CVE-2014-6593
CVE-2014-6593 is a medium-severity vulnerability in Oracle Jrockit with a CVSS 2.0 base score of 4.0. Its EPSS exploit-prediction score of 67% places it in the 99th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.0)
- EPSS exploit prediction: 67% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Oracle Jrockit
- Published:
- Last modified:
Description
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
Frequently asked questions
- What is CVE-2014-6593?
- Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
- How severe is CVE-2014-6593?
- CVE-2014-6593 has a CVSS 2.0 base score of 4.0, rated medium severity.
- Is CVE-2014-6593 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 67% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-6593?
- CVE-2014-6593 primarily affects Oracle Jrockit. In total, 14 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-6593?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-6593 published?
- CVE-2014-6593 was published on 2015-01-21 and last updated on 2026-06-17.
References
- http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html
- http://marc.info/?l=bugtraq&m=142496355704097&w=2
- http://marc.info/?l=bugtraq&m=142607790919348&w=2
- http://packetstormsecurity.com/files/134251/Java-Secure-Socket-Extension-JSSE-SKIP-TLS.html
- http://rhn.redhat.com/errata/RHSA-2015-0068.html
- http://rhn.redhat.com/errata/RHSA-2015-0079.html
- http://rhn.redhat.com/errata/RHSA-2015-0080.html
- http://rhn.redhat.com/errata/RHSA-2015-0085.html
- http://rhn.redhat.com/errata/RHSA-2015-0086.html
- http://rhn.redhat.com/errata/RHSA-2015-0136.html
- http://rhn.redhat.com/errata/RHSA-2015-0264.html
- http://www.debian.org/security/2015/dsa-3144
- http://www.debian.org/security/2015/dsa-3147
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.securityfocus.com/bid/72169
- http://www.securitytracker.com/id/1031580
- http://www.ubuntu.com/usn/USN-2486-1
- http://www.ubuntu.com/usn/USN-2487-1
- http://www.vmware.com/security/advisories/VMSA-2015-0003.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10104
- https://security.gentoo.org/glsa/201507-14
- https://security.gentoo.org/glsa/201603-14
- https://www-304.ibm.com/support/docview.wss?uid=swg21695474
- https://www.exploit-db.com/exploits/38641/
Affected products (14)
- cpe:2.3:a:oracle:jrockit:r27.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jrockit:r28.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.5.0:update75:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.6.0:update85:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update71:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update72:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.8.0:update25:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.8.0:update6:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.5.0:update75:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.6.0:update85:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update71:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update72:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.8.0:update25:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.8.0:update6:*:*:*:*:*:*
More vulnerabilities in Oracle Jrockit
- CVE-2016-0483 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows…
- CVE-2014-2421 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows…
- CVE-2014-0457 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE…
- CVE-2014-0456 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to…
- CVE-2014-0429 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE…
- CVE-2013-5907 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45;…