CVE-2016-3485 Other in n/a

Low 2.9 Published 21 Jul 2016 Updated 11 Oct 2024

Local attackers can compromise data integrity in Oracle Java SE via unspecified networking vectors, requiring a security patch.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2016-3485?

CVE-2016-3485 is a low-severity vulnerability in Oracle Jdk, published on 21 Jul 2016. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.

Which versions are affected by CVE-2016-3485?

It affects 3 products.

Linux distribution packages (8)

`java-1_6_0-ibm` SUSE:Linux Enterprise Module for Legacy 12	All versions	`1.6.0_sr16.30-40.1`
`java-1_6_0-ibm` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`1.6.0_sr16.30-75.1`
`java-1_6_0-ibm` SUSE:Linux Enterprise Server 11 SP2-LTSS	All versions	`1.6.0_sr16.30-75.1`
`java-1_6_0-ibm` SUSE:Linux Enterprise Server 11 SP3-LTSS	All versions	`1.6.0_sr16.30-75.1`
`java-1_6_0-ibm` SUSE:Linux Enterprise Server 11 SP3-TERADATA	All versions	`1.6.0_sr16.30-75.1`
`java-1_6_0-ibm` SUSE:Manager 2.1	All versions	`1.6.0_sr16.30-75.1`
`java-1_6_0-ibm` SUSE:Manager Proxy 2.1	All versions	`1.6.0_sr16.30-75.1`
`java-1_6_0-ibm` SUSE:OpenStack Cloud 5	All versions	`1.6.0_sr16.30-75.1`

Products include Oracle Jdk, Oracle Jre, Oracle Jrockit.

How do I fix CVE-2016-3485?

Apply the vendor's patch.

Is CVE-2016-3485 being exploited?

There is no known exploitation of CVE-2016-3485 in the wild and no public exploit code.

All Oracle Jdk vulnerabilities

Sources

Also known as GHSA-c5cc-pp8q-5p3c, MINI-j5cw-c74r-q2hf, SUSE-SU-2016:2348-1, SUSE-SU-2016:2430-1.