CVE-2015-2590

Name: CVE-2015-2590
Creator: NVD / NIST
Published: 2015-07-16T10:59:17.05+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10Actively ExploitedEPSS 25.71%

Last modified Jun 17, 2026

CVE-2015-2590 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.. CISA has confirmed active exploitation in the wild. EPSS estimates a 25.71% chance of exploitation in the next 30 days.

Description

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

25.71%

97.7th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Mar 24, 2022.

Affected Software

Vendor	Product	Versions	Update
Oracle	Jdk	1.6.0	Update95
Oracle	Jdk	1.7.0	Update75
Oracle	Jdk	1.8.0	Update33
Oracle	Jre	1.6.0	Update95
Oracle	Jre	1.7.0	Update75
Oracle	Jre	1.8.0	Update33
Canonical	Ubuntu Linux	12.04	—
Canonical	Ubuntu Linux	14.04	—
Canonical	Ubuntu Linux	15.04	—
Debian	Debian Linux	7.0	—
Debian	Debian Linux	8.0	—
Suse	Linux Enterprise Debuginfo	11	Sp3
Opensuse	Opensuse	13.1	—
Opensuse	Opensuse	13.2	—
Suse	Linux Enterprise Desktop	11	Sp3
Suse	Linux Enterprise Desktop	12	—
Suse	Linux Enterprise Server	12	—
Redhat	Satellite	5.6	—
Redhat	Satellite	5.7	—
Redhat	Enterprise Linux Desktop	5.0	—
Redhat	Enterprise Linux Desktop	6.0	—
Redhat	Enterprise Linux Desktop	7.0	—
Redhat	Enterprise Linux Eus	6.6	—
Redhat	Enterprise Linux Eus	6.7	—
Redhat	Enterprise Linux Eus	7.1	—
Redhat	Enterprise Linux Eus	7.2	—
Redhat	Enterprise Linux Eus	7.3	—
Redhat	Enterprise Linux Eus	7.4	—
Redhat	Enterprise Linux Eus	7.5	—
Redhat	Enterprise Linux For Ibm Z Systems	6.0_s390x	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	6.7_s390x	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.1_s390x	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.2_s390x	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.3_s390x	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.4_s390x	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.5_s390x	—
Redhat	Enterprise Linux For Power Big Endian	6.0_ppc64	—
Redhat	Enterprise Linux For Power Big Endian	7.0_ppc64	—
Redhat	Enterprise Linux For Power Big Endian Eus	6.7_ppc64	—
Redhat	Enterprise Linux For Power Big Endian Eus	7.1_ppc64	—
Redhat	Enterprise Linux For Power Big Endian Eus	7.2_ppc64	—
Redhat	Enterprise Linux For Power Big Endian Eus	7.3_ppc64	—
Redhat	Enterprise Linux For Power Big Endian Eus	7.4_ppc64	—
Redhat	Enterprise Linux For Power Big Endian Eus	7.5_ppc64	—
Redhat	Enterprise Linux For Power Little Endian	7.0_ppc64le	—
Redhat	Enterprise Linux For Power Little Endian Eus	7.1_ppc64le	—
Redhat	Enterprise Linux For Power Little Endian Eus	7.2_ppc64le	—
Redhat	Enterprise Linux For Power Little Endian Eus	7.3_ppc64le	—
Redhat	Enterprise Linux For Power Little Endian Eus	7.4_ppc64le	—
Redhat	Enterprise Linux For Power Little Endian Eus	7.5_ppc64le	—

Showing 50 of 65 affected configurations. See NVD for the full list.

References

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1228.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1229.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1230.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1241.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1242.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1243.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1485.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1486.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1488.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1526.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1544.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1604.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3316Mailing List, Third Party Advisory
http://www.debian.org/security/2015/dsa-3339Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/75818Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032910Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2696-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2706-1Third Party Advisory
https://security.gentoo.org/glsa/201603-11Third Party Advisory
https://security.gentoo.org/glsa/201603-14Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1228.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1229.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1230.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1241.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1242.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1243.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1485.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1486.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1488.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1526.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1544.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1604.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3316Mailing List, Third Party Advisory
http://www.debian.org/security/2015/dsa-3339Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/75818Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032910Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2696-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2706-1Third Party Advisory
https://security.gentoo.org/glsa/201603-11Third Party Advisory
https://security.gentoo.org/glsa/201603-14Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2590US Government Resource

Timeline

Published: Jul 16, 2015
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2015-2590?

How severe is CVE-2015-2590?

CVE-2015-2590 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 25.71% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2015-2590?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-2590?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST