Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2011-3557: Oracle Java and JRockit can be remotely compromised
CVE-2011-3557 · published 15 years ago
Summary
Versions of Oracle Java (JDK and JRE) up through the listed updates, as well as JRockit, contain a flaw that lets an attacker from the network read, change, or disrupt your applications. This can affect the privacy, correctness, and uptime of any software that relies on these Java runtimes. Update to the latest Java releases or apply the vendor’s patches as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sun | jdk |
1.7.0 <= 1.6.0 1.6.0 <= 1.5.0 1.5.0 <= 1.4.2_33 1.4.2 1.4.2_1 1.4.2_2 1.4.2_3 1.4.2_4 1.4.2_5 27 more version ranges
cpe:2.3:a:sun:jdk:1.7.0:*:*:*:*:*:*:* |
| sun | jre |
1.7.0 <= 1.6.0 1.6.0 <= 1.5.0 1.5.0 <= 1.4.2_33 1.4.2 1.4.2_1 1.4.2_2 1.4.2_3 1.4.2_4 1.4.2_5 27 more version ranges
cpe:2.3:a:sun:jre:1.7.0:*:*:*:*:*:*:* |
| oracle | jrockit |
<= r28.1.4 r28.0.0 r28.0.1 r28.0.2 r28.1.0 r28.1.1 r28.1.3 cpe:2.3:a:oracle:jrockit:*:*:*:*:*:*:*:* |
Original advisory text
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 an...
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
References
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html
- http://marc.info/?l=bugtraq&m=132750579901589&w=2
- http://marc.info/?l=bugtraq&m=133365109612558&w=2
- http://marc.info/?l=bugtraq&m=133728004526190&w=2
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://marc.info/?l=bugtraq&m=134254957702612&w=2
- http://osvdb.org/76506
- http://rhn.redhat.com/errata/RHSA-2012-0508.html
- http://rhn.redhat.com/errata/RHSA-2013-1455.html
- http://secunia.com/advisories/48308
- http://secunia.com/advisories/48692
- http://secunia.com/advisories/48915
- http://secunia.com/advisories/48948
- http://secunia.com/advisories/49198
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.ibm.com/developerworks/java/jdk/alerts/
- http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1384.html
- http://www.redhat.com/support/errata/RHSA-2012-0006.html
- http://www.securityfocus.com/bid/50234
- http://www.securitytracker.com/id?1026215
- http://www.ubuntu.com/usn/USN-1263-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/70836
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.8
Medium
Timeline
Published19 Oct 2011
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-3557 · NVD
Track software like this
Free during beta