Oracle Java SE Remote Code Execution Vulnerability (CVE-2015-2590)

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: CRITICAL

  CVE Identifier: CVE-2015-2590

  Advisory Date: JUL 14, 2015

---

  DESCRIPTION

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

Trend Micro researcher Brooks Li disclosed details about this vulnerability to Oracle. The said company acknowledged Li’s research contribution.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  PATCH: http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Related Blog Entries

• Pawn Storm Update: Trend Micro Discovers New Java Zero-Day Exploit
• An In-Depth Look at How Pawn Storm’s Java Zero-Day Was Used
• Analyzing the Pawn Storm Java Zero-Day – Old Techniques Reused
• July 2015 Patch Tuesday: Microsoft, Adobe, and Oracle Roll out Security Patches for Zero-Day Vulnerabilities
• Pawn Storm C&C Redirects to Trend Micro IP Address
• OS X Zero-days on the Rise—A 2015 Midyear Review and Outlook on Advanced Attack Surfaces

Related Malware

• JAVA_DLOADR.EFD
• TROJ_DROPPR.CXC
• TSPY_FAKEMS.C