CVE-2016-5556: Critical severity oracle java se 7 vulnerability

Q: What is the severity of CVE-2016-5556?

CVE-2016-5556 has a CVSS score of 9.6, indicating a critical vulnerability.

Q: How do I fix CVE-2016-5556?

To fix CVE-2016-5556, update your Java installation to the versions specified in the vendor's advisory.

Q: What versions of Java are affected by CVE-2016-5556?

CVE-2016-5556 affects Oracle Java SE 6u131, 7u121, and 8u111.

Q: Is there a workaround for CVE-2016-5556?

There are no known workarounds for CVE-2016-5556, so updating is the best approach.

Q: What components are impacted by CVE-2016-5556?

CVE-2016-5556 impacts the 2D component of Oracle Java.

Published Oct 18, 2016

Updated

Oracle Java SE 6u131, 7u121, and 8u111 fixes an unspecified vulnerability in the 2D component (CVE-2016-5556). Upstream has CVSS scored this issue as: 9.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

External Reference:

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixJAVA

Other sources

Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

Affected Software

22 affected componentsFixes available

redhat/java<1.7.0-oracle-1:1.7.0.121-1jpp.1.el5_11

1.7.0-oracle-1:1.7.0.121-1jpp.1.el5_11

redhat/java<1.6.0-sun-1:1.6.0.131-1jpp.1.el5_11

1.6.0-sun-1:1.6.0.131-1jpp.1.el5_11

redhat/java<1.8.0-oracle-1:1.8.0.111-1jpp.4.el6_8

1.8.0-oracle-1:1.8.0.111-1jpp.4.el6_8

redhat/java<1.7.0-oracle-1:1.7.0.121-1jpp.1.el6_8

1.7.0-oracle-1:1.7.0.121-1jpp.1.el6_8

redhat/java<1.6.0-sun-1:1.6.0.131-1jpp.1.el6_8

1.6.0-sun-1:1.6.0.131-1jpp.1.el6_8

redhat/java<1.8.0-oracle-1:1.8.0.111-1jpp.4.el7

1.8.0-oracle-1:1.8.0.111-1jpp.4.el7

redhat/java<1.7.0-oracle-1:1.7.0.121-1jpp.1.el7

1.7.0-oracle-1:1.7.0.121-1jpp.1.el7

redhat/java<1.6.0-sun-1:1.6.0.131-1jpp.1.el7

1.6.0-sun-1:1.6.0.131-1jpp.1.el7

redhat/java<1.7.0-ibm-1:1.7.0.9.60-1jpp.1.el5_11

1.7.0-ibm-1:1.7.0.9.60-1jpp.1.el5_11

redhat/java<1.6.0-ibm-1:1.6.0.16.35-1jpp.1.el5_11

1.6.0-ibm-1:1.6.0.16.35-1jpp.1.el5_11

redhat/java<1.8.0-ibm-1:1.8.0.3.20-1jpp.1.el6_8

1.8.0-ibm-1:1.8.0.3.20-1jpp.1.el6_8

redhat/java<1.7.1-ibm-1:1.7.1.3.60-1jpp.1.el6_8

1.7.1-ibm-1:1.7.1.3.60-1jpp.1.el6_8

redhat/java<1.6.0-ibm-1:1.6.0.16.35-1jpp.1.el6_8

1.6.0-ibm-1:1.6.0.16.35-1jpp.1.el6_8

redhat/java<1.8.0-ibm-1:1.8.0.3.20-1jpp.1.el7_2

1.8.0-ibm-1:1.8.0.3.20-1jpp.1.el7_2

redhat/java<1.7.1-ibm-1:1.7.1.3.60-1jpp.1.el7_2

1.7.1-ibm-1:1.7.1.3.60-1jpp.1.el7_2

redhat/java<1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8

1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8

Oracle JDK=1.6.0-update121

Oracle JDK=1.7.0-update111

Oracle JDK=1.8.0-update102

ORACLE JRE=1.6.0-update121

ORACLE JRE=1.7.0-update111

ORACLE JRE=1.8.0-update102

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Event History

Oct 18, 2016

CVE Published

12:00 AM

Data Sourced

via Red Hat·08:53 PM

DescriptionSeverityAffected Software

Oct 25, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2016-5556?

CVE-2016-5556 has a CVSS score of 9.6, indicating a critical vulnerability.

How do I fix CVE-2016-5556?