CVE-2011-3544 Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution
Remote attackers can bypass security restrictions in Java Web Start and applets to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Since 3 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-3544?
CVE-2011-3544 is a critical vulnerability in Canonical Ubuntu Linux, published on 19 Oct 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
Weakness: CWE-284
Which versions are affected by CVE-2011-3544?
It affects 6 products.
Products include Canonical Ubuntu Linux, Oracle Jdk, Oracle Jre, Redhat Satellite With Embedded Oracle, Suse Linux Enterprise Java, Suse Linux Enterprise Server.
How do I fix CVE-2011-3544?
Apply the vendor's patch. US federal agencies must fix it by 24 Mar 2022.
Is CVE-2011-3544 being exploited?
Yes. Attackers have exploited CVE-2011-3544 in the wild since at least 3 Mar 2022.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-25jq-3vh4-pgv4.