CVE-2015-2590
CRITICALCVSS 9.8/10Actively ExploitedEPSS 25.71%
Last modified
CVE-2015-2590 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.. CISA has confirmed active exploitation in the wild. EPSS estimates a 25.71% chance of exploitation in the next 30 days.
Description
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Oracle | Jdk | 1.6.0 | Update95 |
| Oracle | Jdk | 1.7.0 | Update75 |
| Oracle | Jdk | 1.8.0 | Update33 |
| Oracle | Jre | 1.6.0 | Update95 |
| Oracle | Jre | 1.7.0 | Update75 |
| Oracle | Jre | 1.8.0 | Update33 |
| Canonical | Ubuntu Linux | 12.04 | — |
| Canonical | Ubuntu Linux | 14.04 | — |
| Canonical | Ubuntu Linux | 15.04 | — |
| Debian | Debian Linux | 7.0 | — |
| Debian | Debian Linux | 8.0 | — |
| Suse | Linux Enterprise Debuginfo | 11 | Sp3 |
| Opensuse | Opensuse | 13.1 | — |
| Opensuse | Opensuse | 13.2 | — |
| Suse | Linux Enterprise Desktop | 11 | Sp3 |
| Suse | Linux Enterprise Desktop | 12 | — |
| Suse | Linux Enterprise Server | 12 | — |
| Redhat | Satellite | 5.6 | — |
| Redhat | Satellite | 5.7 | — |
| Redhat | Enterprise Linux Desktop | 5.0 | — |
| Redhat | Enterprise Linux Desktop | 6.0 | — |
| Redhat | Enterprise Linux Desktop | 7.0 | — |
| Redhat | Enterprise Linux Eus | 6.6 | — |
| Redhat | Enterprise Linux Eus | 6.7 | — |
| Redhat | Enterprise Linux Eus | 7.1 | — |
| Redhat | Enterprise Linux Eus | 7.2 | — |
| Redhat | Enterprise Linux Eus | 7.3 | — |
| Redhat | Enterprise Linux Eus | 7.4 | — |
| Redhat | Enterprise Linux Eus | 7.5 | — |
| Redhat | Enterprise Linux For Ibm Z Systems | 6.0_s390x | — |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 6.7_s390x | — |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 7.1_s390x | — |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 7.2_s390x | — |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 7.3_s390x | — |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 7.4_s390x | — |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 7.5_s390x | — |
| Redhat | Enterprise Linux For Power Big Endian | 6.0_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian | 7.0_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 6.7_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.1_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.2_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.3_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.4_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.5_ppc64 | — |
| Redhat | Enterprise Linux For Power Little Endian | 7.0_ppc64le | — |
| Redhat | Enterprise Linux For Power Little Endian Eus | 7.1_ppc64le | — |
| Redhat | Enterprise Linux For Power Little Endian Eus | 7.2_ppc64le | — |
| Redhat | Enterprise Linux For Power Little Endian Eus | 7.3_ppc64le | — |
| Redhat | Enterprise Linux For Power Little Endian Eus | 7.4_ppc64le | — |
| Redhat | Enterprise Linux For Power Little Endian Eus | 7.5_ppc64le | — |
Showing 50 of 65 affected configurations. See NVD for the full list.
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1228.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1229.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1230.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1241.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1242.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1243.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1485.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1486.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1488.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1526.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1544.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1604.htmlThird Party Advisory
- http://www.debian.org/security/2015/dsa-3316Mailing List, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3339Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/75818Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032910Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2696-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2706-1Third Party Advisory
- https://security.gentoo.org/glsa/201603-11Third Party Advisory
- https://security.gentoo.org/glsa/201603-14Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1228.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1229.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1230.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1241.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1242.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1243.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1485.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1486.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1488.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1526.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1544.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1604.htmlThird Party Advisory
- http://www.debian.org/security/2015/dsa-3316Mailing List, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3339Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/75818Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032910Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2696-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2706-1Third Party Advisory
- https://security.gentoo.org/glsa/201603-11Third Party Advisory
- https://security.gentoo.org/glsa/201603-14Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2590US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2015-2590?
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
How severe is CVE-2015-2590?
CVE-2015-2590 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 25.71% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2015-2590?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-2584Unspecified vulnerability in the Hyperion Enterprise Perform…
- CVE-2015-2585Unspecified vulnerability in the Application Express compone…
- CVE-2015-2586Unspecified vulnerability in the Application Express compone…
- CVE-2015-2587Unspecified vulnerability in the Siebel UI Framework compone…
- CVE-2015-2588Unspecified vulnerability in the PeopleSoft Enterprise Peopl…
- CVE-2015-2589Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 …
- CVE-2015-2591Unspecified vulnerability in the PeopleSoft Enterprise Porta…
- CVE-2015-2592Unspecified vulnerability in the Hyperion Enterprise Perform…
- CVE-2015-2593Unspecified vulnerability in the Oracle Access Manager compo…
- CVE-2015-2594Unspecified vulnerability in the Oracle VM VirtualBox compon…
- CVE-2015-2595Unspecified vulnerability in the Oracle OLAP component in Or…
- CVE-2015-2596Unspecified vulnerability in Oracle Java SE 7u80 allows remo…
Are you affected by CVE-2015-2590?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST