CVE-2016-3425: oracle jdk
CVSS: 5.0v2.0MediumModified
AliasesUBUNTU-CVE-2016-3425CGA-2f29-4ppc-9vmqCGA-2p3r-2fjm-rv2vCGA-3w56-72r5-hvc5CGA-5hr7-v3wv-xgx8CGA-5r83-hf45-m2fvCGA-5whp-5c55-xwx9CGA-66ww-hq66-h9rrCGA-6j4h-v7j4-x36gCGA-7v33-px88-2hmjCGA-833c-9336-qphhCGA-857h-qqv5-rc2jCGA-96c8-3g4w-vjgfCGA-986c-j79c-cq4hCGA-c2h2-ghgf-8qjjCGA-c6jc-xp43-m644CGA-fhh9-63jh-xpxfCGA-fqx3-gr45-ww3fCGA-fvqm-hvgm-4xc9CGA-g3cr-23h3-gvxcCGA-ghg9-m67x-cqqhCGA-gpcm-cr72-3m33CGA-gxcx-j7h9-hfp4CGA-h6h8-c2xq-rmfjCGA-hmr9-f5g9-hxpmCGA-hw7m-hvg7-x86gCGA-jfqg-q8qv-xfhjCGA-jrg6-r5w5-8h43CGA-mv78-f7v7-vrqwCGA-p8pg-w5px-rr27CGA-pxp3-9f8p-rm85CGA-qmr6-9m97-r97cCGA-vwf2-xvwv-fmmr
Published 21-04-2016Last modified 15-10-2024
Vulnerability summary
CVE-2016-3425 is a medium (CVSS 5.0) vulnerability in oracle jdk. EPSS estimates a 3.80% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities.
CVSS score
5.0/10
010
Medium · v2.0 (NVD)EPSS score
3.80%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 11DLA-451-1DSA-3558-1MGASA-2016-0149OPENSUSE-SU-2024:10197-1OPENSUSE-SU-2024:10534-1RHSA-2016:0650RHSA-2016:0651RHSA-2016:0675RHSA-2016:0676RHSA-2016:0677RHSA-2016:0678RHSA-2016:0679RHSA-2016:0723SUSE-SU-2016:1248-1SUSE-SU-2016:1250-1USN-2963-1USN-2964-1CGA-52V9-MC4H-FW7GCGA-F3PM-RXRR-GX23CGA-GXJJ-4XFP-MGJFCGA-QP97-9QM2-5QP3CGA-WRCW-H2J6-9PCJ
Timeline
- 21-04-2016PublishedVulnerability first disclosed.
- 15-10-2024Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 4.3Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.80%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.80% on 18-09-2026
18-09-202618-10-2026
EPSS score3.80%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard16 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Oracle3 products
Ubuntu3 products
- openjdk-6< 6b39-1.13.11-0ubuntu0.14.04.1
- openjdk-7< 7u101-2.6.6-0ubuntu0.14.04.1
- openjdk-8< 8u91-b14-0ubuntu4~16.04.1
3 vendors · 22 products
References
31 links- lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 31 references
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.htmlVendor AdvisoryX Refsource SUSEWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlX Refsource CONFIRMVendor AdvisoryAdvisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.htmlVendor AdvisoryX Refsource SUSEWEB
