Actively exploited · Published Jul 16, 2015 · Assigned by oracle

CVE-2015-2590

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in Java SE from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 25.5% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)25.5%top 2.0% of all CVEs

Exploited in the wildYesCISA KEV since Mar 3, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

RHSA-2015:1243 vendor-advisory, x_refsource_REDHAT
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html x_refsource_CONFIRM
75818 vdb-entry, x_refsource_BID
RHSA-2015:1229 vendor-advisory, x_refsource_REDHAT
1032910 vdb-entry, x_refsource_SECTRACK
USN-2706-1 vendor-advisory, x_refsource_UBUNTU
RHSA-2015:1526 vendor-advisory, x_refsource_REDHAT
RHSA-2015:1485 vendor-advisory, x_refsource_REDHAT
RHSA-2015:1544 vendor-advisory, x_refsource_REDHAT
openSUSE-SU-2015:1289 vendor-advisory, x_refsource_SUSE
RHSA-2015:1228 vendor-advisory, x_refsource_REDHAT
DSA-3316 vendor-advisory, x_refsource_DEBIAN
GLSA-201603-11 vendor-advisory, x_refsource_GENTOO
RHSA-2015:1486 vendor-advisory, x_refsource_REDHAT
GLSA-201603-14 vendor-advisory, x_refsource_GENTOO
USN-2696-1 vendor-advisory, x_refsource_UBUNTU
DSA-3339 vendor-advisory, x_refsource_DEBIAN
RHSA-2015:1242 vendor-advisory, x_refsource_REDHAT
RHSA-2015:1488 vendor-advisory, x_refsource_REDHAT
SUSE-SU-2015:1319 vendor-advisory, x_refsource_SUSE
SUSE-SU-2015:1320 vendor-advisory, x_refsource_SUSE
openSUSE-SU-2015:1288 vendor-advisory, x_refsource_SUSE
RHSA-2015:1241 vendor-advisory, x_refsource_REDHAT
RHSA-2015:1230 vendor-advisory, x_refsource_REDHAT
RHSA-2015:1604 vendor-advisory, x_refsource_REDHAT
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2590 government-resource