Skip to content
Fencer Intel
medium 5.9

CVE-2015-7575 json

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does no…

published 2016-01-09 10 y ago modified 2026-10-14 25 d ago also EUVD-2015-7485

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

Patch / fix

  • nss Debian 14, Debian 13, Debian 12 2:3.21-1
  • openssl Debian 14, Debian 13, Debian 12 1.0.1f-1
  • gnutls28 Debian 14, Debian 13, Debian 12 3.3.15-1

debian advisories DEBIAN-CVE-2015-7575

  • nss Ubuntu 14.04 LTS 2:3.19.2.1-0ubuntu0.14.04.2
  • firefox Ubuntu 14.04 LTS 43.0.4+build3-0ubuntu0.14.04.1
  • gnutls26 Ubuntu 14.04 LTS 2.12.23-12ubuntu2.4
  • openjdk-6 Ubuntu 14.04 LTS 6b38-1.13.10-0ubuntu0.14.04.1
  • openjdk-7 Ubuntu 14.04 LTS 7u95-2.6.4-0ubuntu0.14.04.1
  • thunderbird Ubuntu 14.04 LTS 1:38.6.0+build1-0ubuntu0.14.04.1
  • thunderbird Ubuntu 16.04 LTS 1:38.6.0+build1-0ubuntu1

ubuntu advisories UBUNTU-CVE-2015-7575

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • java-1.7.0-ibm network satellite 5.6 1:1.7.0.9.40-1jpp.1.el5
  • java-1.7.1-ibm network satellite 5.7, network satellite 5.6 1:1.7.1.3.40-1jpp.1.el6_7
  • spacewalk-java network satellite 5.6 2.0.2-109.el5sat
  • spacewalk-java network satellite 5.6 2.0.2-109.el6sat
  • spacewalk-java network satellite 5.7 2.3.8-146.el6sat
  • spacewalk-java-lib network satellite 5.6 2.0.2-109.el5sat
  • spacewalk-java-lib network satellite 5.6 2.0.2-109.el6sat
  • spacewalk-java-lib network satellite 5.7 2.3.8-146.el6sat

red hat advisories RHSA-2016:1430RHSA-2016:0101RHSA-2016:0100RHSA-2016:0099RHSA-2016:0053RHSA-2016:0050

  • java-1_6_0-ibm SLE Module for Legacy 12 1.6.0_sr16.20-30.1
  • java-1_7_1-ibm SLES for SAP 12 SP1, SLES for SAP 12, SLES 12 SP1 +3 more 1.7.1_sr3.30-21.1
  • java-1_7_1-ibm SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 1.7.1_sr3.30-9.1
  • java-1_8_0-ibm SLES for SAP 12 SP1, SLES 12 SP1, SLE Software Development Kit 12 SP1 1.8.0_sr2.10-7.1
  • java-1_7_0-openjdk SLES for SAP 12 SP1, SLES for SAP 12, SLES 12 SP1 +3 more 1.7.0.95-24.2
  • java-1_7_0-openjdk SLED 11 SP4, SLED 11 SP3 1.7.0.95-0.17.2
  • java-1_8_0-openjdk SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 1.8.0.72-3.2
  • mozilla-nss SLES for SAP 11 SP4, SLES for SAP 11 SP3, SLES 11 SP4 +6 more 3.19.2.2-22.1

suse advisories SUSE-SU-2016:0770-1SUSE-SU-2016:0636-1SUSE-SU-2016:0584-1SUSE-SU-2016:0431-1SUSE-SU-2016:0433-1SUSE-SU-2016:0428-1

  • mbedtls-3 openSUSE Tumbleweed 3.6.6-1.1
  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 50.1.0-1.1
  • mbedtls openSUSE Tumbleweed 2.4.0-1.2
  • java-1_8_0-openjdk openSUSE Tumbleweed 1.8.0.111-1.1
  • MozillaThunderbird openSUSE Tumbleweed 45.5.1-1.1
  • mozilla-nss openSUSE Tumbleweed 3.26.2-1.1
  • bouncycastle openSUSE Tumbleweed 1.54-1.2

opensuse advisories openSUSE-SU-2026:11119-1openSUSE-SU-2024:14572-1openSUSE-SU-2024:10071-1openSUSE-SU-2024:10088-1openSUSE-SU-2024:10197-1openSUSE-SU-2024:10230-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-7575 updated cvss 5.8

TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)

  • Red Hat JBoss Enterprise Web Server 1 openssl
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 3 openssl
    affected: no fix available
  • Red Hat Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.7.0-oracle 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-src 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el7, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Client 5 java-1.7.0-oracle 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-src 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-javafx 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-plugin 1.7.0.95-1jpp.1.el5_11 Red Hat Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.7.0-oracle 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-src 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-javafx 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-javafx 1.8.0.71-1jpp.1.el7 Red Hat Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.7.0-oracle 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-src 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el6_7, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.7.0-oracle 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-src 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el6_7, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.7.0-oracle 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-src 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el7, +4 more
    +4 more products
    Red Hat Oracle Java for Red Hat Enterprise Linux Server 5 java-1.7.0-oracle 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-src 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-javafx 1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-plugin 1.7.0.95-1jpp.1.el5_11 Red Hat Oracle Java for Red Hat Enterprise Linux Server 6 java-1.7.0-oracle 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-src 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el6_7, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Workstation java-1.7.0-oracle 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-src 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el6_7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.1.el6_7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el6_7, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-oracle 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-src 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-src 1.8.0.71-1jpp.1.el7, java-1.7.0-oracle-jdbc 1.7.0.95-1jpp.2.el7, java-1.8.0-oracle-jdbc 1.8.0.71-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2016:0056
  • Red Hat Enterprise Linux (v. 5 server) java-1.7.0-openjdk 1.7.0.95-2.6.4.1.el5_11, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.1.el5_11, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.1.el5_11, java-1.7.0-openjdk-javadoc 1.7.0.95-2.6.4.1.el5_11 Red Hat Enterprise Linux Client (v. 7) nss 3.19.1-19.el7_2, gnutls 3.3.8-14.el7_2, nss-tools 3.19.1-19.el7_2, openssl 1.0.1e-51.el7_2.2, gnutls-dane 3.3.8-14.el7_2, gnutls-utils 3.3.8-14.el7_2, +6 more Red Hat Enterprise Linux Client Optional (v. 7) gnutls-c++ 3.3.8-14.el7_2, openssl-perl 1.0.1e-51.el7_2.2, java-1.8.0-openjdk-src 1.8.0.71-2.b15.el7_2, java-1.8.0-openjdk-demo 1.8.0.71-2.b15.el7_2, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el7_2, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el7_2, +4 more
    fixed: vendor fix RHSA-2016:0054
  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.3.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2016:0099
  • Red Hat Enterprise Linux ComputeNode (v. 7) nss 3.19.1-19.el7_2, gnutls 3.3.8-14.el7_2, nss-tools 3.19.1-19.el7_2, openssl 1.0.1e-51.el7_2.2, gnutls-dane 3.3.8-14.el7_2, gnutls-utils 3.3.8-14.el7_2, +6 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) gnutls-c++ 3.3.8-14.el7_2, openssl-perl 1.0.1e-51.el7_2.2, java-1.8.0-openjdk-src 1.8.0.71-2.b15.el7_2, java-1.8.0-openjdk-demo 1.8.0.71-2.b15.el7_2, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el7_2, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el7_2, +4 more
    fixed: vendor fix RHSA-2016:0054
  • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm-demo 1.8.0.2.10-1jpp.1.el7
    fixed: vendor fix RHSA-2016:0099
  • Red Hat Enterprise Linux Desktop (v. 5 client) java-1.7.0-openjdk 1.7.0.95-2.6.4.1.el5_11, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.1.el5_11, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.1.el5_11, java-1.7.0-openjdk-javadoc 1.7.0.95-2.6.4.1.el5_11
    fixed: vendor fix RHSA-2016:0054
show 16 more
  • Red Hat Enterprise Linux Desktop (v. 6) nss 3.19.1-8.el6_7, gnutls 2.8.5-19.el6_7, nss-tools 3.19.1-8.el6_7, openssl 1.0.1e-42.el6_7.2, nss-sysinit 3.19.1-8.el6_7, gnutls-utils 2.8.5-19.el6_7, +3 more Red Hat Enterprise Linux Desktop Optional (v. 6) gnutls-guile 2.8.5-19.el6_7, openssl-perl 1.0.1e-42.el6_7.2, java-1.8.0-openjdk-src 1.8.0.71-1.b15.el6_7, java-1.8.0-openjdk-demo 1.8.0.71-1.b15.el6_7, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el6_7, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el6_7, +2 more
    fixed: vendor fix RHSA-2016:0012
  • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.7.0-ibm 1.7.0.9.30-1jpp.1.el5, java-1.6.0-ibm 1.6.0.16.20-1jpp.1.el5, java-1.7.0-ibm-src 1.7.0.9.30-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.16.20-1jpp.1.el5, java-1.7.0-ibm-demo 1.7.0.9.30-1jpp.1.el5, java-1.7.0-ibm-jdbc 1.7.0.9.30-1jpp.1.el5, +6 more Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm-src 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-jdbc 1.7.1.3.30-1jpp.2.el6_7, +5 more
    fixed: vendor fix RHSA-2016:0101
  • Red Hat Enterprise Linux HPC Node (v. 6) nss 3.19.1-8.el6_7, gnutls 2.8.5-19.el6_7, nss-tools 3.19.1-8.el6_7, openssl 1.0.1e-42.el6_7.2, nss-sysinit 3.19.1-8.el6_7, gnutls-utils 2.8.5-19.el6_7, +3 more Red Hat Enterprise Linux HPC Node Optional (v. 6) gnutls-guile 2.8.5-19.el6_7, openssl-perl 1.0.1e-42.el6_7.2, java-1.8.0-openjdk-src 1.8.0.71-1.b15.el6_7, java-1.8.0-openjdk-demo 1.8.0.71-1.b15.el6_7, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el6_7, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el6_7, +2 more
    fixed: vendor fix RHSA-2016:0012
  • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm-src 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm-demo 1.6.0.16.20-1jpp.1.el6_7, +1 more
    fixed: vendor fix RHSA-2016:0101
  • Red Hat Enterprise Linux Server (v. 6) nss 3.19.1-8.el6_7, gnutls 2.8.5-19.el6_7, nss-tools 3.19.1-8.el6_7, openssl 1.0.1e-42.el6_7.2, nss-sysinit 3.19.1-8.el6_7, gnutls-utils 2.8.5-19.el6_7, +3 more
    fixed: vendor fix RHSA-2016:0012
  • Red Hat Enterprise Linux Server (v. 7) nss 3.19.1-19.el7_2, gnutls 3.3.8-14.el7_2, gnutls-c++ 3.3.8-14.el7_2, nss-tools 3.19.1-19.el7_2, openssl 1.0.1e-51.el7_2.2, gnutls-dane 3.3.8-14.el7_2, +7 more
    fixed: vendor fix RHSA-2016:0054
  • Red Hat Enterprise Linux Server Optional (v. 6) gnutls-guile 2.8.5-19.el6_7, openssl-perl 1.0.1e-42.el6_7.2, java-1.8.0-openjdk-src 1.8.0.71-1.b15.el6_7, java-1.8.0-openjdk-demo 1.8.0.71-1.b15.el6_7, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el6_7, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el6_7, +2 more
    fixed: vendor fix RHSA-2016:0012
  • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.1e-51.el7_2.2, java-1.8.0-openjdk-src 1.8.0.71-2.b15.el7_2, java-1.8.0-openjdk-demo 1.8.0.71-2.b15.el7_2, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el7_2, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el7_2, java-1.8.0-openjdk-javadoc 1.8.0.71-2.b15.el7_2, +3 more
    fixed: vendor fix RHSA-2016:0054
  • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.7.0-ibm 1.7.0.9.30-1jpp.1.el5, java-1.6.0-ibm 1.6.0.16.20-1jpp.1.el5, java-1.7.0-ibm-src 1.7.0.9.30-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.16.20-1jpp.1.el5, java-1.7.0-ibm-demo 1.7.0.9.30-1jpp.1.el5, java-1.7.0-ibm-jdbc 1.7.0.9.30-1jpp.1.el5, +6 more Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm-src 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-jdbc 1.7.1.3.30-1jpp.2.el6_7, +5 more
    fixed: vendor fix RHSA-2016:0101
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.3.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2016:0099
  • Red Hat Enterprise Linux Workstation (v. 6) nss 3.19.1-8.el6_7, gnutls 2.8.5-19.el6_7, nss-tools 3.19.1-8.el6_7, openssl 1.0.1e-42.el6_7.2, nss-sysinit 3.19.1-8.el6_7, gnutls-utils 2.8.5-19.el6_7, +3 more
    fixed: vendor fix RHSA-2016:0012
  • Red Hat Enterprise Linux Workstation (v. 7) nss 3.19.1-19.el7_2, gnutls 3.3.8-14.el7_2, gnutls-c++ 3.3.8-14.el7_2, nss-tools 3.19.1-19.el7_2, openssl 1.0.1e-51.el7_2.2, gnutls-dane 3.3.8-14.el7_2, +7 more
    fixed: vendor fix RHSA-2016:0054
  • Red Hat Enterprise Linux Workstation Optional (v. 6) gnutls-guile 2.8.5-19.el6_7, openssl-perl 1.0.1e-42.el6_7.2, java-1.8.0-openjdk-src 1.8.0.71-1.b15.el6_7, java-1.8.0-openjdk-demo 1.8.0.71-1.b15.el6_7, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el6_7, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el6_7, +2 more
    fixed: vendor fix RHSA-2016:0012
  • Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.1e-51.el7_2.2, java-1.8.0-openjdk-src 1.8.0.71-2.b15.el7_2, java-1.8.0-openjdk-demo 1.8.0.71-2.b15.el7_2, java-1.7.0-openjdk-src 1.7.0.95-2.6.4.0.el7_2, java-1.7.0-openjdk-demo 1.7.0.95-2.6.4.0.el7_2, java-1.8.0-openjdk-javadoc 1.8.0.71-2.b15.el7_2, +3 more
    fixed: vendor fix RHSA-2016:0054
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.2.el6_7, java-1.6.0-ibm-src 1.6.0.16.20-1jpp.1.el6_7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-jdbc 1.7.1.3.30-1jpp.2.el6_7, +5 more
    fixed: vendor fix RHSA-2016:0101
  • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.3.30-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.2.10-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.3.30-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2016:0099

3 more fixed, 5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
25 d ago

Exploit prediction

2.90% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-19 Data Processing Errors

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.