CVE-2016-3508: Medium severity oracle java se 7 vulnerability
It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.
Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property.
Other sources
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3508?
CVE-2016-3508 has a moderate severity rating due to its potential to consume excessive memory and CPU resources.
How do I fix CVE-2016-3508?
To fix CVE-2016-3508, users should update to the latest versions of affected JDK and JRE releases as provided by Oracle.
What types of systems are affected by CVE-2016-3508?
CVE-2016-3508 affects various versions of Oracle JDK, JRE, and Oracle Linux.
What are the potential risks of CVE-2016-3508?
The risks of CVE-2016-3508 include possible denial of service due to excessive resource consumption during XML parsing.
How can I identify if my system is vulnerable to CVE-2016-3508?
To identify vulnerability to CVE-2016-3508, check if your system is running any affected versions of Oracle JDK or JRE.