Oracle Java SE 8u431 Install file access

Summaryinfo

A vulnerability has been found in Oracle Java SE 8u431 and classified as problematic. This vulnerability affects unknown code of the component Install. The manipulation leads to Remote Code Execution. This vulnerability is traded as CVE-2025-0509. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Oracle Java SE 8u431. It has been rated as problematic. This issue affects an unknown part of the component Install. The manipulation with an unknown input leads to a remote code execution vulnerability. Using CWE to declare the problem leads to CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

It is possible to read the advisory at oracle.com. The identification of this vulnerability is CVE-2025-0509 since 01/15/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/31/2025). The attack technique deployed by this issue is T1083 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 214532 (Oracle Java SE Multiple Vulnerabilities (January 2025 CPU)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (214532) and CERT Bund (WID-SEC-2025-0140). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Xerox FreeFlow Print Server
• Oracle Linux
• Hitachi Configuration Manager
• SUSE openSUSE
• RESF Rocky Linux
• NetApp ActiveIQ Unified Manager
• IBM App Connect Enterprise
• Azul Zulu
• Dell NetWorker
• Hitachi Command Suite
• Hitachi Ops Center
• Dell Avamar
• Oracle Java SE
• Oracle GraalVM
• HCL BigFix

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

Version

• 8u431

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion