CVE-2015-5041: Infoleak
First published: Thu Jan 28 2016(Updated: )
The following flaw was reported for IBM JDK: A flaw in the IBM J9 JVM allows code to invoke non-public interface methods under certain circumstances. Untrusted code could potentially exploit this. This could lead to sensitive data being exposed to an attacker, or the attacker being able to inject bad data. <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21974193">http://www-01.ibm.com/support/docview.wss?uid=swg21974193</a> <a href="http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_January_2016">http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_January_2016</a> This flaw could allow an untrusted Java application or applet to bypass certain Java sandbox restrictions. Issue was fixed in IBM JDK 6 SR16-FP20, 7 SR9-FP30, 7R1 SR3-FP30, and 8 SR2-FP10.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM SDK, Java Technology Edition | >=6.0.0.0<6.0.16.20 | |
| IBM SDK, Java Technology Edition | >=6.1.0.0<6.1.8.20 | |
| IBM SDK, Java Technology Edition | >=7.0.0.0<7.0.9.30 | |
| IBM SDK, Java Technology Edition | >=7.1.0.0<7.1.3.30 | |
| SUSE Linux Enterprise Server | =11-sp2 | |
| SUSE Linux Enterprise Server | =11-sp4 | |
| SUSE Linux Enterprise Server | =12-sp1 | |
| SUSE Linux Enterprise Software Development Kit | =11-sp4 | |
| SUSE Linux Enterprise Software Development Kit | =12 | |
| SUSE Linux Enterprise Software Development Kit | =12-sp1 | |
| SUSE Linux Enterprise Server | =12 | |
| Ibm Websphere Application Server | <=3.0.9.20 | |
| Red Hat Network Satellite Server | =5.6 | |
| Red Hat Network Satellite Server | =5.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-01.ibm.com/support/docview.wss?uid=swg21974193
- http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_January_2016
- https://rhn.redhat.com/errata/RHSA-2016-0101.html
- https://rhn.redhat.com/errata/RHSA-2016-0100.html
- https://rhn.redhat.com/errata/RHSA-2016-0098.html
- https://rhn.redhat.com/errata/RHSA-2016-0099.html
- https://access.redhat.com/errata/RHSA-2016:1430
- https://bugzilla.redhat.com/show_bug.cgi?id=1302689
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00032.html
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV72872
- http://www-01.ibm.com/support/docview.wss?uid=swg21974194
- http://www.securityfocus.com/bid/82451
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5041
- agent/first-publish-date
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm sdk, java technology edition
- version/ibm sdk, java technology edition/6.0.0.0
- version/ibm sdk, java technology edition/6.1.0.0
- version/ibm sdk, java technology edition/7.0.0.0
- version/ibm sdk, java technology edition/7.1.0.0
- vendor/suse
- canonical/suse linux enterprise server
- version/suse linux enterprise server/11-sp2
- version/suse linux enterprise server/11-sp4
- version/suse linux enterprise server/12-sp1
- canonical/suse linux enterprise software development kit
- version/suse linux enterprise software development kit/11-sp4
- version/suse linux enterprise software development kit/12
- version/suse linux enterprise software development kit/12-sp1
- version/suse linux enterprise server/12
- canonical/ibm websphere application server
- version/ibm websphere application server/3.0.9.20
- vendor/redhat
- canonical/red hat network satellite server
- version/red hat network satellite server/5.6
- version/red hat network satellite server/5.7