CVE-2016-0494: Critical severity ubuntu vulnerability
Integer signedness issues were discovered in IndicRearrangementProcessor and IndicRearrangementProcessor2 in the ICU Layout Engine. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code.
ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to execute arbitrary code with Java Virtual Machine privileges and bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0494?
CVE-2016-0494 is rated as a critical vulnerability affecting confidentiality, integrity, and availability in certain Oracle Java SE versions.
How do I fix CVE-2016-0494?
To fix CVE-2016-0494, you should update your Oracle Java SE or JRE to the latest version available, which contains the necessary patches.
Which software versions are affected by CVE-2016-0494?
CVE-2016-0494 affects Oracle Java SE versions 6u105, 7u91, 8u66, and specific Ubuntu Linux distributions such as 12.04, 14.04, 15.04, and 15.10.
Can CVE-2016-0494 be exploited remotely?
Yes, CVE-2016-0494 can be exploited remotely by attackers leveraging unknown vectors in the 2D component of Oracle Java.
What types of systems are impacted by CVE-2016-0494?
CVE-2016-0494 impacts systems running Oracle Java SE or JRE, particularly those in certain versions of Ubuntu Linux.