WaratekVRT Sign in

Oracle Critical Patch Update January 2025

Released January 2025 · Oracle's advisory ↗ · ← Critical Patch Update, October 2024 · Critical Patch Update, April 2025 →

253 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidate, exploitedMitigation candidate, exploitedMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicable, exploitedNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update January 2025, one square per CVE: 103 Java CVEs, 13 protected by Waratek, 11 exploited, 150 other CVEs in this release.

Download the image

By status

13Protected by Waratek4Mitigation candidate86No exploit published17Outside Waratek scope133Not applicable 11Exploited, marked by the ring

No exploit published. For 48 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Overview 103 matches · 13 protected · 6 exploited · 2 CISA KEV · 9 public PoC · 5 EPSS ≥ 0.5
103matches 13protected12.6% 6exploited5.8% 2CISA KEV1.9% 9public PoC8.7% 5EPSS ≥ 0.54.9%
Protected by Waratek 13 12.6% Rule in development 0 0.0% Mitigation candidate 4 3.9% No exploit published 86 83.5%
Critical 11 10.7% High 37 35.9% Medium 54 52.4% Low 1 1.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 13 12.6% partly blocked 0 0.0% not blocked 90 87.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 5.8% Working exploit published 1 1.0% Proof of concept only 7 6.8% Forecast only 0 0.0% No public exploit 89 86.4%
split by peak 45 / quarter
No exploit published: 86Mitigation candidate: 4Protected by Waratek: 13 Low: 1Medium: 54High: 37Critical: 11 not blocked: 90blocked by ARMR today: 13 No public exploit: 89Proof of concept only: 7Working exploit published: 1Exploited: 6
Q3 191 No exploit published1 Medium1 not blocked1 No public exploit1 Q4 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q1 201 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q2 201 No exploit published1 High1 not blocked1 No public exploit1 Q3 200 Q4 202 No exploit published2 High2 not blocked2 No public exploit2 Q1 211 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 213 Protected by Waratek1 No exploit published2 High2 Medium1 blocked by ARMR today1 not blocked2 No public exploit3 Q3 210 Q4 210 Q1 220 Q2 220 Q3 222 Protected by Waratek1 No exploit published1 High2 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 Q4 220 Q1 231 No exploit published1 High1 not blocked1 No public exploit1 Q2 231 No exploit published1 High1 not blocked1 No public exploit1 Q3 232 Protected by Waratek1 No exploit published1 High1 Medium1 blocked by ARMR today1 not blocked1 No public exploit2 Q4 235 Protected by Waratek1 Mitigation candidate1 No exploit published3 Critical1 High1 Medium3 blocked by ARMR today1 not blocked4 Exploited2 No public exploit3 Q1 2410 Mitigation candidate1 No exploit published9 High4 Medium6 not blocked10 Proof of concept only3 No public exploit7 Q2 247 No exploit published7 High6 Medium1 not blocked7 No public exploit7 Q3 246 Protected by Waratek2 No exploit published4 High5 Medium1 blocked by ARMR today2 not blocked4 Exploited1 No public exploit5 Q4 2414 Protected by Waratek3 Mitigation candidate2 No exploit published9 Critical4 High1 Medium8 Low1 blocked by ARMR today3 not blocked11 Exploited2 Working exploit published1 Proof of concept only2 No public exploit9 Q1 2545 Protected by Waratek1 No exploit published44 Critical4 High10 Medium31 blocked by ARMR today1 not blocked44 Exploited1 No public exploit44
Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25
103 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-1000027 Critical 2020-01-02 Protected by Waratek Proof of concept only Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVE-2019-12415 Medium 2019-10-23 Protected by Waratek No public exploit In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
CVE-2019-16370 Medium 2019-09-16 No exploit published No public exploit The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
‹ prev page 2 of 2 next ›