Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remo…

published 2011-10-19 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-3507

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-03
epss: 96.7%; EPSS 96.7% chance of exploitation in 30 days, percentile 99.8%
public exploits: 2; Metasploit, Exploit-DB

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 9 distros 1 links 1

oracle java_se 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
oracle jdk 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
oracle jre 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
sun java 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
sun java_se 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
sun jdk 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
sun jre 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
oracle openjdk 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1
sun openjdk 1.6.0_29, 1.7.0_1, 6.0.29, 7.0.1

java-1.6.0-ibm network satellite 5.4 1:1.6.0.14.0-1jpp.1.el5_9
java-1.6.0-ibm network satellite 5.4 1:1.6.0.14.0-1jpp.1.el6_4
java-1.7.0-ibm RHEL 6 EXTRAS 1:1.7.0.3.0-1jpp.2.el6_3
java-1.7.0-ibm-src RHEL 6 EXTRAS 1:1.7.0.3.0-1jpp.2.el6_3
java-1.7.0-ibm-demo RHEL 6 EXTRAS 1:1.7.0.3.0-1jpp.2.el6_3
java-1.7.0-ibm-jdbc RHEL 6 EXTRAS 1:1.7.0.3.0-1jpp.2.el6_3
java-1.7.0-ibm-plugin RHEL 6 EXTRAS 1:1.7.0.3.0-1jpp.2.el6_3
java-1.6.0-ibm RHEL 4 EXTRAS 1:1.6.0.10.0-1jpp.2.el4

red hat advisories RHSA-2013:1455 RHSA-2012:1467 RHSA-2012:0034 RHSA-2011:1380 RHSA-2011:1384

oracle.com/technetwork/topics/security/javacpuoct2011-443431.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-3544 updated 2026-11-04 cvss 6.8

OpenJDK: missing SecurityManager checks in scripting engine (Scripting, 7046823)

Red Hat Enterprise Linux 5 java-1.7.0-ibm
affected: no fix available
Red Hat Desktop version 4 Extras java-1.6.0-sun 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el4, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el4, +5 more
fixed: vendor fix RHSA-2012:0034
Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk 1.6.0.0-1.23.1.9.10.el5_7, java-1.6.0-openjdk-src 1.6.0.0-1.23.1.9.10.el5_7, java-1.6.0-openjdk-demo 1.6.0.0-1.23.1.9.10.el5_7, java-1.6.0-openjdk-javadoc 1.6.0.0-1.23.1.9.10.el5_7
fixed: vendor fix RHSA-2011:1380
Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el4, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el4, +5 more
fixed: vendor fix RHSA-2012:0034
Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk 1.6.0.0-1.23.1.9.10.el5_7, java-1.6.0-openjdk-src 1.6.0.0-1.23.1.9.10.el5_7, java-1.6.0-openjdk-demo 1.6.0.0-1.23.1.9.10.el5_7, java-1.6.0-openjdk-javadoc 1.6.0.0-1.23.1.9.10.el5_7
fixed: vendor fix RHSA-2011:1380
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun 1.6.0.29-1jpp.1.el5, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el5, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el5, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el5, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el5, +6 more Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-sun 1.6.0.29-1jpp.1.el6, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el6, java-1.7.0-ibm 1.7.0.3.0-1jpp.2.el6_3, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el6, +10 more Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el4, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el4, +5 more Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-sun 1.6.0.29-1jpp.1.el6, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el6, java-1.7.0-ibm 1.7.0.3.0-1jpp.2.el6_3, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el6, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el6, +4 more
fixed: vendor fix RHSA-2012:0034
Red Hat Enterprise Linux Server (v. 6) java-1.6.0-openjdk 1.6.0.0-1.40.1.9.10.el6_1, java-1.6.0-openjdk-javadoc 1.6.0.0-1.40.1.9.10.el6_1 Red Hat Enterprise Linux Server Optional (v. 6) java-1.6.0-openjdk 1.6.0.0-1.40.1.9.10.el6_1, java-1.6.0-openjdk-src 1.6.0.0-1.40.1.9.10.el6_1, java-1.6.0-openjdk-demo 1.6.0.0-1.40.1.9.10.el6_1
fixed: vendor fix RHSA-2011:1380
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun 1.6.0.29-1jpp.1.el5, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el5, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el5, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el5, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el5, +6 more Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-sun 1.6.0.29-1jpp.1.el6, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el6, java-1.7.0-ibm 1.7.0.3.0-1jpp.2.el6_3, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el6, +10 more Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-sun 1.6.0.29-1jpp.1.el6, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el6, java-1.7.0-ibm 1.7.0.3.0-1jpp.2.el6_3, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el6, +10 more Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm 1.6.0.10.0-1jpp.2.el4, java-1.6.0-sun-src 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-demo 1.6.0.29-1jpp.1.el4, java-1.6.0-sun-jdbc 1.6.0.29-1jpp.1.el4, java-1.6.0-ibm-src 1.6.0.10.0-1jpp.2.el4, +5 more
fixed: vendor fix RHSA-2012:0034

show 2 more

Red Hat Satellite 5.4 (RHEL v.5) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el5_9 Red Hat Satellite 5.4 (RHEL v.6) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el6_4
fixed: vendor fix RHSA-2013:1455
Red Hat Enterprise Linux 4 java-1.4.2-ibm, java-1.5.0-ibm Red Hat Enterprise Linux 5 java-1.4.2-ibm, java-1.5.0-ibm Red Hat Enterprise Linux 6 java-1.5.0-ibm, java-1.4.2-ibm-sap, java-1.5.0-ibm-src, java-1.5.0-ibm-demo, java-1.5.0-ibm-jdbc, java-1.5.0-ibm-plugin, +1 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2011-10-18 First public exploit (Metasploit exploit/multi/browser/java_rhino)
2011-10-19 Published
2022-03-03 Added to CISA KEV
2022-03-24 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-03)
Patch by: 2022-03-24 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Oracle, Java SE JDK and JRE
CISA name: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

96.65% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/multi/browser/java_rhino Java Applet Rhino Script Engine Remote Code Execution metasploit exploit, excellent rank, 2011-10-18
EDB-18171 Java Applet Rhino Script Engine - Remote Code Execution (Metasploit) remote, 2011-11-30

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-284 Improper Access Control

References

oracle.com /technetwork/topics/security/javacpuoct2011-443431.html
patch, vendor-advisory
security.gentoo.org /glsa/glsa-201406-32.xml
vendor-advisory, third-party-advisory
marc.info /?l=bugtraq&m=134254866602253&w=2
vendor-advisory, mailing-list
marc.info /?l=bugtraq&m=132750579901589&w=2
vendor-advisory, mailing-list
lists.opensuse.org /opensuse-security-announce/2012-01/msg00049.html
vendor-advisory, mailing-list, third-party-advisory
rhn.redhat.com /errata/RHSA-2013-1455.html
vendor-advisory, third-party-advisory
redhat.com /support/errata/RHSA-2011-1384.html
vendor-advisory, broken-link
marc.info /?l=bugtraq&m=134254957702612&w=2
vendor-advisory, mailing-list
ubuntu.com /usn/USN-1263-1
vendor-advisory, third-party-advisory
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13947
vdb-entry, signature, broken-link
secunia.com /advisories/48308
third-party-advisory, broken-link
securityfocus.com /bid/50218
vdb-entry, broken-link, third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/70849
vdb-entry, third-party-advisory
securitytracker.com /id?1026215
vdb-entry, broken-link, third-party-advisory
ibm.com /developerworks/java/jdk/alerts/
product
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3544
government-resource, us-government-resource

Sources

CVE List CVE-2011-3544
NVD CVE-2011-3544

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Updated Java versions.

Summary