CVE-2016-3425: Medium severity oracle java se 7 vulnerability

Published Apr 18, 2016

Updated

It was discovered that the JAXP (Java API for XML Processing) component of OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. A specially-crafted XML input could cause a Java application to use an excessive amount of memory when parsed.

Other sources

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP.

— MITRE

Affected Software

7 affected components

Oracle JDK=1.6.0-update113

Oracle JDK=1.7.0-update99

Oracle JDK=1.8.0-update77

ORACLE JRE=1.6.0-update113

ORACLE JRE=1.7.0-update99

ORACLE JRE=1.8.0-update77

ORACLE Jrockit=r28.3.9

Event History

Apr 18, 2016

Data Sourced

09:46 AM

DescriptionSeverityAffected Software

Apr 21, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3425?

CVE-2016-3425 is rated as medium severity due to its potential to cause excessive memory consumption.

How do I fix CVE-2016-3425?

To fix CVE-2016-3425, upgrade to the latest version of OpenJDK or Oracle JDK that addresses this vulnerability.

Which versions are affected by CVE-2016-3425?

CVE-2016-3425 affects Oracle JDK and JRE versions 1.6.0-update113, 1.7.0-update99, and 1.8.0-update77.

What impact does CVE-2016-3425 have on applications?

CVE-2016-3425 can lead to denial of service due to excessive memory usage when processing specially-crafted XML input.

Is CVE-2016-3425 specific to any particular Java implementation?

CVE-2016-3425 specifically affects Oracle's OpenJDK and JRE implementations, including BEA JRockit.