Oracle Java SE and JRockit Unspecified
What to do
Apply updates per vendor instructions.
CISA deadline 2023-06-02 · passed 3 years 3 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
Who is affected
Oracle Java SE and JRockit. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 3 years 3 months ago
Sources
- NVD entry for CVE-2016-3427 nvd.nist.gov/vuln/detail/CVE-2016-3427
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- oracle.com www.oracle.com/security-alerts/cpuapr2016v3.html
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2016-3427