VDB
BDU%3A2025-09248
BDU%3A2025-09248
PUBLISHED
CVSS 7.300000190734863 HIGH
Уязвимость фреймворка Sparkle программной платформы Oracle Java SE, связанная с раскрытием файлов или каталогов внешним сторонам, позволяющая нарушителю обойти проверку подписи (Ed)DSA и получить полный контроль над приложением
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| sparkle-project | Sparkle | 0 |
| Oracle Corp., Сообщество свободного программного обеспечения | Java SE, Sparkle |
Timeline
- Feb 4, 2025 CVE Published
- Feb 4, 2025 PoC Published
- Feb 4, 2025 PoC Published
- Feb 4, 2025 PoC Published
- Feb 4, 2025 PoC Published
- Jul 31, 2025 CVE Updated
References
- https://sparkle-project.org/documentation/security-and-reliability/ url
- https://security.netapp.com/advisory/ntap-20250124-0008/ url
- https://www.oracle.com/security-alerts/cpujan2025verbose.html advisory
- https://www.oracle.com/security-alerts/cpujan2025.html advisory
- https://github.com/sparkle-project/Sparkle/pull/2550 url
- https://github.com/sparkle-project/Sparkle/releases/tag/2.6.4 advisory