VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2011-3544

9.8 Critical Mitigation candidate

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

CWE-284 · Improper access control

Exploitation Status

Exploited in the wild

Confirmed real-world exploitation.

CVSS E:A

  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-03 · remediation due 2022-03-24 · ransomware use: unknown
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2011-11-30.
  • EPSS 97% chance in 30 days A model prediction, not an observation. Higher than 100% of all scored CVEs.
IndexArtifactStarsFirst seen
Exploit-DB Java Applet Rhino Script Engine - Remote Code Execution (Metasploit) 2011-11-30

Waratek Defense Posture

Mitigation candidate

A defect of the type ARMR addresses, with a fix path to work from and a working exploit already published. This is a claim on attention, not a scheduling commitment: no rule exists and none is scheduled.

  • Protection none
  • Action unverified patch rule
  • Review automated inferred
  • Record active
Decided by patch-hint : A reference pointing at the upstream fix: a commit, a PR, a Red Hat bug
Finding A reference points at an upstream fix (redhat-cve tier): https://access.redhat.com/security/cve/CVE-2011-3544. That makes this CVE a candidate for an ARMR patch rule — it is the kind of defect ARMR can address, and there is a fix to work from. No rule exists and none is scheduled: writing one means reading the linked change and finding a hook point ARMR can express it at, which may turn out not to exist.
Candidate fix https://access.redhat.com/security/cve/CVE-2011-3544 : a Red Hat CVE page: the weakest tier, pinning no commit, but its existence means Red Hat triaged and shipped the CVE

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 10.0 no band published AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Java SE CPU Oct 2011 ↗ CPU 2011-Q4 Oracle JDK, JRE and JRockit / Java Runtime Environment (JDK and JRE 7, 6 Update 27 and before)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle JDK, JRE and JRockit Java Runtime Environment JDK and JRE 7, 6 Update 27 and before 7

🖥️ Product CPEs & Version Ranges

6 product(s) over 98 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd canonical ubuntu linux generic 10.04 · 10.10 · 11.04 · 11.10
nvd oracle jdk javase 1.6.0 · ＜ 6.0.0.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update10 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update7_b32 · 1.7.0:update9 · 1.7.0:update9_b31 · 1.7.0:update9_b32 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13 · 1.7.0:update15 · 1.7.0:update17 · 1.7.0:update21 · 1.7.0:update25
nvd oracle jre javase 1.6.0 · ＜ 6.0.0.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update3 · 1.6.0:update4 · 1.6.0:update5 · 1.6.0:update6 · 1.6.0:update7 · 1.6.0:update8 · 1.6.0:update9 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update7_b32 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update10_b31 · 1.7.0:update11 · 1.7.0:update13 · 1.7.0:update15 · 1.7.0:update17 · 1.7.0:update17_b31 · 1.7.0:update17_b32 · 1.7.0:update21 · 1.7.0:update21_b31 · 1.7.0:update25 · 1.7.0:update25_b33 · 1.7.0:update25_b34 · 1.7.0:update25_b35
nvd redhat satellite with embedded oracle generic 5.4
nvd suse linux enterprise java generic 10:sp4
nvd suse linux enterprise server generic 10:sp4

References

URLTags
https://access.redhat.com/security/cve/CVE-2011-3544 redhat-cve
https://access.redhat.com/errata/RHSA-2011:1380 ADVISORY, RHSA-2011:1380
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=132750579901589&w=2 Mailing List
http://marc.info/?l=bugtraq&m=134254866602253&w=2 Mailing List
http://marc.info/?l=bugtraq&m=134254957702612&w=2 Mailing List
http://rhn.redhat.com/errata/RHSA-2013-1455.html Third Party Advisory
http://secunia.com/advisories/48308 Broken Link
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory
http://www.ibm.com/developerworks/java/jdk/alerts/ Product

Timeline

Published 2011-10-19 Last modified 2026-06-16
Published2011-10-19By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.