CVE-2016-0466: Medium severity Canonical Ubuntu Linux vulnerability
It was discovered that the JAXP component of OpenJDK did not properly count total size of the expanded general entities and therefore did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application parse a specially crafted XML file could use this flaw to make the application use and excessive amount of memory and possibly exit on out of memory condition.
JAXP XML parsing limits are described on the following page:
https://docs.oracle.com/javase/tutorial/jaxp/limits/limits.html
Other sources
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0466?
CVE-2016-0466 is rated as a moderate severity vulnerability allowing remote attackers to affect availability.
How do I fix CVE-2016-0466?
To fix CVE-2016-0466, upgrade to a newer version of Oracle Java SE or JRockit that addresses this vulnerability.
What components are affected by CVE-2016-0466?
CVE-2016-0466 affects the Java SE, Java SE Embedded, and JRockit components of Oracle Java.
What versions of Java are vulnerable to CVE-2016-0466?
Oracle Java SE versions 6u105, 7u91, and 8u66, along with Java SE Embedded 8u65 and JRockit R28.3.8 are vulnerable.
What is the impact of CVE-2016-0466 on affected systems?
CVE-2016-0466 can impact the availability of systems running the affected versions of Java.