CVE-2016-3427criticalunder attackCWE-284

CVE-2016-3427

Published · Updated

Follow this CVE+ Monitor Oracle Java SE+ Monitor JRockit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 92%
from disclosure to weapon
Published on NVDApr 21
CISA KEV+2577d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
41 products (1,119 components)
Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Server (v. 7) · and others 36
fix ↗
Action required by CISAfederal deadline: 2023-06-02

Apply updates per vendor instructions.

In short

A flaw in Oracle Java's JMX (Java Management Extensions) component allows remote attackers to compromise the security of a system without authentication, potentially stealing data, modifying it, or disrupting services.

Technical detail

An unspecified vulnerability in JMX affects Java SE versions 6u113, 7u99, 8u77, Java SE Embedded 8u77, and JRockit R28.3.9. Remote attackers can exploit this vector to gain unauthorized access, compromising confidentiality, integrity, and availability of affected systems.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a