CVE-2016-3443: oracle jdk
Vulnerability summary
CVE-2016-3443 is a high (CVSS 10.0) vulnerability in oracle jdk. EPSS estimates a 5.48% chance of exploitation in the next 30 days, higher than 92.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 17 · Related 11Timeline
- 21-04-2016PublishedVulnerability first disclosed.
- 15-10-2024Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · ChainguardEcosystem advisory · calculated9.6CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
5.48%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.48% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard16 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
2 vendors · 18 products
References
24 links- lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 24 references
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.htmlVendor AdvisoryX Refsource SUSEWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlX Refsource CONFIRMVendor AdvisoryAdvisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.htmlVendor AdvisoryX Refsource SUSEWEB