WaratekVRT Sign in

Oracle Critical Patch Update October 2016

Released October 2016 · Oracle's advisory ↗ · ← Critical Patch Update, July 2016 · Critical Patch Update, January 2017 →

205 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableWithdrawn CVEWithdrawn CVE
Share this chart Oracle Critical Patch Update October 2016, one square per CVE: 96 Java CVEs, 7 protected by Waratek, 4 exploited, 109 other CVEs in this release.

Download the image

By status

7Protected by Waratek2Mitigation candidate87No exploit published39Outside Waratek scope68Not applicable2Withdrawn CVE 4Exploited, marked by the ring

No exploit published. For 83 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 205 matches · 96 in Waratek scope · 7 protected · 4 exploited · 1 CISA KEV · 11 public PoC · 10 EPSS ≥ 0.5
205matches 96in Waratek scope46.8% 7protected3.4% 4exploited2.0% 1CISA KEV0.5% 11public PoC5.4% 10EPSS ≥ 0.54.9%
Protected by Waratek 7 3.4% Rule in development 0 0.0% Mitigation candidate 2 1.0% No exploit published 87 42.4% Outside Waratek scope 39 19.0% Not applicable 68 33.2% Withdrawn CVE 2 1.0%
Critical 13 6.3% High 59 28.8% Medium 115 56.1% Low 16 7.8% None 0 0.0% Unknown 2 1.0%
blocked by ARMR today 7 3.4% partly blocked 0 0.0% not blocked 198 96.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 2.0% Working exploit published 7 3.4% Proof of concept only 0 0.0% Forecast only 2 1.0% No public exploit 192 93.7%
split by peak 159 / quarter
Withdrawn CVE: 2Not applicable: 68Outside Waratek scope: 39No exploit published: 87Mitigation candidate: 2Protected by Waratek: 7 Unknown: 2Low: 16Medium: 115High: 59Critical: 13 not blocked: 198blocked by ARMR today: 7 No public exploit: 192Forecast only: 2Working exploit published: 7Exploited: 4
Q1 131 Outside Waratek scope1 Medium1 not blocked1 Forecast only1 Q2 131 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Q3 130 Q4 130 Q1 144 Protected by Waratek1 No exploit published1 Outside Waratek scope2 Medium4 blocked by ARMR today1 not blocked3 No public exploit4 Q2 146 Protected by Waratek2 Mitigation candidate1 No exploit published2 Outside Waratek scope1 High2 Medium4 blocked by ARMR today2 not blocked4 Exploited1 Working exploit published1 No public exploit4 Q3 141 No exploit published1 Medium1 not blocked1 No public exploit1 Q4 142 Outside Waratek scope1 Not applicable1 Medium2 not blocked2 No public exploit2 Q1 159 Outside Waratek scope6 Not applicable3 High3 Medium6 not blocked9 Working exploit published1 No public exploit8 Q2 155 Outside Waratek scope4 Not applicable1 Medium5 not blocked5 No public exploit5 Q3 152 Outside Waratek scope2 Critical1 Medium1 not blocked2 Working exploit published1 No public exploit1 Q4 152 Outside Waratek scope2 Medium2 not blocked2 No public exploit2 Q1 163 Outside Waratek scope3 High2 Medium1 not blocked3 No public exploit3 Q2 163 Protected by Waratek1 Not applicable2 High2 Medium1 blocked by ARMR today1 not blocked2 Exploited1 Working exploit published1 No public exploit1 Q3 165 Protected by Waratek1 Outside Waratek scope1 Not applicable3 Critical1 High4 blocked by ARMR today1 not blocked4 Exploited1 Forecast only1 No public exploit3 Q4 16159 Protected by Waratek1 Mitigation candidate1 No exploit published83 Outside Waratek scope15 Not applicable57 Withdrawn CVE2 Critical10 High45 Medium86 Low16 Unknown2 blocked by ARMR today1 not blocked158 Working exploit published3 No public exploit156 Q1 171 Not applicable1 High1 not blocked1 No public exploit1 Q2 170 Q3 170 Q4 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
Q2 13Q4 13Q2 14Q4 14Q2 15Q4 15Q2 16Q4 16Q2 17Q4 17
205 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2013-4590 Medium 2014-02-26 Protected by Waratek No public exploit Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2013-4322 Medium 2014-02-26 No exploit published No public exploit Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
CVE-2013-4286 Medium 2014-02-26 Outside Waratek scope No public exploit Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
CVE-2013-2067 Medium 2013-06-01 Outside Waratek scope No public exploit java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
CVE-2013-2566 Medium 2013-03-15 Outside Waratek scope Forecast only The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
‹ prev page 3 of 3 next ›