JdkApplication · Oracle

CVE-2015-2628

HIGH · 10.0 CVSS v2.0 Published 2015-07-16

Patch available

A vendor patch is available. No clean upgrade release — apply the published patch.

See remediation →

100/100

Remediation priority · Urgent

Remotely reachable No privileges Zero-click Patch available

Official description

NVD · unedited

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

Technical summary

dbcve analysis · moderate confidence

Remote code execution vulnerability in the CORBA (Common Object Request Broker Architecture) component of Oracle Java SE versions 6u95, 7u80, 8u45 and Java SE Embedded 7u75/8u33. The CVSS 10 score and impact to confidentiality, integrity, and availability indicates unauthenticated remote attackers can execute arbitrary code via specially crafted CORBA network requests.

MitigationUpgrade to Oracle Java SE versions that include the security fix for this CORBA vulnerability (newer than the affected versions listed) or apply the corresponding Oracle Critical Patch Update. For systems not requiring CORBA, consider disabling or removing the CORBA module as a defense-in-depth measure.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions

NVD · CPE data

JdkApplication

Affected:= 1.6.0= 1.7.0= 1.8.0

JreApplication

Affected:= 1.6.0= 1.7.0= 1.8.0

CVSS breakdown

From the vector

Attack vector: Network
Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Am I affected?

dbcve checks

Work through these to decide whether this CVE applies to you.

Verify Java is installed

Run 'java -version' or 'java -help' from command line. On Windows, also check Registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit or HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.

Affected if No Java installation found means this CVE does not apply.
Get installed Java version

Run 'java -version' and capture the full version string (e.g., 1.8.0_45). Also use 'java -fullversion' if available. For multiple Java installations, check each via JAVA_HOME environment variable or by specifying full path.

Affected if The installed version falls within: Java 6 (all versions up to 6u95), Java 7 (all versions up to 7u80), Java 8 (all versions up to 8u45), Java SE Embedded 7u75 or 8u33.
Confirm CORBA component is present

Check if the CORBA module exists in the JRE/JDK. Look for 'jacorb.jar' or 'orb.jar' in the Java lib directory (typically $JAVA_HOME/jre/lib or $JAVA_HOME/lib), or attempt to load the org.omg.CORBA classes: compile a simple test with 'import org.omg.CORBA.*;' to verify the CORBA package is available on the classpath.

Affected if CORBA module is not present means the specific attack surface for this CVE does not exist, though other attack vectors may remain.
Check if CORBA is in use or enabled

Review application configurations, deployment descriptors, or Java policy files for CORBA-related settings. Examine any 'ior.config' or 'NamingService' configurations. Check application logs for CORBA-related activity. On application servers, list enabled Java modules or services.

Affected if CORBA functionality is actively used or enabled increases the likelihood of successful exploitation if a vulnerable version is present.

You are affected if you have any Oracle Java SE version 6u95 or earlier, 7u80 or earlier, 8u45 or earlier (or Embedded 7u75/8u33) installed AND the CORBA component is present and accessible on your system.

Generated from the published advisory. Verify against your own configuration.

Remediation

dbcve · scoped

Patch available Apply the vendor patch

Vendor patch www.oracle.com →

Interim mitigation

Upgrade to Oracle Java SE versions that include the security fix for this CORBA vulnerability (newer than the affected versions listed) or apply the corresponding Oracle Critical Patch Update. For systems not requiring CORBA, consider disabling or removing the CORBA module as a defense-in-depth measure.

Recommended fix High confidence

Java SE 6u95+/7u80+/8u45+ (or migrate to currently supported Java versions 11/17/21)

1. Identify the currently installed Java version by running 'java -version'
2. For Java 6u users: upgrade to Java SE 6u95 or later (or migrate to Java 7u80+/8u45+ as Java 6 is End of Life)
3. For Java 7u users: upgrade to Java SE 7u80 or later
4. For Java 8u users: upgrade to Java SE 8u45 or later
5. Download the appropriate fixed JDK/JRE from Oracle's official download page or your distribution's vendor repository
6. Install the updated Java version following standard installation procedures
7. Verify the installation by running 'java -version' and confirm it shows the updated version number
8. Update JAVA_HOME environment variable to point to the new installation path if necessary

Caveat Upgrading Java versions may introduce compatibility issues with existing applications; testing in a non-production environment is recommended before deployment

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Jdk Scoped from the published advisory

Consultation2.0 h
Implementation4.0 h
Testing8.0 h
Review / QA2.0 h

16.0 hours of engineering $2,680

Get the patch applied

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,288.

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2015-2628 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2015-2628 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2015-2628?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsA vendor remedy is published

Severity 10.0 High

Exploit likelihood EPSS, next 30 days 6.2%

Affects: Jdk

Remediation

A high-priority fix

Fix this in Jdk 16 hrs · Moderate

Typical engagement from $2,680

Get a fix See the full breakdown ↓

A high-priority vulnerability. Send your environment and a specialist will scope CVE-2015-2628 and return a fixed quote and timeline.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

Check your environment

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

Affected products & versions

CVSS breakdown

Am I affected?

Remediation

References