#VU7326 Denial of service in JRockit and Oracle Java SE - CVE-2016-5547

Vulnerability identifier: #VU7326

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-5547

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
JRockit
Server applications / Web servers
Oracle Java SE
Universal components / Libraries / Software for developers

Vendor: Oracle

Description
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the Libraries component. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation
Install update from vendor's website.

Vulnerable software versions

JRockit: r28.3.12

Oracle Java SE: 6u131, 7u121, 8u111 - 8u112

---

External links
https://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.