Critical severity · published Jun 6, 2016
CVE-2015-5041
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive…
9.1
CVSS
3.9%
EPSS
No
On KEV
Description
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java Sdk · Ibm
6.0.0.0 before 6.0.16.20; 6.1.0.0 before 6.1.8.20; 7.0.0.0 before 7.0.9.30; 7.1.0.0 before 7.1.3.30 · source: NVD
LE
Linux Enterprise Server · Suse
11; 11; 12 · source: NVD
LE
Linux Enterprise Software Development Kit · Suse
11; 12; 12 · source: NVD
SA
Satellite · Redhat
5.6; 5.7 · source: NVD
SL
Suse Linux Enterprise Server · Suse
12 · source: NVD
WA
Websphere Application Server · Ibm
through 3.0.9.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5041
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5041
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00026.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00028.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00031.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00032.html
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV72872
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21974194
More from Java Sdk
8.1
CVE-2018-1417
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges
8.1
CVE-2016-0376
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…
8.1
CVE-2016-0363
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1…
5.9
CVE-2024-27267
The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a…
5.6
CVE-2016-0264
Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40…