CVE-2014-6593
MediumPublic exploitUnspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
Published Feb 24, 2015 · Updated May 29, 2026 · Also known as UBUNTU-CVE-2014-6593
Key Facts
Patch immediately- CVE-2014-6593 is a medium-severity vulnerability (CVSS 4.0 v2) affecting Jdk (Oracle), Jre (Oracle), Jrockit (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 66% probability of exploitation in the next 30 days.
- Fixed versions are available, including java 1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el5, java 1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el6, java 1.7.0-oracle-1:1.7.0.75-1jpp.2.el7.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
4.0
AV:N/AC:H/Au:N/C:P/I:P/A:N
EPSS (30-day exploit likelihood)
66%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2014-6593 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
Affected Products
105 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JdkOracle | 1.5.0-update75, 1.6.0-update85, 1.7.0-update71, 1.7.0-update72, 1.8.0-update25, 1.8.0-update6 | n/a |
| JreOracle | 1.5.0-update75, 1.6.0-update85, 1.7.0-update71, 1.7.0-update72, 1.8.0-update25, 1.8.0-update6 | n/a |
| JrockitOracle | r27.8.4, r28.3.4 | n/a |
| openjdk-6debian | See advisory | 6b34-1.13.6-1~deb6u1 |
| openjdk-7debian | See advisory | 7u75-2.5.4-1~deb7u1 |
Patched Releases
java
1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el5, 1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el6, 1.7.0-oracle-1:1.7.0.75-1jpp.2.el7
java-1_7_0-openjdk
1.7.0.121-1.1, 1.7.0.71-0.7.1, 1.7.0.75-11.3
java-1_7_0-openjdk-accessibility
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap-devel
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap-headless
1.7.0.121-1.1
java-1_7_0-openjdk-demo
1.7.0.121-1.1, 1.7.0.71-0.7.1, 1.7.0.75-11.3
java-1_7_0-openjdk-devel
1.7.0.121-1.1, 1.7.0.71-0.7.1, 1.7.0.75-11.3
java-1_7_0-openjdk-headless
1.7.0.121-1.1, 1.7.0.75-11.3
java-1_7_0-openjdk-javadoc
1.7.0.121-1.1
java-1_7_0-openjdk-src
1.7.0.121-1.1
java-1.6.0-openjdk
1:1.6.0.34-1.13.6.1.0.1.el5_11, 1:1.6.0.34-1.13.6.1.el6_6, 1:1.6.0.34-1.13.6.1.el7_0, 1:1.6.0.34-67.1.13.6.0.69.amzn1
java-1.6.0-openjdk-demo
1:1.6.0.34-1.13.6.1.0.1.el5_11, 1:1.6.0.34-1.13.6.1.el6_6, 1:1.6.0.34-1.13.6.1.el7_0, 1:1.6.0.34-67.1.13.6.0.69.amzn1
java-1.6.0-openjdk-devel
1:1.6.0.34-1.13.6.1.0.1.el5_11, 1:1.6.0.34-1.13.6.1.el6_6, 1:1.6.0.34-1.13.6.1.el7_0, 1:1.6.0.34-67.1.13.6.0.69.amzn1
java-1.6.0-openjdk-javadoc
1:1.6.0.34-1.13.6.1.0.1.el5_11, 1:1.6.0.34-1.13.6.1.el6_6, 1:1.6.0.34-1.13.6.1.el7_0, 1:1.6.0.34-67.1.13.6.0.69.amzn1
java-1.6.0-openjdk-src
1:1.6.0.34-1.13.6.1.0.1.el5_11, 1:1.6.0.34-1.13.6.1.el6_6, 1:1.6.0.34-1.13.6.1.el7_0, 1:1.6.0.34-67.1.13.6.0.69.amzn1
java-1.7.0-openjdk
1:1.7.0.75-2.5.4.0.0.1.el5_11, 1:1.7.0.75-2.5.4.0.0.1.el6_6, 1:1.7.0.75-2.5.4.0.53.amzn1, 1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.7.0-openjdk-accessibility
1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.7.0-openjdk-demo
1:1.7.0.75-2.5.4.0.0.1.el5_11, 1:1.7.0.75-2.5.4.0.0.1.el6_6, 1:1.7.0.75-2.5.4.0.53.amzn1, 1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.7.0-openjdk-devel
1:1.7.0.75-2.5.4.0.0.1.el5_11, 1:1.7.0.75-2.5.4.0.0.1.el6_6, 1:1.7.0.75-2.5.4.0.53.amzn1, 1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.7.0-openjdk-headless
1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.7.0-openjdk-javadoc
1:1.7.0.75-2.5.4.0.0.1.el5_11, 1:1.7.0.75-2.5.4.0.0.1.el6_6, 1:1.7.0.75-2.5.4.0.53.amzn1, 1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.7.0-openjdk-src
1:1.7.0.75-2.5.4.0.0.1.el5_11, 1:1.7.0.75-2.5.4.0.0.1.el6_6, 1:1.7.0.75-2.5.4.0.53.amzn1, 1:1.7.0.75-2.5.4.2.0.1.el7_0
java-1.8.0-openjdk
1:1.8.0.31-1.b13.el6_6, 1:1.8.0.31-2.b13.5.amzn1
java-1.8.0-openjdk-demo
1:1.8.0.31-1.b13.el6_6, 1:1.8.0.31-2.b13.5.amzn1
Timeline
Publicly disclosed
Feb 24, 2015
Last updated
May 29, 2026
References
- advisoryRHSA-2015:0067
- advisoryRHSA-2015:0068
- advisoryRHSA-2015:0069
- advisoryRHSA-2015:0079
- advisoryRHSA-2015:0080
FAQ
Common Questions.
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
Affected: Jdk (Oracle) versions 1.5.0-update75, 1.6.0-update85, 1.7.0-update71, 1.7.0-update72, 1.8.0-update25, 1.8.0-update6; Jre (Oracle) versions 1.5.0-update75, 1.6.0-update85, 1.7.0-update71, 1.7.0-update72, 1.8.0-update25, 1.8.0-update6; Jrockit (Oracle) versions r27.8.4, r28.3.4, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including java 1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el5, java 1.6.0-ibm-1:1.6.0.16.3-1jpp.1.el6, java 1.7.0-oracle-1:1.7.0.75-1jpp.2.el7.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2014-6593 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo