Oracle Critical Patch Update October 2015
Released October 2015 · Oracle's advisory ↗ · ← Critical Patch Update, July 2015 · Critical Patch Update, January 2016 →
140 CVEs in this release, one square each
By status
8Protected by Waratek3Mitigation candidate44No exploit published34Outside Waratek scope51Not applicable
1Exploited, marked by the ring
No exploit published. For 44 of them, Oracle's security advisory is the source of public detail.
Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.
Overview 18 matches · 2 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
Protected by Waratek
2
11.1%
Rule in development
0
0.0%
Mitigation candidate
3
16.7%
No exploit published
13
72.2%
blocked by ARMR today
2
11.1%
partly blocked
0
0.0%
not blocked
16
88.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
4
22.2%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
14
77.8%
split by
peak 15 / quarter
Q2 101
Protected by Waratek1
Medium1
blocked by ARMR today1
Working exploit published1
Q3 100
Q4 100
Q1 110
Q2 110
Q3 110
Q4 110
Q1 120
Q2 120
Q3 120
Q4 120
Q1 130
Q2 130
Q3 130
Q4 130
Q1 140
Q2 141
Mitigation candidate1
High1
not blocked1
Working exploit published1
Q3 140
Q4 140
Q1 150
Q2 150
Q3 151
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Q4 1515
Mitigation candidate2
No exploit published13
Medium9
Low6
not blocked15
Working exploit published2
No public exploit13
Q2 10Q4 10Q2 11Q4 11Q2 12Q4 12Q2 13Q4 13Q2 14Q4 14Q2 15Q4 15
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2015-4914 | Low | 2015-10-22 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Listener. |
| CVE-2015-4912 | Medium | 2015-10-22 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via vectors related to SSO Engine. |
| CVE-2015-4909 | Medium | 2015-10-22 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote attackers to affect integrity via vectors related to ADF Faces. |
| CVE-2015-4899 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality via unknown vectors related to Security. |
| CVE-2015-4880 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867. |
| CVE-2015-4878 | Low | 2015-10-21 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4877. |
| CVE-2015-4877 | Low | 2015-10-21 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4878. |
| CVE-2015-4867 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4880. |
| CVE-2015-4838 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces. |
| CVE-2015-4832 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.7, 11.1.2.2, and 11.1.2.3 allows remote attackers to affect integrity via vectors related to OIM Legacy UI. |
| CVE-2015-4812 | Low | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 allows remote attackers to affect confidentiality via vectors related to OSSL Module. |
| CVE-2015-4811 | Low | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDKutside In PDF Export SDK, a different vulnerability than CVE-2015-4809. |
| CVE-2015-4809 | Low | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDK, a different vulnerability than CVE-2015-4811. |
| CVE-2015-4799 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.1, and 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Security. |
| CVE-2015-1829 | Medium | 2015-10-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener. |
| CVE-2014-3576 | High | 2015-08-14 | Protected by Waratek | No public exploit | The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command. |
| CVE-2014-0050 | High | 2014-04-01 | Mitigation candidate | Working exploit published | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. |
| CVE-2010-1622 | Medium | 2010-06-21 | Protected by Waratek | Working exploit published | SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file. |