CVE-2016-5546

Estado: ModificadaAlta (7.5)—

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data.

Leer descripción completaMostrar menos

Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts).

CVSS

Versión: 3.0
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 3.17%
Percentil entre todas las CVEs puntuadas: 88
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Oracle — JDK Oracle — JRE Oracle — Jrockit

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2016-5546",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2016-5546",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-09T19:25:41.476171Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle",
          "product": "Java SE",
          "versions": [
            {
              "status": "affected",
              "version": "6u131"
            },
            {
              "status": "affected",
              "version": "7u121"
            },
            {
              "status": "affected",
              "version": "8u112"
            }
          ]
        },
        {
          "vendor": "Oracle",
          "product": "Java SE Embedded",
          "versions": [
            {
              "status": "affected",
              "version": "8u111"
            }
          ]
        },
        {
          "vendor": "Oracle",
          "product": "JRockit",
          "versions": [
            {
              "status": "affected",
              "version": "R28.3.12"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-01-27T22:59:00.303",
  "references": [
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0175.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0176.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0177.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0180.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0263.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0269.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.debian.org/security/2017/dsa-3782",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/95506",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037637",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:1216",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201701-65",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201707-01",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20170119-0001/",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0175.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0176.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0177.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0180.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0263.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0269.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2017/dsa-3782",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/95506",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037637",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:1216",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201701-65",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201707-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20170119-0001/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en Java SE, Java SE Embedded, componente JRockit de Oracle Java SE (subcomponente: Libraries). Versiones compatibles que están afectadas son Java SE: 6u131, 7u121 y 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Vulnerabilidad fácilmente explotable permite a atacante no autenticado con acceso a la red a través de múltiples protocolos, comprometer Java SE, Java SE Embedded, JRockit. Ataques exitosos de esta vulnerabilidad pueden resultar en creación, borrado o modificación de acceso no autorizado a datos críticos o a todos los datos accesibles de Java SE, Java SE Embedded, JRockit. Nota: Aplica a la implementación de cliente y servidor de Java. Esta vulnerabilidad puede ser explotada a través de aplicaciones y Java Web Start y applets de Java aisladas. También puede ser explotada suministrando datos de APIs en el componente especificado sin utilizar aplicaciones Java Web Start o applets Java aisladas, como por ejemplo mediante un servicio web. CVSS v3.0 Base Score 7.5 (Impactos de Integridad)."
    }
  ],
  "lastModified": "2026-06-17T00:49:36.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6:update_131:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1384D79-F9DA-44C5-A3C9-3CCE627B2255"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7:update_121:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92EF1E3B-6EF8-499A-84EA-D7792B181CCB"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8:update_111:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73185AEF-8CB1-4728-9E99-D0D2A3419D40"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8:update_112:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEB76EC4-557F-4C67-BE1E-79E837043B05"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.6:update_131:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C747C39A-145E-4648-99C2-0A8C7BA77F11"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7:update_121:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "706F9471-3647-4D13-B794-4F53700091F7"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8:update_111:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1ED8B5A9-E738-430E-9FC6-206DFC98B965"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8:update_112:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AA3E574-DC5D-465B-95B8-CD1AF5433646"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jrockit:r28.3.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE1A57E9-0134-466F-B8EE-9E38A844F865"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}