CVE-2016-5552: Medium severity Google Android vulnerability
It was discovered that the URLStreamHandler class in the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause Java application to incorrectly parse attacker provided URL and interpret it differently from other applications processing the same URL.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.3 (Integrity impacts).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5552?
CVE-2016-5552 has been assigned a medium severity rating due to its potential to lead to URL parsing issues in Java applications.
How do I fix CVE-2016-5552?
To fix CVE-2016-5552, update your OpenJDK or Oracle JDK to the latest version that addresses this vulnerability.
What systems are affected by CVE-2016-5552?
CVE-2016-5552 affects multiple versions of OpenJDK and Oracle JDK, including versions 1.6, 1.7, and 1.8, as well as Android devices using Java components.
What is the impact of CVE-2016-5552?
The impact of CVE-2016-5552 is that a remote attacker could exploit improper parsing of URLs, potentially leading to malicious actions executed by Java applications.
Is CVE-2016-5552 exploitable in all environments?
CVE-2016-5552 may not be exploitable in all environments, as it largely depends on how Java applications handle URL inputs and user data.