CVE-2011-3557
published 2011-10-19CVE-2011-3557: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier…
PriorityP346medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.48%
89.1th percentile
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | jrockit | <= r28.1.4 | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | <= 1.5.0 | — |
| sun | jdk | <= 1.4.2_33 | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 6 regression
vendor_ubuntu·2012-01-24·CVSS 4.3
CVE-2011-3389 [MEDIUM] OpenJDK 6 regression
Title: OpenJDK 6 regression
Summary: USN-1263-1 caused a regression when using OpenJDK 6's SSL/TLS
implementation.
USN-1263-1 fixed vulnerabilities in OpenJDK 6. The upstream patch for
the chosen plaintext attack on the block-wise AES encryption algorithm
(CVE-2011-3389) introduced a regression that caused TLS/SSL connections
to fail when using certain algorithms. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Deepak Bhole discovered a flaw in the Same Origin Policy (SOP)
implementation in the IcedTea web browser plugin. This could allow a
remote attacker to open connections to certain hosts that should
not be permitted. (CVE-2011-3377)
Juliano Rizzo and Thai Duong discovered that the block-wise AES
encryption algorithm block-wise as use
Ubuntu
IcedTea-Web, OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-11-16·CVSS 4.3
CVE-2011-3389 [MEDIUM] IcedTea-Web, OpenJDK 6 vulnerabilities
Title: IcedTea-Web, OpenJDK 6 vulnerabilities
Summary: Multiple OpenJDK 6 and IcedTea-Web vulnerabilities have been fixed.
Deepak Bhole discovered a flaw in the Same Origin Policy (SOP)
implementation in the IcedTea web browser plugin. This could allow a
remote attacker to open connections to certain hosts that should
not be permitted. (CVE-2011-3377)
Juliano Rizzo and Thai Duong discovered that the block-wise AES
encryption algorithm block-wise as used in TLS/SSL was vulnerable to
a chosen-plaintext attack. This could allow a remote attacker to view
confidential data. (CVE-2011-3389)
It was discovered that a type confusion flaw existed in the in
the Internet Inter-Orb Protocol (IIOP) deserialization code. A
remote attacker could use this to cause an untrusted application
or applet to
Red Hat
OpenJDK: RMI registry privileged code execution (RMI, 7083012)
vendor_redhat·2011-10-18·CVSS 7.5
CVE-2011-3557 [HIGH] OpenJDK: RMI registry privileged code execution (RMI, 7083012)
OpenJDK: RMI registry privileged code execution (RMI, 7083012)
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 4) - Affected
Package: java-1.4.2-ibm-sap (Red Hat Enterprise Linux 6) - Affected
Red Hat
OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
vendor_redhat·2011-10-18·CVSS 7.5
CVE-2011-3556 [HIGH] OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
Package: java-1.4.2-ibm-sap (Red Hat Enterprise Linux 6) - Affected
GHSA
GHSA-7fq2-gpx6-fhfw: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2011-3557 [HIGH] GHSA-7fq2-gpx6-fhfw: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
GHSA
GHSA-x97f-rpv2-wwmc: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
ghsa_unreviewed·2022-05-14·CVSS 6.8
CVE-2011-3556 [MEDIUM] GHSA-x97f-rpv2-wwmc: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.htmlhttp://marc.info/?l=bugtraq&m=132750579901589&w=2http://marc.info/?l=bugtraq&m=133365109612558&w=2http://marc.info/?l=bugtraq&m=133728004526190&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://osvdb.org/76506http://rhn.redhat.com/errata/RHSA-2012-0508.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48308http://secunia.com/advisories/48692http://secunia.com/advisories/48915http://secunia.com/advisories/48948http://secunia.com/advisories/49198http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.ibm.com/developerworks/java/jdk/alerts/http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1384.htmlhttp://www.redhat.com/support/errata/RHSA-2012-0006.htmlhttp://www.securityfocus.com/bid/50234http://www.securitytracker.com/id?1026215http://www.ubuntu.com/usn/USN-1263-1https://exchange.xforce.ibmcloud.com/vulnerabilities/70836https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14373http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.htmlhttp://marc.info/?l=bugtraq&m=132750579901589&w=2http://marc.info/?l=bugtraq&m=133365109612558&w=2http://marc.info/?l=bugtraq&m=133728004526190&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://osvdb.org/76506http://rhn.redhat.com/errata/RHSA-2012-0508.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48308http://secunia.com/advisories/48692http://secunia.com/advisories/48915http://secunia.com/advisories/48948http://secunia.com/advisories/49198http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.ibm.com/developerworks/java/jdk/alerts/http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1384.htmlhttp://www.redhat.com/support/errata/RHSA-2012-0006.htmlhttp://www.securityfocus.com/bid/50234http://www.securitytracker.com/id?1026215http://www.ubuntu.com/usn/USN-1263-1https://exchange.xforce.ibmcloud.com/vulnerabilities/70836https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14373
2011-10-19
Published