CVE-2016-0402: Medium severity Canonical Ubuntu Linux vulnerability
A flaw was found in the deserialization of the URL class in the Networking component of OpenJDK. Deserialization of the specially crafted data could result in creation of the URL object with an inconsistent state. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0402?
CVE-2016-0402 is considered to have a medium severity rating since it affects the integrity of the system.
How do I fix CVE-2016-0402?
To address CVE-2016-0402, update your Oracle Java SE or Java SE Embedded installations to the latest version available.
What software is affected by CVE-2016-0402?
CVE-2016-0402 affects Oracle Java SE versions 6u105, 7u91, and 8u66, as well as various Ubuntu Linux versions.
Can CVE-2016-0402 be exploited remotely?
Yes, CVE-2016-0402 can potentially be exploited by remote attackers due to its network-related vulnerabilities.
Is there a workaround for CVE-2016-0402?
While the best approach is to update the affected software, limiting network access may serve as a temporary workaround for CVE-2016-0402.