Critical severity · published Oct 19, 2011
CVE-2011-3544
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
In wildKEV
9.8
CVSS
96.7%
EPSS
Yes
On KEV
Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)96.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2022
Federal remediation dueMar 24, 2022
Ransomware campaign useNot known
Affected products
Which versions
JD
Jdk · Oracle
before 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; +34 more · source: NVD
JR
Jre · Oracle
before 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; +34 more · source: NVD
LE
Linux Enterprise Java · Suse
10 · source: NVD
LE
Linux Enterprise Server · Suse
10 · source: NVD
SW
Satellite With Embedded Oracle · Redhat
5.4 · source: NVD
UL
Ubuntu Linux · Canonical
10.04; 10.10; 11.04; 11.10 · source: NVD
JS
Java SE JDK and JRE · Oracle
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3544
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13947
vendor-advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml
vendor-advisory
http://marc.info/?l=bugtraq&m=134254866602253&w=2
third-party-advisory
http://secunia.com/advisories/48308
vendor-advisory
http://marc.info/?l=bugtraq&m=132750579901589&w=2
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation