CVE-2016-3598: Critical severity oracle java se 7 vulnerability
Published Jul 15, 2016
·Updated
A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.
— MITRE
Affected Software
7 affected components
Oracle JDK=1.8.0-update91
Oracle JDK=1.8.0-update92
ORACLE JRE=1.8.0-update91
ORACLE JRE=1.8.0-update92
ORACLE Linux=5.0
ORACLE Linux=6
ORACLE Linux=7
Remediation
Event History
Jul 15, 2016
Data Sourced
via Red Hat·12:00 PM
DescriptionSeverityAffected Software
Jul 21, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What security measures should be taken regarding CVE-2016-3598?
Regularly update your Java installations and monitor for security patches to protect against CVE-2016-3598.