--- title: "CVE-2016-5546\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2016-5546?format=md keywords: index, follow --- # CVE-2016-5546 Publication date 31 December 2016 Last updated 25 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **7.5 · High** [Score breakdown](https://ubuntu.com/security/CVE-2016-5546?format=md#impact-score) Toggle side navigation ## Description Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts). ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | openjdk-6 | 16.10 yakkety | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Fixed 6b41-1.13.13-0ubuntu0.14.04.1 | | 12.04 LTS precise | Fixed 6b41-1.13.13-0ubuntu0.12.04.1 | | openjdk-7 | 16.10 yakkety | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Fixed 7u121-2.6.8-1ubuntu0.14.04.3 | | 12.04 LTS precise | Fixed 7u121-2.6.8-1ubuntu0.12.04.3 | | openjdk-8 | 16.10 yakkety | Fixed 8u121-b13-0ubuntu1.16.10.2 | | 16.04 LTS xenial | Fixed 8u121-b13-0ubuntu1.16.04.2 | | 14.04 LTS trusty | Not in release | | 12.04 LTS precise | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 7.5 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | High | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 7.5 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5546) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-5546) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2016-5546) * [Debian](https://security-tracker.debian.org/tracker/CVE-2016-5546) ### Related Ubuntu Security Notices (USN) + [USN-3198-1](https://usn.ubuntu.com/USN-3198-1) + OpenJDK 6 vulnerabilities + 16 February 2017 + [USN-3179-1](https://usn.ubuntu.com/USN-3179-1) + OpenJDK 8 vulnerabilities + 25 January 2017 + [USN-3194-1](https://usn.ubuntu.com/USN-3194-1) + OpenJDK 7 vulnerabilities + 9 February 2017 ### Other references * * * *