critical
CVE-2016-5582
OpenJDK: incomplete type checks of System.arraycopy arguments (Hotspot, 8160591)
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Red Hat8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Red Hat. Rated lower by Amazon (high), Oracle (high), Ubuntu (medium).
Description
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | java-1.6.0-openjdk, java-1.6.0-openjdk-debuginfo, java-1.6.0-openjdk-demo and 16 more | 1:1.6.0.41-1.13.13.1.77.amzn1 and 2 more |
| chainguard | openjdk-11-openj9, openjdk-17-openj9, openjdk-21-openj9 and 3 more | 0.53.0-r0 and 2 more |
| debian 7 | openjdk-6, openjdk-7 | 7u111-2.6.7-2~deb7u1 |
| debian 8 | openjdk-7 | 7u111-2.6.7-2~deb8u1 |
| Oracle Linux 5 | java-1.6.0-openjdk, java-1.6.0-openjdk-demo, java-1.6.0-openjdk-devel and 7 more | 1:1.6.0.41-1.13.13.1.0.1.el5_11 and 1 more |
| Oracle Linux 6 | java-1.6.0-openjdk, java-1.6.0-openjdk-demo, java-1.6.0-openjdk-devel and 19 more | 1:1.6.0.41-1.13.13.1.el6_8 and 2 more |
| Oracle Linux 7 | java-1.6.0-openjdk, java-1.6.0-openjdk-demo, java-1.6.0-openjdk-devel and 23 more | 1:1.6.0.41-1.13.13.1.el7_3 and 2 more |
| ubuntu 12.04 | openjdk-6, openjdk-7 | 6b40-1.13.12-0ubuntu0.12.04.2 and 1 more |
| ubuntu 14.04 | openjdk-6, openjdk-7 | 6b40-1.13.12-0ubuntu0.14.04.3 and 1 more |
| ubuntu 16.04 | openjdk-8 | 8u111-b14-2ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | openjdk-8 | 8u111-b14-2ubuntu0.16.04.2 |
| ubuntu 16.10 | openjdk-8 | 8u111-b14-2ubuntu0.16.10.2 |
Show all 93 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | java-1.6.0-openjdk | 1:1.6.0.41-1.13.13.1.77.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-debuginfo | 1:1.6.0.41-1.13.13.1.77.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-demo | 1:1.6.0.41-1.13.13.1.77.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-devel | 1:1.6.0.41-1.13.13.1.77.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-javadoc | 1:1.6.0.41-1.13.13.1.77.amzn1 |
| amazon linux 1 | java-1.6.0-openjdk-src | 1:1.6.0.41-1.13.13.1.77.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk | 1:1.7.0.121-2.6.8.1.69.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-debuginfo | 1:1.7.0.121-2.6.8.1.69.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-demo | 1:1.7.0.121-2.6.8.1.69.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-devel | 1:1.7.0.121-2.6.8.1.69.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-javadoc | 1:1.7.0.121-2.6.8.1.69.amzn1 |
| amazon linux 1 | java-1.7.0-openjdk-src | 1:1.7.0.121-2.6.8.1.69.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk | 1:1.8.0.111-1.b15.25.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-debuginfo | 1:1.8.0.111-1.b15.25.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-demo | 1:1.8.0.111-1.b15.25.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-devel | 1:1.8.0.111-1.b15.25.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-headless | 1:1.8.0.111-1.b15.25.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-javadoc | 1:1.8.0.111-1.b15.25.amzn1 |
| amazon linux 1 | java-1.8.0-openjdk-src | 1:1.8.0.111-1.b15.25.amzn1 |
| chainguard | openjdk-11-openj9 | 0.53.0-r0 |
| chainguard | openjdk-17-openj9 | 0.53.0-r0 |
| chainguard | openjdk-21-openj9 | 0.53.0-r0 |
| chainguard | openjdk-25-openj9 | 0.59.0-r1 |
| chainguard | openjdk-26-openj9 | 0.59.0-r1 |
| chainguard | openjdk-8-openj9 | 0.53.0-r1 |
| debian 7 | openjdk-6 | no fix listed |
| debian 7 | openjdk-7 | 7u111-2.6.7-2~deb7u1 |
| debian 8 | openjdk-7 | 7u111-2.6.7-2~deb8u1 |
| Oracle Linux 5 | java-1.6.0-openjdk | 1:1.6.0.41-1.13.13.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.6.0-openjdk-demo | 1:1.6.0.41-1.13.13.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.6.0-openjdk-devel | 1:1.6.0.41-1.13.13.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.6.0-openjdk-javadoc | 1:1.6.0.41-1.13.13.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.6.0-openjdk-src | 1:1.6.0.41-1.13.13.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.7.0-openjdk | 1:1.7.0.121-2.6.8.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.7.0-openjdk-demo | 1:1.7.0.121-2.6.8.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.7.0-openjdk-devel | 1:1.7.0.121-2.6.8.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.7.0-openjdk-javadoc | 1:1.7.0.121-2.6.8.1.0.1.el5_11 |
| Oracle Linux 5 | java-1.7.0-openjdk-src | 1:1.7.0.121-2.6.8.1.0.1.el5_11 |
| Oracle Linux 6 | java-1.6.0-openjdk | 1:1.6.0.41-1.13.13.1.el6_8 |
| Oracle Linux 6 | java-1.6.0-openjdk-demo | 1:1.6.0.41-1.13.13.1.el6_8 |
| Oracle Linux 6 | java-1.6.0-openjdk-devel | 1:1.6.0.41-1.13.13.1.el6_8 |
| Oracle Linux 6 | java-1.6.0-openjdk-javadoc | 1:1.6.0.41-1.13.13.1.el6_8 |
| Oracle Linux 6 | java-1.6.0-openjdk-src | 1:1.6.0.41-1.13.13.1.el6_8 |
| Oracle Linux 6 | java-1.7.0-openjdk | 1:1.7.0.121-2.6.8.1.0.1.el6_8 |
| Oracle Linux 6 | java-1.7.0-openjdk-demo | 1:1.7.0.121-2.6.8.1.0.1.el6_8 |
| Oracle Linux 6 | java-1.7.0-openjdk-devel | 1:1.7.0.121-2.6.8.1.0.1.el6_8 |
| Oracle Linux 6 | java-1.7.0-openjdk-javadoc | 1:1.7.0.121-2.6.8.1.0.1.el6_8 |
| Oracle Linux 6 | java-1.7.0-openjdk-src | 1:1.7.0.121-2.6.8.1.0.1.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-debug | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-demo | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-demo-debug | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-devel | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-devel-debug | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-headless | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-headless-debug | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-javadoc | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-javadoc-debug | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-src | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 6 | java-1.8.0-openjdk-src-debug | 1:1.8.0.111-0.b15.el6_8 |
| Oracle Linux 7 | java-1.6.0-openjdk | 1:1.6.0.41-1.13.13.1.el7_3 |
| Oracle Linux 7 | java-1.6.0-openjdk-demo | 1:1.6.0.41-1.13.13.1.el7_3 |
| Oracle Linux 7 | java-1.6.0-openjdk-devel | 1:1.6.0.41-1.13.13.1.el7_3 |
| Oracle Linux 7 | java-1.6.0-openjdk-javadoc | 1:1.6.0.41-1.13.13.1.el7_3 |
| Oracle Linux 7 | java-1.6.0-openjdk-src | 1:1.6.0.41-1.13.13.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk-accessibility | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk-demo | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk-devel | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk-headless | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk-javadoc | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.7.0-openjdk-src | 1:1.7.0.121-2.6.8.0.0.1.el7_3 |
| Oracle Linux 7 | java-1.8.0-openjdk | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-accessibility | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-accessibility-debug | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-debug | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-demo | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-demo-debug | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-devel | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-devel-debug | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-headless | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-headless-debug | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-javadoc | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-javadoc-debug | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-src | 1:1.8.0.111-1.b15.el7_2 |
| Oracle Linux 7 | java-1.8.0-openjdk-src-debug | 1:1.8.0.111-1.b15.el7_2 |
| ubuntu 12.04 | openjdk-6 | 6b40-1.13.12-0ubuntu0.12.04.2 |
| ubuntu 12.04 | openjdk-7 | 7u121-2.6.8-1ubuntu0.12.04.1 |
| ubuntu 14.04 | openjdk-6 | 6b40-1.13.12-0ubuntu0.14.04.3 |
| ubuntu 14.04 | openjdk-7 | 7u121-2.6.8-1ubuntu0.14.04.1 |
| ubuntu 16.04 | openjdk-8 | 8u111-b14-2ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | openjdk-8 | 8u111-b14-2ubuntu0.16.04.2 |
| ubuntu 16.10 | openjdk-8 | 8u111-b14-2ubuntu0.16.10.2 |
References
- http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/a3ede966ecfe
- http://rhn.redhat.com/errata/RHSA-2016-2079.html
- http://rhn.redhat.com/errata/RHSA-2016-2088.html
- http://rhn.redhat.com/errata/RHSA-2016-2089.html
- http://rhn.redhat.com/errata/RHSA-2016-2090.html
- http://rhn.redhat.com/errata/RHSA-2016-2658.html
- http://rhn.redhat.com/errata/RHSA-2017-0061.html
- http://www.debian.org/security/2016/dsa-3707
All 26 references
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixJAVA
- http://www.securityfocus.com/bid/93623
- http://www.securitytracker.com/id/1037040
- http://www.ubuntu.com/usn/USN-3130-1
- http://www.ubuntu.com/usn/USN-3154-1
- https://access.redhat.com/security/cve/CVE-2016-5582
- https://linux.oracle.com/cve/CVE-2016-5582.html
- https://linux.oracle.com/errata/ELSA-2017-0061.html
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-5582
- https://security.gentoo.org/glsa/201611-04
- https://security.gentoo.org/glsa/201701-43
- https://security.netapp.com/advisory/ntap-20161019-0001/
- https://ubuntu.com/security/notices/USN-3121-1
- https://ubuntu.com/security/notices/USN-3130-1
- https://ubuntu.com/security/notices/USN-3154-1
- https://www.cve.org/CVERecord?id=CVE-2016-5582