WaratekVRT Sign in

Oracle Critical Patch Update April 2015

Released April 2015 · Oracle's advisory ↗ · ← Critical Patch Update, January 2015 · Critical Patch Update, July 2015 →

93 CVEs in this release, one square each

Mitigation candidateMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update April 2015, one square per CVE: 34 Java CVEs, 2 exploited, 59 other CVEs in this release.

Download the image

By status

3Mitigation candidate31No exploit published27Outside Waratek scope32Not applicable 2Exploited, marked by the ring

No exploit published. For 29 of them, Oracle's security advisory is the source of public detail.

Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Protection: None✕
Overview 32 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
32matches 0in Waratek scope0.0% 0protected0.0% 1exploited3.1% 0CISA KEV0.0% 2public PoC6.2% 1EPSS ≥ 0.53.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 32 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 12.5% Medium 18 56.2% Low 10 31.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 32 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 3.1% Working exploit published 1 3.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 30 93.8%
split by peak 27 / month
Not applicable: 32 Low: 10Medium: 18High: 4 not blocked: 32 No public exploit: 30Working exploit published: 1Exploited: 1
Nov 131 Not applicable1 Medium1 not blocked1 No public exploit1 Dec 130 Jan 140 Feb 140 Mar 140 Apr 140 May 140 Jun 140 Jul 140 Aug 140 Sep 141 Not applicable1 High1 not blocked1 No public exploit1 Oct 140 Nov 140 Dec 141 Not applicable1 Medium1 not blocked1 No public exploit1 Jan 152 Not applicable2 Medium2 not blocked2 Exploited1 No public exploit1 Feb 150 Mar 150 Apr 1527 Not applicable27 High3 Medium14 Low10 not blocked27 Working exploit published1 No public exploit26
Dec 13Feb 14Apr 14Jun 14Aug 14Oct 14Dec 14Feb 15Apr 15
32 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2015-2578 High 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 11.2 allows remote attackers to affect availability via vectors related to Kernel IDMap.
CVE-2015-2577 High 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Accounting commands.
CVE-2015-2576 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.
CVE-2015-2575 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.
CVE-2015-2574 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality via unknown vectors related to Text Utilities.
CVE-2015-2573 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
CVE-2015-2572 Medium 2015-04-16 Not applicable Working exploit published Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
CVE-2015-2571 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.
CVE-2015-2567 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
CVE-2015-2566 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via vectors related to DML.
CVE-2015-0511 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP.
CVE-2015-0508 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.
CVE-2015-0507 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.
CVE-2015-0506 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508.
CVE-2015-0505 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
CVE-2015-0503 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
CVE-2015-0499 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated.
CVE-2015-0498 Low 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.
CVE-2015-0476 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in the SQL Trace Analyzer component in Oracle Support Tools before 12.1.11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVE-2015-0471 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libelfsign.
CVE-2015-0452 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in the Oracle VM Server for SPARC component in Oracle Sun Systems Products Suite 3.1 and 3.2 allows remote attackers to affect confidentiality via unknown vectors related to Ldom Manager.
CVE-2015-0448 High 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to ZFS File system.
CVE-2015-0441 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption.
CVE-2015-0440 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in the Oracle Knowledge component in Oracle Right Now Service Cloud 8.2.3.10.1 and 8.4.7.2 allows remote attackers to affect integrity via unknown vectors related to Information Manager Console.
CVE-2015-0439 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.
CVE-2015-0438 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
CVE-2015-0405 Medium 2015-04-16 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
CVE-2015-0204 Medium 2015-01-09 Not applicable Exploited The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.
CVE-2014-3571 Medium 2015-01-09 Not applicable No public exploit OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.
CVE-2014-3569 Medium 2014-12-24 Not applicable No public exploit The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.
CVE-2014-1568 High 2014-09-25 Not applicable No public exploit Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
CVE-2013-4545 Medium 2013-11-23 Not applicable No public exploit cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.