CVE-2016-3550: Integer Overflow

Published Jul 18, 2016

Updated

Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.

— MITRE

Affected Software

11 affected components

ORACLE Linux=5.0

ORACLE Linux=6

ORACLE Linux=7

Oracle JDK=1.6.0-update115

Oracle JDK=1.7.0-update101

Oracle JDK=1.8.0-update91

Oracle JDK=1.8.0-update92

ORACLE JRE=1.6.0-update115

ORACLE JRE=1.7.0-update101

ORACLE JRE=1.8.0-update91

ORACLE JRE=1.8.0-update92

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Event History

Jul 18, 2016

Data Sourced

via Red Hat·11:53 AM

DescriptionSeverityAffected Software

Jul 21, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3550?

CVE-2016-3550 is considered a high-severity vulnerability due to its potential to compromise confidentiality.

How do I fix CVE-2016-3550?

To fix CVE-2016-3550, update your Oracle Java SE to the latest version that addresses this vulnerability.

What software is affected by CVE-2016-3550?

CVE-2016-3550 affects Oracle Java SE 6u115, 7u101, 8u92 and Java SE Embedded 8u91, along with specific Oracle Linux versions.

What type of vulnerability is CVE-2016-3550?

CVE-2016-3550 is classified as an integer overflow vulnerability found in the Hotspot component of OpenJDK.

Can CVE-2016-3550 be exploited remotely?

Yes, CVE-2016-3550 can be exploited remotely, impacting the confidentiality of affected users.