CVE-2016-0483: Buffer Overflow
It was discovered that the JPEG decoder in the AWT component of OpenJDK did not use correct buffer boundary in certain cases when decoding JPEG files. A specially crafted JPEG file could cause a Java application to corrupt its memory and possibly execute arbitrary code when opened. An untrusted Java application or applet could also use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0483?
CVE-2016-0483 has a high severity rating as it can affect confidentiality, integrity, and availability.
How do I fix CVE-2016-0483?
To fix CVE-2016-0483, update Oracle Java SE to the latest version provided by Oracle.
What versions of software are affected by CVE-2016-0483?
CVE-2016-0483 affects Oracle Java SE 6u105, 7u91, 8u66 and Java SE Embedded 8u65 as well as JRockit R28.3.8.
Can CVE-2016-0483 be exploited remotely?
Yes, CVE-2016-0483 can be exploited remotely by attackers via specific vectors related to AWT.
What is the impact of CVE-2016-0483 on systems?
The impact of CVE-2016-0483 can lead to potential unauthorized access or manipulation of system resources.