CVE-2015-4840: Medium severity oracle java se 7 vulnerability

Published Oct 20, 2015

Updated

It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

— MITRE

Affected Software

6 affected components

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Remediation

Patch Available

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Event History

Oct 20, 2015

Data Sourced

via Red Hat·09:06 AM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4840?

CVE-2015-4840 has a critical severity level due to its potential impact on confidentiality through out of bounds access.

How do I fix CVE-2015-4840?

To remediate CVE-2015-4840, upgrade to the latest version of Oracle Java SE that addresses this vulnerability.

Which versions are affected by CVE-2015-4840?

CVE-2015-4840 affects Oracle Java SE 7u85, 8u60, and Java SE Embedded 8u51.

What types of attacks can exploit CVE-2015-4840?

CVE-2015-4840 can be exploited by remote attackers to disclose sensitive information through unspecified vectors.

Is there a workaround for CVE-2015-4840?

There is no official workaround for CVE-2015-4840; the recommended action is to update to a patched version.