CVE-2016-3500: Medium severity oracle linux vulnerability
It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.
Other sources
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3500?
CVE-2016-3500 has been rated with a severity level that can potentially affect system availability.
How do I fix CVE-2016-3500?
To fix CVE-2016-3500, update your Oracle Java SE or Oracle JRockit to the latest version available.
Which versions of software are affected by CVE-2016-3500?
CVE-2016-3500 affects Oracle Java SE versions 6u115, 7u101, 8u92, Java SE Embedded 8u91, and JRockit R28.3.10.
Can CVE-2016-3500 lead to remote attacks?
Yes, CVE-2016-3500 allows remote attackers to potentially affect availability through unspecified vectors related to JAXP.
Is CVE-2016-3500 related to other vulnerabilities?
CVE-2016-3500 is a different vulnerability than CVE-2016-3508, although both affect Oracle Java software components.