "Affected Products and Components" of corresponding security advisory at the vendor’s website:
Depending on the vulnerability exploited, a successful attack could lead to arbitrary code execution, denial of services, gain of escalated privilege, information disclosure, bypass of security restrictions or compromise of a vulnerable system.
Patches for affected systems are available. Users of the affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.
For Oracle Java SE products, please refer to the following link:
Java Platform SE 8 (JDK and JRE 8 Update 66) http://www.oracle.com/technetwork/java/javase/downloads/index.html
Java SE 7 has reached its end of public updates since April 2015. Users should consider upgrading to the latest Java SE version(s) or contact their product support vendors for extended support.