{"id":"CVE-2016-3552","description":"Unspecified vulnerability in Oracle Java SE 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.","cvssScore":8.1,"cvssVersion":"3.0","cvssVector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssMetrics":[{"version":"3.0","score":8.1,"severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"2.0","score":6.2,"vector":"AV:L/AC:H/Au:N/C:C/I:C/A:C","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"OUT-OF-SCOPE","published":"2016-07-21","lastModified":"2026-06-17","affectedProducts":[{"vendor":"oracle","product":"jdk","version":"1.8.0","update":"update92"},{"vendor":"oracle","product":"jre","version":"1.8.0","update":"update92"}],"totalAffectedProducts":2,"references":[{"url":"https://access.redhat.com/errata/RHSA-2016:1475","source":"redhat","tags":["ADVISORY","RHSA-2016:1475"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3552","source":"redhat","tags":["REPORT","RHSA-2016:1475"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00024.html","source":"secalert_us@oracle.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00033.html","source":"secalert_us@oracle.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00028.html","source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","source":"secalert_us@oracle.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/91787","source":"secalert_us@oracle.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/92000","source":"secalert_us@oracle.com"},{"url":"http://www.securitytracker.com/id/1036365","source":"secalert_us@oracle.com"},{"url":"https://security.gentoo.org/glsa/201610-08","source":"secalert_us@oracle.com"}],"reasoning":{"decidingSource":"oracle-component","decidingReason":"This CVE affects Oracle's Java SE Install component (JDK installer or client deployment tooling).","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"withheld","detail":"Historical environment classification superseded by the dedicated java-se-install component rule"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"matched","status":"OUT-OF-SCOPE","detail":"Description names the unsupported Java SE \"Install\" component","decisive":true}]},"oracleAdvisories":[{"advisory":"Oracle Critical Patch Update July 2016","releaseType":"CPU","quarter":"2016-Q3","url":"https://www.oracle.com/security-alerts/cpujul2016.html","products":[{"product":"Oracle Java SE","component":"Install","affectedVersions":"Java SE: 8u92"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"not-needed","type":"none"},"review":{"state":"automated","basis":"inferred"}},"h2Comments":"## Manual Classification Context\n\n\n**Labels:** INSTALL, SEE NOTE 2\n\n**Products:** ORACLE JDK, JAVA SE, ORACLE JAVA SE","signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.00413,"percentile":0.34789},"ssvc":{"available":true,"exploitation":"none","automatable":"no","technicalImpact":"total"}}