CVE-2016-0686: Critical severity oracle java se 7 vulnerability
It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0686?
CVE-2016-0686 is classified as a high severity vulnerability due to its potential to allow untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2016-0686?
To fix CVE-2016-0686, update to the latest version of the Oracle JDK or JRE that contains the security patch addressing this vulnerability.
Which software versions are affected by CVE-2016-0686?
CVE-2016-0686 affects Oracle JDK versions 1.6.0-update113, 1.7.0-update99, and 1.8.0-update77 as well as corresponding Oracle JRE versions.
What kind of exploit is possible with CVE-2016-0686?
An attacker could exploit CVE-2016-0686 to perform unauthorized operations by sending crafted serialized data to an untrusted Java application.
Is CVE-2016-0686 only a concern for enterprise environments?
CVE-2016-0686 can impact any environment running the affected versions of Oracle JDK or JRE, making it a concern for both enterprise and personal systems.