Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

The remote host is affected by the vulnerability described in GLSA-201610-08 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both Oracle&rsquo;s JRE and JDK. Please       review the referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could gain access to information, remotely execute       arbitrary code, or cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The Oracle Java SE installed on the remote host is version 6 prior to Update 113, 7 prior to Update 97, or 8 prior to Update 73 and is affected by an arbitrary code execution vulnerability that may have been exploited when installing Java.  If an attacker convinced a user to download a set of malicious files before Java was installed, then arbitrary code may have been executed during the installation.  A system with the vulnerable versions of Java installed should be checked for malicious software or abnormal behaviors.

The version of Oracle Java SE or Java for Business installed on the remote host is prior to 8 Update 73, 7 Update 97, or 6 Update 113. It is, therefore, affected by an arbitrary code execution vulnerability that may have been exploited when installing Java. If an attacker convinced a user to download a set of malicious files before Java was installed, then arbitrary code may have been executed during the installation. A system with the vulnerable versions of Java installed should be checked for malicious software or abnormal behaviors.

ID	Name	Product	Family	Severity
94085	GLSA-201610-08 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
9353	Oracle Java SE 6 < Update 113 / 7 < Update 97 / 8 < Update 73 Arbitrary Code Execution	Nessus Network Monitor	Web Clients	high
88755	Oracle Java SE Installer on Windows Arbitrary Code Execution	Nessus	Windows	high

Detections

Analytics

CVE-2016-0603

critical

Tenable Plugins

critical

high

high