CVE-2016-3606: Critical severity oracle linux vulnerability

Published Jul 15, 2016

Updated

It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

— MITRE

Affected Software

9 affected components

ORACLE Linux=5.0

ORACLE Linux=6.0

ORACLE Linux=7.0

Oracle JDK=1.7.0-update101

Oracle JDK=1.8.0-update91

Oracle JDK=1.8.0-update92

ORACLE JRE=1.7.0-update101

ORACLE JRE=1.8.0-update91

ORACLE JRE=1.8.0-update92

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Event History

Jul 15, 2016

Data Sourced

via Red Hat·11:50 AM

DescriptionSeverityAffected Software

Jul 21, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3606?

CVE-2016-3606 has a high severity due to its impact on confidentiality, integrity, and availability.

How do I fix CVE-2016-3606?

To fix CVE-2016-3606, upgrade to the latest version of Oracle Java SE or Oracle JRE that addresses this vulnerability.

What systems are affected by CVE-2016-3606?

CVE-2016-3606 affects Oracle Java SE versions 7u101 and 8u92 and various Oracle Linux versions.

Can CVE-2016-3606 be exploited remotely?

Yes, CVE-2016-3606 can be exploited remotely, allowing attackers to execute malicious code.

What component of Java is impacted by CVE-2016-3606?

CVE-2016-3606 impacts the bytecode verifier component in the Hotspot of OpenJDK.