Information disclosure in JRockit and Oracle Java SE - CVE-2016-10165

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU8861

Information disclosure in JRockit and Oracle Java SE - CVE-2016-10165

Published: October 18, 2017 / Updated: October 18, 2017


Vulnerability identifier: #VU8861
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10165
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to a flaw in the 2D (Little CMS 2) component. A remote attacker can read arbitrary files on the target system.

Affected software

JRockit
Oracle Java SE
Debian Linux
IBM AIX
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
SUSE OpenStack Cloud
SUSE Linux
Opensuse
lcms2 (Alpine package)
java-1.7.0-oracle-src (Red Hat package)
java-1.7.0-oracle-plugin (Red Hat package)
java-1.7.0-oracle-jdbc (Red Hat package)
java-1.7.0-oracle-javafx (Red Hat package)
java-1.7.0-oracle-devel (Red Hat package)
java-1.7.0-oracle (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)
java-1.8.0-oracle (Red Hat package)
Red Hat Satellite
IBM Cognos Controller

How to mitigate CVE-2016-10165

The vulnerability is addressed in the following version: 8u151.

lcms2 (Alpine package) - addressed in versions 2.8-r0, 2.8-r1
java-1.7.0-oracle-src (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-plugin (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-jdbc (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-javafx (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-devel (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7

External References

Related Security Bulletins