CVE-2016-5547: Medium severity Oracle JDK vulnerability
It was discovered that the ObjectIdentifier class in the Libraries component of OpenJDK did not check the length of the object identifier read from the input before allocating memory to store the OID. An attacker able to make a Java application to decode a specially crafted DER input could cause the application to use an excessive amount of memory. The DER encoding is used in e.g. X.509 certificates or LDAP protocol.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.3 (Availability impacts).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5547?
CVE-2016-5547 is classified as a high severity vulnerability due to its potential for code execution upon decoding malicious input.
How do I fix CVE-2016-5547?
To fix CVE-2016-5547, update your OpenJDK to a version that includes the security patch for this vulnerability.
Which software versions are affected by CVE-2016-5547?
CVE-2016-5547 affects multiple versions including specific updates of Oracle JDK, JRE, and OpenJDK.
Can CVE-2016-5547 be exploited remotely?
Yes, CVE-2016-5547 can potentially be exploited remotely if an attacker sends specially crafted DER input to a vulnerable Java application.
What are the potential impacts of CVE-2016-5547?
The potential impacts of CVE-2016-5547 include denial of service or possibly arbitrary code execution in affected applications.