critical
CVE-2016-3587
OpenJDK: insufficient protection of MethodHandle.invokeBasic() (Hotspot, 8154475)
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Red Hat8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Red Hat, Amazon, Oracle. Rated lower by Ubuntu (medium).
Description
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | java-1.8.0-openjdk, java-1.8.0-openjdk-debuginfo, java-1.8.0-openjdk-demo and 4 more | 1:1.8.0.101-3.b13.24.amzn1 |
| Oracle Linux 6 | java-1.8.0-openjdk, java-1.8.0-openjdk-debug, java-1.8.0-openjdk-demo and 9 more | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 7 | java-1.8.0-openjdk, java-1.8.0-openjdk-accessibility, java-1.8.0-openjdk-accessibility-debug and 11 more | 1:1.8.0.101-3.b13.el7_2 |
| chainguard | openjdk-11-openj9, openjdk-17-openj9, openjdk-21-openj9 and 3 more | 0.53.0-r0 and 2 more |
| ubuntu 15.10 | openjdk-8 | 8u91-b14-3ubuntu1~15.10.1 |
| ubuntu 16.04 | openjdk-8 | 8u91-b14-3ubuntu1~16.04.1 |
| ubuntu 16.04-ESM | openjdk-8 | 8u91-b14-3ubuntu1~16.04.1 |
Show all 42 entries from 7 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | java-1.8.0-openjdk | 1:1.8.0.101-3.b13.24.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-debuginfo | 1:1.8.0.101-3.b13.24.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-demo | 1:1.8.0.101-3.b13.24.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-devel | 1:1.8.0.101-3.b13.24.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-headless | 1:1.8.0.101-3.b13.24.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-javadoc | 1:1.8.0.101-3.b13.24.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-src | 1:1.8.0.101-3.b13.24.amzn1 |
| Oracle Linux 6 | java-1.8.0-openjdk | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-debug | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-demo | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-demo-debug | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-devel | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-devel-debug | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-headless | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-headless-debug | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-javadoc | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-javadoc-debug | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-src | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-src-debug | 1:1.8.0.101-3.b13.el6_8 |
| Oracle Linux 7 | java-1.8.0-openjdk | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-accessibility | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-accessibility-debug | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-debug | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-demo | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-demo-debug | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-devel | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-devel-debug | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-headless | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-headless-debug | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-javadoc | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-javadoc-debug | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-src | 1:1.8.0.101-3.b13.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-src-debug | 1:1.8.0.101-3.b13.el7_2 |
| chainguard | openjdk-11-openj9 | 0.53.0-r0 |
| chainguard | openjdk-17-openj9 | 0.53.0-r0 |
| chainguard | openjdk-21-openj9 | 0.53.0-r0 |
| chainguard | openjdk-25-openj9 | 0.59.0-r1 |
| chainguard | openjdk-26-openj9 | 0.59.0-r1 |
| chainguard | openjdk-8-openj9 | 0.53.0-r1 |
| ubuntu 15.10 | openjdk-8 | 8u91-b14-3ubuntu1~15.10.1 |
| ubuntu 16.04 | openjdk-8 | 8u91-b14-3ubuntu1~16.04.1 |
| ubuntu 16.04-ESM | openjdk-8 | 8u91-b14-3ubuntu1~16.04.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00033.html
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00028.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/91787
- http://www.securityfocus.com/bid/91904
All 21 references
- http://www.securitytracker.com/id/1036365
- http://www.ubuntu.com/usn/USN-3043-1
- https://access.redhat.com/errata/RHSA-2016:1458
- https://access.redhat.com/errata/RHSA-2016:1475
- https://access.redhat.com/security/cve/CVE-2016-3587
- https://linux.oracle.com/cve/CVE-2016-3587.html
- https://linux.oracle.com/errata/ELSA-2016-1458.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-3587
- https://security.gentoo.org/glsa/201610-08
- https://security.gentoo.org/glsa/201701-43
- https://security.netapp.com/advisory/ntap-20160721-0001/
- https://ubuntu.com/security/notices/USN-3043-1
- https://www.cve.org/CVERecord?id=CVE-2016-3587