Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Oracle Java SE and JRockit can be crashed remotely

CVE-2015-0488 · published 11 years ago
Summary

Certain older versions of Oracle Java SE (5.0u81, 6u91, 7u76, 8u40) and JRockit (R28.3.5) contain a flaw that could let an attacker cause the program to stop working, impacting its availability. The problem is linked to the component that manages encrypted network connections. Apply the latest security updates from Oracle or upgrade to a supported Java release to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle jrockit r28.3.5
cpe:2.3:a:oracle:jrockit:r28.3.5:*:*:*:*:*:*:*
oracle jdk 1.5.0
1.6.0
1.7.0
1.8.0
cpe:2.3:a:oracle:jdk:1.5.0:update8:*:*:*:*:*:*
oracle jre 1.5.0
1.6.0
1.7.0
1.8.0
cpe:2.3:a:oracle:jre:1.5.0:update81:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.
Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
4% chance of attack within 30 days
Timeline
Published16 Apr 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-0488 · NVD
Track software like this
Free during beta