{"id":"CVE-2011-3544","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.","cvssScore":9.8,"cvssVersion":"3.1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssMetrics":[{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","sourceName":"CISA-ADP","type":"Secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-284"],"resolved":"MITIGATION-CANDIDATE","published":"2011-10-19","lastModified":"2026-06-16","affectedProducts":[{"vendor":"oracle","product":"jdk","versionEnd":"\u003c1.6.0"},{"vendor":"oracle","product":"jdk","version":"1.6.0"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update1"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update10"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update11"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update12"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update13"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update14"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update15"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update16"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update17"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update18"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update19"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update2"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update20"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update21"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update22"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update23"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update24"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update25"}],"totalAffectedProducts":6,"references":[{"url":"https://access.redhat.com/security/cve/CVE-2011-3544","source":"patch-hint","tags":["redhat-cve"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1380","source":"redhat","tags":["ADVISORY","RHSA-2011:1380"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","source":"secalert_us@oracle.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2","source":"secalert_us@oracle.com","tags":["Mailing List"]},{"url":"http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2","source":"secalert_us@oracle.com","tags":["Mailing List"]},{"url":"http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2","source":"secalert_us@oracle.com","tags":["Mailing List"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1455.html","source":"secalert_us@oracle.com","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/48308","source":"secalert_us@oracle.com","tags":["Broken Link"]},{"url":"http://security.gentoo.org/glsa/glsa-201406-32.xml","source":"secalert_us@oracle.com","tags":["Third Party Advisory"]},{"url":"http://www.ibm.com/developerworks/java/jdk/alerts/","source":"secalert_us@oracle.com","tags":["Product"]}],"reasoning":{"decidingSource":"patch-hint","decidingReason":"A reference points at an upstream fix (redhat-cve tier): https://access.redhat.com/security/cve/CVE-2011-3544. That makes this CVE a candidate for an ARMR patch rule — it is the kind of defect ARMR can address, and there is a fix to work from. No rule exists and none is scheduled: writing one means reading the linked change and finding a hook point ARMR can express it at, which may turn out not to exist.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"no-match"},{"rule":"cna-maven-package","stage":"scope","outcome":"no-match"},{"rule":"known-cpe-product","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Matches known products: oracle/jdk, oracle/jre"},{"rule":"patch-hint","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"References include candidate fix URL (redhat-cve tier): https://access.redhat.com/security/cve/CVE-2011-3544 (from RHSA-2011:1380)","decisive":true},{"rule":"open-source-maven","stage":"disposition","outcome":"skipped"},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"no-match"},{"rule":"below-action-threshold","stage":"disposition","outcome":"no-match","detail":"Severity is CRITICAL — only MEDIUM/LOW are deprioritized"},{"rule":"no-exploit-published","stage":"disposition","outcome":"no-match","detail":"A KEV listing, a CISA verdict of active exploitation, or a reviewed exploit catalogue carries this CVE — somebody has published a working exploit, so it stays a candidate"}],"patchHintUrl":"https://access.redhat.com/security/cve/CVE-2011-3544","patchHintTier":"redhat-cve","affectedProducts":[{"vendor":"oracle","product":"jdk","isKnown":true,"cpe":"cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*","source":"yaml"},{"vendor":"oracle","product":"jre","isKnown":true,"cpe":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","source":"yaml"},{"vendor":"canonical","product":"ubuntu_linux","isKnown":false,"cpe":"cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*"},{"vendor":"redhat","product":"satellite_with_embedded_oracle","isKnown":false,"cpe":"cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.4:*:*:*:*:*:*:*"},{"vendor":"suse","product":"linux_enterprise_java","isKnown":false,"cpe":"cpe:2.3:o:suse:linux_enterprise_java:10:sp4:*:*:*:*:*:*"},{"vendor":"suse","product":"linux_enterprise_server","isKnown":false,"cpe":"cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*"}]},"oracleAdvisories":[{"advisory":"Java SE CPU Oct 2011","releaseType":"CPU","quarter":"2011-Q4","url":"https://www.oracle.com/security-alerts/javacpuoct2011.html","products":[{"product":"Oracle JDK, JRE and JRockit","component":"Java Runtime Environment","affectedVersions":"JDK and JRE 7, 6 Update 27 and before"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"unverified","type":"patch-rule"},"review":{"state":"automated","basis":"inferred"}},"exploits":[{"source":"exploit-db","url":"https://www.exploit-db.com/exploits/18171","title":"Java Applet Rhino Script Engine - Remote Code Execution (Metasploit)","date":"2011-11-30"}],"signals":{"hasPOC":true,"pocCount":1,"pocSources":["exploit-db"],"firstPOCDate":"2011-11-30"},"kev":{"inKEV":true,"dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareUse":"Unknown"},"epss":{"available":true,"score":0.96714,"percentile":0.99883},"ssvc":{"available":true,"exploitation":"active","automatable":"yes","technicalImpact":"total"},"patchHintUrl":"https://access.redhat.com/security/cve/CVE-2011-3544","patchHintTier":"redhat-cve"}