CVE-2016-0483 Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors...
HighCVSS 10.0
EPSS 14.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle jdk | = 1.6.0-update105 | No fix listed |
| oracle jdk | = 1.7.0-update91 | No fix listed |
| oracle jdk | = 1.8.0-update66 | No fix listed |
| oracle jre | = 1.6.0-update105 | No fix listed |
| oracle jre | = 1.7.0-update91 | No fix listed |
| oracle jre | = 1.8.0-update66 | No fix listed |
| oracle jrockit | = r28.3.8 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
References
- www.zerodayinitiative.com third-party-advisory vdb-entry
- openSUSE-SU-2016:0272 vendor-advisory
- 1034715 third-party-advisory vdb-entry
- openSUSE-SU-2016:0279 vendor-advisory
- GLSA-201610-08 vendor-advisory
- USN-2884-1 third-party-advisory vendor-advisory
- DSA-3465 vendor-advisory
- www.oracle.com
- USN-2885-1 third-party-advisory vendor-advisory
- www.oracle.com patch vendor-advisory
- RHSA-2016:1430 vendor-advisory
- RHSA-2016:0049 vendor-advisory
- openSUSE-SU-2016:0270 vendor-advisory
- RHSA-2016:0053 vendor-advisory
- SUSE-SU-2016:0269 vendor-advisory
- RHSA-2016:0067 vendor-advisory
- openSUSE-SU-2016:0263 vendor-advisory
- SUSE-SU-2016:0256 vendor-advisory
- GLSA-201603-14 vendor-advisory
- RHSA-2016:0057 vendor-advisory
- RHSA-2016:0055 vendor-advisory
- RHSA-2016:0054 vendor-advisory
- RHSA-2016:0056 vendor-advisory
- openSUSE-SU-2016:0268 vendor-advisory
- RHSA-2016:0050 vendor-advisory
- DSA-3458 vendor-advisory
- SUSE-SU-2016:0265 vendor-advisory