CVE-2016-3443
Oracle Java Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read.
Vulnerabilidad no especificada en Oracle Java SE 6u113, 7u99 y 8u77 permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través de vectores relacionados con 2D. NOTA: la información anterior es de la CPU de Abril de 2016. Oracle no ha comentado nada sobre terceros que alegan que este problema permite a atacantes remotos obtener información sensible a través de datos de fuente manipulada, lo que desencadena una lectura fuera de rango.
This vulnerability allows remote attackers to leak arbitrary information on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of font files. The issue lies in insufficient validation of supplied font data in Java, where specific font data can force reading memory past the end of an allocated object. An attacker can leverage this vulnerability to leak arbitrary information.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2016-03-17 CVE Reserved
- 2016-04-21 CVE Published
- 2024-05-21 EPSS Updated
- 2024-10-15 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (26)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/86482 | Vdb Entry | |
| http://www.securitytracker.com/id/1035596 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-16-376 | X_refsource_misc |
|
| https://security.netapp.com/advisory/ntap-20160420-0001 | X_refsource_confirm |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Jdk Search vendor "Oracle" for product "Jdk" | 1.6.0 Search vendor "Oracle" for product "Jdk" and version "1.6.0" | update113 |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jdk Search vendor "Oracle" for product "Jdk" | 1.7.0 Search vendor "Oracle" for product "Jdk" and version "1.7.0" | update99 |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jdk Search vendor "Oracle" for product "Jdk" | 1.8.0 Search vendor "Oracle" for product "Jdk" and version "1.8.0" | update77 |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jre Search vendor "Oracle" for product "Jre" | 1.6.0 Search vendor "Oracle" for product "Jre" and version "1.6.0" | update113 |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jre Search vendor "Oracle" for product "Jre" | 1.7.0 Search vendor "Oracle" for product "Jre" and version "1.7.0" | update99 |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jre Search vendor "Oracle" for product "Jre" | 1.8.0 Search vendor "Oracle" for product "Jre" and version "1.8.0" | update77 |
Affected
| ||||||