Vulnerability Details : CVE-2014-3065
Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache.
Vulnerability category: Execute code
Products affected by CVE-2014-3065
- cpe:2.3:a:ibm:java:6.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.16.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.16.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:7.0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:5.0.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:java:6.0.14.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-3065
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-3065
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
CWE ids for CVE-2014-3065
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3065
-
http://rhn.redhat.com/errata/RHSA-2014-1876.html
RHSA-2014:1876 - Security Advisory - Red Hat Customer Portal
-
https://bugzilla.redhat.com/show_bug.cgi?id=1162554
1162554 – (CVE-2014-3065) CVE-2014-3065 IBM JDK: privilege escalation via shared class cache
-
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html
[security-announce] SUSE-SU-2014:1549-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
[security-announce] SUSE-SU-2015:0344-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2015-0264.html
RHSA-2015:0264 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
[security-announce] SUSE-SU-2015:0392-1: important: Security update for
-
http://www.securityfocus.com/bid/71147
IBM Java SDK CVE-2014-3065 Local Arbitrary Code Execution Vulnerability
-
http://www-01.ibm.com/support/docview.wss?uid=swg21688283
IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology EditionVendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IV66045
IBM IV66045: FIX SECURITY VULNERABILITY CVE-2014-3065Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2014-1877.html
RHSA-2014:1877 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html
[security-announce] SUSE-SU-2015:0345-1: important: Security update for
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IV66044
IBM IV66044: FIX SECURITY VULNERABILITY CVE-2014-3065Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2014-1880.html
RHSA-2014:1880 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html
[security-announce] SUSE-SU-2015:0376-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2014-1882.html
RHSA-2014:1882 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html
[security-announce] SUSE-SU-2014:1526-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2014-1881.html
RHSA-2014:1881 - Security Advisory - Red Hat Customer Portal
Jump to