CVE-2016-3587: Critical severity oracle linux vulnerability

Published Jul 15, 2016

Updated

It was discovered that the Hotspot component of OpenJDK did not properly restrict access to the invokeBasic() method of the MethodHandle class. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

— MITRE

Affected Software

6 affected components

ORACLE Linux=6

ORACLE Linux=7

Oracle JDK=1.8.0-update91

Oracle JDK=1.8.0-update92

ORACLE JRE=1.8.0-update91

ORACLE JRE=1.8.0-update92

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Event History

Jul 15, 2016

Data Sourced

via Red Hat·12:34 PM

DescriptionSeverityAffected Software

Jul 21, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3587?

CVE-2016-3587 has been classified as a high-severity vulnerability affecting confidentiality, integrity, and availability.

How do I fix CVE-2016-3587?

To fix CVE-2016-3587, update Oracle Java SE to the latest versions available that address this vulnerability.

What versions of Oracle Java are affected by CVE-2016-3587?

CVE-2016-3587 affects Oracle Java SE 8u92, and Java SE Embedded 8u91, among others.

Can CVE-2016-3587 be exploited remotely?

Yes, CVE-2016-3587 allows remote attackers to exploit the vulnerability.

What component of OpenJDK is involved in CVE-2016-3587?

The Hotspot component of OpenJDK is involved in the CVE-2016-3587 vulnerability.