Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availabilit…

published 2016-07-21 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-4529

cvss: 7.7; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits: 0; none known

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

Patch / fix

fixed in 9 distros 3 links 1

oracle java_se 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
oracle jdk 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
oracle jre 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
sun java 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
sun java_se 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
sun jdk 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
sun jre 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
oracle openjdk 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101
sun openjdk 1.6.0_121, 1.7.0_111, 1.8.0_101, 6.0.121, 7.0.111, 8.0.101

red hat suse opensuse

java-1.6.0-sun RHEL 5 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el5_11
java-1.6.0-sun RHEL 6 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el6_8
java-1.6.0-sun RHEL 7 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el7
java-1.6.0-sun-src RHEL 5 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el5_11
java-1.6.0-sun-src RHEL 6 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el6_8
java-1.6.0-sun-src RHEL 7 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el7
java-1.6.0-sun-demo RHEL 5 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el5_11
java-1.6.0-sun-demo RHEL 6 EXTRAS_ORACLE_JAVA 1:1.6.0.121-1jpp.1.el6_8

red hat advisories RHSA-2016:1477 RHSA-2016:1476 RHSA-2016:1475

java-1_8_0-openjdk SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 1.8.0.101-14.3
java-1_7_0-openjdk SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 1.7.0.111-33.1

suse advisories SUSE-SU-2016:2012-1 SUSE-SU-2016:1997-1

java-1_8_0-openjdk openSUSE Tumbleweed 1.8.0.111-1.1
java-1_7_0-openjdk openSUSE Tumbleweed 1.7.0.121-1.1

opensuse advisories openSUSE-SU-2024:10197-1 openSUSE-SU-2024:10534-1

oracle.com/technetwork/security-advisory/cpujul2016-2881720.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-3503 updated 2026-06-28 cvss 7.0

JDK: unspecified vulnerability fixed in 6u121, 7u111, and 8u101 (Install)

Red Hat Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.6.0-sun 1.6.0.121-1jpp.1.el7, java-1.7.0-oracle 1.7.0.111-1jpp.1.el7, java-1.8.0-oracle 1.8.0.101-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el7, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Client 5 java-1.6.0-sun 1.6.0.121-1jpp.1.el5_11, java-1.7.0-oracle 1.7.0.111-1jpp.1.el5_11, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el5_11, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el5_11, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el5_11, java-1.6.0-sun-plugin 1.6.0.121-1jpp.1.el5_11, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.6.0-sun 1.6.0.121-1jpp.1.el7, java-1.7.0-oracle 1.7.0.111-1jpp.1.el7, java-1.8.0-oracle 1.8.0.101-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el7, +5 more Red Hat Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.6.0-sun 1.6.0.121-1jpp.1.el6_8, java-1.7.0-oracle 1.7.0.111-1jpp.1.el6_8, java-1.8.0-oracle 1.8.0.101-1jpp.1.el6_8, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el6_8, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.6.0-sun 1.6.0.121-1jpp.1.el6_8, java-1.7.0-oracle 1.7.0.111-1jpp.1.el6_8, java-1.8.0-oracle 1.8.0.101-1jpp.1.el6_8, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el6_8, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.6.0-sun 1.6.0.121-1jpp.1.el7, java-1.7.0-oracle 1.7.0.111-1jpp.1.el7, java-1.8.0-oracle 1.8.0.101-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el7, +9 more

+4 more productsfewer

Red Hat Oracle Java for Red Hat Enterprise Linux Server 5 java-1.6.0-sun 1.6.0.121-1jpp.1.el5_11, java-1.7.0-oracle 1.7.0.111-1jpp.1.el5_11, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el5_11, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el5_11, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el5_11, java-1.6.0-sun-plugin 1.6.0.121-1jpp.1.el5_11, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Server 6 java-1.6.0-sun 1.6.0.121-1jpp.1.el6_8, java-1.7.0-oracle 1.7.0.111-1jpp.1.el6_8, java-1.8.0-oracle 1.8.0.101-1jpp.1.el6_8, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el6_8, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.6.0-sun 1.6.0.121-1jpp.1.el7, java-1.7.0-oracle 1.7.0.111-1jpp.1.el7, java-1.8.0-oracle 1.8.0.101-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el7, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.6.0-sun 1.6.0.121-1jpp.1.el6_8, java-1.7.0-oracle 1.7.0.111-1jpp.1.el6_8, java-1.8.0-oracle 1.8.0.101-1jpp.1.el6_8, java-1.6.0-sun-src 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-demo 1.6.0.121-1jpp.1.el6_8, java-1.6.0-sun-jdbc 1.6.0.121-1jpp.1.el6_8, +9 more

fixed: vendor fix RHSA-2016:1477

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-10-11)

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.7	CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

References

oracle.com /technetwork/security-advisory/cpujul2016-2881720.html
patch, vendor-advisory
security.gentoo.org /glsa/201610-08
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2016-08/msg00024.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2016-08/msg00034.html
vendor-advisory
access.redhat.com /errata/RHSA-2016:1475
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2016-08/msg00033.html
vendor-advisory
access.redhat.com /errata/RHSA-2016:1477
vendor-advisory
access.redhat.com /errata/RHSA-2016:1476
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2016-08/msg00011.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2016-08/msg00032.html
vendor-advisory
lists.opensuse.org /opensuse-updates/2016-08/msg00028.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2016-08/msg00035.html
vendor-advisory
security.netapp.com /advisory/ntap-20160721-0001/
securityfocus.com /bid/91996
vdb-entry, third-party-advisory
securitytracker.com /id/1036365
vdb-entry
securityfocus.com /bid/91787
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-3503
NVD CVE-2016-3503

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Updated Java versions.

Summary