CVE-2016-3427 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors...
CriticalCVSS 9.8
EPSS 92.3%
CISA KEV
added 2023-05-12 · due 2023-06-02
Exploited in the wild
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CISA Known Exploited Vulnerability
- Date added
- 2023-05-12
- Due date (FCEB)
- 2023-06-02
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle jdk | = 1.6.0-update113 | No fix listed |
| oracle jdk | = 1.7.0-update99 | No fix listed |
| oracle jdk | = 1.8.0-update77 | No fix listed |
| oracle jre | = 1.6.0-update113 | No fix listed |
| oracle jre | = 1.7.0-update99 | No fix listed |
| oracle jre | = 1.8.0-update77 | No fix listed |
| oracle jrockit | = r28.3.9 | No fix listed |
| oracle linux | = 5 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| netapp e-series santricity management plug-ins | All versions | No fix listed |
| netapp e-series santricity storage manager | All versions | No fix listed |
| netapp e-series santricity web services | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand cloud manager | All versions | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand report | All versions | No fix listed |
| netapp oncommand shift | All versions | No fix listed |
| netapp oncommand unified manager | All versions | No fix listed |
Show 55 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp StorageGRID | <= 9.0.4 | No fix listed |
| netapp vasa provider for clustered data ontap | >= 7.2 | No fix listed |
| netapp virtual storage console | >= 7.2 | No fix listed |
| apache cassandra | >= 2.1.0, < 2.1.22 | 2.1.22 |
| apache cassandra | >= 2.2.0, < 2.2.18 | 2.2.18 |
| apache cassandra | >= 3.0.0, < 3.0.22 | 3.0.22 |
| apache cassandra | >= 3.11.0, < 3.11.8 | 3.11.8 |
| apache cassandra | = 4.0.0-beta1 | No fix listed |
| redhat satellite | = 5.6 | No fix listed |
| redhat satellite | = 5.7 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 6.7 | No fix listed |
| redhat enterprise linux eus | = 7.2 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server eus | = 6.7 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| SUSE linux enterprise module for legacy | = 12 | No fix listed |
| SUSE manager | = 2.1 | No fix listed |
| SUSE manager proxy | = 2.1 | No fix listed |
| SUSE openstack cloud | = 5 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp1 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise server | = 12-sp1 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp1 | No fix listed |
References
- openSUSE-SU-2016:1222 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1230 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1235 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1248 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1250 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1262 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1265 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1299 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1300 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1303 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1378 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1379 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1388 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1458 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1475 mailing-list third-party-advisory vendor-advisory
- RHSA-2016:0650 third-party-advisory vendor-advisory
- RHSA-2016:0651 third-party-advisory vendor-advisory
- RHSA-2016:0675 third-party-advisory vendor-advisory
- RHSA-2016:0676 third-party-advisory vendor-advisory
- RHSA-2016:0677 third-party-advisory vendor-advisory
- RHSA-2016:0678 third-party-advisory vendor-advisory
- RHSA-2016:0679 third-party-advisory vendor-advisory
- RHSA-2016:0701 third-party-advisory vendor-advisory
- RHSA-2016:0702 third-party-advisory vendor-advisory
- RHSA-2016:0708 third-party-advisory vendor-advisory
- RHSA-2016:0716 third-party-advisory vendor-advisory
- RHSA-2016:0723 third-party-advisory vendor-advisory
- RHSA-2016:1039 third-party-advisory vendor-advisory
- DSA-3558 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20200831 CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX mailing-list
- www.oracle.com patch vendor-advisory
- www.oracle.com patch third-party-advisory
- 86421 broken-link third-party-advisory vdb-entry
- 1035596 broken-link third-party-advisory vdb-entry
- 1037331 broken-link third-party-advisory vdb-entry
- USN-2963-1 third-party-advisory vendor-advisory
- USN-2964-1 third-party-advisory vendor-advisory
- USN-2972-1 third-party-advisory vendor-advisory
- RHSA-2016:1430 third-party-advisory vendor-advisory
- RHSA-2017:1216 third-party-advisory vendor-advisory
- kc.mcafee.com broken-link
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list patch
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list patch
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list patch
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list patch
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list patch
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list patch
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list patch
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list patch
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list patch
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list patch
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list patch
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list patch
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list patch
- [cassandra-dev] 20200831 CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX mailing-list third-party-advisory
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list patch
- [cassandra-user] 20200831 CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX mailing-list third-party-advisory
- GLSA-201606-18 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- www.cisa.gov government-resource us-government-resource