CVE-2016-5554: Medium severity oracle java se 7 vulnerability
It was discovered that the ClassLoaderWithRepository class in the JMX component of OpenJDK did not sufficiently perform classloader consistency checks, allowing classloader to return class with different name than requested. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5554?
CVE-2016-5554 is classified as a high severity vulnerability due to the potential for classloader manipulation.
How do I fix CVE-2016-5554?
To fix CVE-2016-5554, users should update their Java Development Kit (JDK) or Java Runtime Environment (JRE) to the latest version that has addressed the vulnerability.
Which software versions are affected by CVE-2016-5554?
CVE-2016-5554 affects Oracle JDK versions 1.6.0-update121, 1.7.0-update111, and 1.8.0-update101 and 1.8.0-update102, as well as the respective JRE versions.
What type of attack can exploit CVE-2016-5554?
An untrusted Java application or applet can exploit CVE-2016-5554 to bypass security restrictions by manipulating classloading.
Is CVE-2016-5554 specific to any Java platform?
Yes, CVE-2016-5554 specifically affects the JMX component of the OpenJDK and Oracle implementation of Java.