Oracle · Java SE JDK and JRE
CVE-2011-3544
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
What it is
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
CISA: An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 24, 2022
- Added to the CISA list
- March 3, 2022
- Published
- October 19, 2011
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 97% in the top 0.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (17)
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://marc.info/?l=bugtraq&m=132750579901589&w=2
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html
- http://rhn.redhat.com/errata/RHSA-2013-1455.html
- http://marc.info/?l=bugtraq&m=132750579901589&w=2
- http://www.redhat.com/support/errata/RHSA-2011-1384.html
- http://marc.info/?l=bugtraq&m=134254957702612&w=2
- http://www.ubuntu.com/usn/USN-1263-1
- http://marc.info/?l=bugtraq&m=134254957702612&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13947
- http://secunia.com/advisories/48308
- http://www.securityfocus.com/bid/50218
- http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/70849
- http://www.securitytracker.com/id?1026215
- http://www.ibm.com/developerworks/java/jdk/alerts/
More exploited flaws from Oracle
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 24, 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critical 10.0 | 73% |
| Jul 15, 2026 | Improper Privilege Management | E-Business Suite | Critical 9.8 | 12% |
| Jun 12, 2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | PeopleSoft Enterprise PeopleTools | Critical 9.8 | 97% |
| Jun 1, 2026 | Unspecified | WebLogic Server | High 7.5 | 74% |
| Nov 21, 2025 | Missing Authentication for Critical Function | Fusion Middleware | Critical 9.8 | 89% |
| Oct 20, 2025 | Server-Side Request Forgery (SSRF) | E-Business Suite | High 7.5 | 96% |
| Oct 6, 2025 | Unspecified | E-Business Suite | Critical 9.8 | 99.7% |
| Feb 24, 2025 | Deserialization | Agile Product Lifecycle Management (PLM) | High 8.8 | 3.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.