NVD Vulnerability Detail

CVE-2011-3544

Summary	Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
Summary	Vulnerabilidad no especificada en el componente de Java Runtime Environment en Oracle Java SE JDK y JRE v7 y v6 Update 27 y anteriores permite a aplicaciones remotas Java Web Start y applets Java no confiables afectar a la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con secuencias de comandos.
Publication Date	Oct. 20, 2011, 6:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	April 22, 2026, 10:10 p.m.

CVSS3.1 : CRITICAL
スコア	9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	10.0
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk::::::::				1.6.0
cpe:2.3:a:oracle:jdk:1.6.0:-::::::
cpe:2.3:a:oracle:jdk:1.6.0:update1::::::
cpe:2.3:a:oracle:jdk:1.6.0:update10::::::
cpe:2.3:a:oracle:jdk:1.6.0:update11::::::
cpe:2.3:a:oracle:jdk:1.6.0:update12::::::
cpe:2.3:a:oracle:jdk:1.6.0:update13::::::
cpe:2.3:a:oracle:jdk:1.6.0:update14::::::
cpe:2.3:a:oracle:jdk:1.6.0:update15::::::
cpe:2.3:a:oracle:jdk:1.6.0:update16::::::
cpe:2.3:a:oracle:jdk:1.6.0:update17::::::
cpe:2.3:a:oracle:jdk:1.6.0:update18::::::
cpe:2.3:a:oracle:jdk:1.6.0:update19::::::
cpe:2.3:a:oracle:jdk:1.6.0:update2::::::
cpe:2.3:a:oracle:jdk:1.6.0:update20::::::
cpe:2.3:a:oracle:jdk:1.6.0:update21::::::
cpe:2.3:a:oracle:jdk:1.6.0:update22::::::
cpe:2.3:a:oracle:jdk:1.6.0:update23::::::
cpe:2.3:a:oracle:jdk:1.6.0:update24::::::
cpe:2.3:a:oracle:jdk:1.6.0:update25::::::
cpe:2.3:a:oracle:jdk:1.6.0:update26::::::
cpe:2.3:a:oracle:jdk:1.7.0:-::::::
cpe:2.3:a:oracle:jdk:1.7.0:update1::::::
cpe:2.3:a:oracle:jdk:1.7.0:update10::::::
cpe:2.3:a:oracle:jdk:1.7.0:update11::::::
cpe:2.3:a:oracle:jdk:1.7.0:update13::::::
cpe:2.3:a:oracle:jdk:1.7.0:update15::::::
cpe:2.3:a:oracle:jdk:1.7.0:update17::::::
cpe:2.3:a:oracle:jdk:1.7.0:update2::::::
cpe:2.3:a:oracle:jdk:1.7.0:update21::::::
cpe:2.3:a:oracle:jdk:1.7.0:update25::::::
cpe:2.3:a:oracle:jdk:1.7.0:update3::::::
cpe:2.3:a:oracle:jdk:1.7.0:update4::::::
cpe:2.3:a:oracle:jdk:1.7.0:update5::::::
cpe:2.3:a:oracle:jdk:1.7.0:update6::::::
cpe:2.3:a:oracle:jdk:1.7.0:update7::::::
cpe:2.3:a:oracle:jdk:1.7.0:update7_b32::::::
cpe:2.3:a:oracle:jdk:1.7.0:update9::::::
cpe:2.3:a:oracle:jdk:1.7.0:update9_b31::::::
cpe:2.3:a:oracle:jdk:1.7.0:update9_b32::::::
cpe:2.3:a:oracle:jre::::::::				1.6.0
cpe:2.3:a:oracle:jre:1.6.0:-::::::
cpe:2.3:a:oracle:jre:1.6.0:update1::::::
cpe:2.3:a:oracle:jre:1.6.0:update11::::::
cpe:2.3:a:oracle:jre:1.6.0:update12::::::
cpe:2.3:a:oracle:jre:1.6.0:update13::::::
cpe:2.3:a:oracle:jre:1.6.0:update14::::::
cpe:2.3:a:oracle:jre:1.6.0:update15::::::
cpe:2.3:a:oracle:jre:1.6.0:update16::::::
cpe:2.3:a:oracle:jre:1.6.0:update17::::::
cpe:2.3:a:oracle:jre:1.6.0:update18::::::
cpe:2.3:a:oracle:jre:1.6.0:update19::::::
cpe:2.3:a:oracle:jre:1.6.0:update2::::::
cpe:2.3:a:oracle:jre:1.6.0:update20::::::
cpe:2.3:a:oracle:jre:1.6.0:update21::::::
cpe:2.3:a:oracle:jre:1.6.0:update22::::::
cpe:2.3:a:oracle:jre:1.6.0:update23::::::
cpe:2.3:a:oracle:jre:1.6.0:update24::::::
cpe:2.3:a:oracle:jre:1.6.0:update25::::::
cpe:2.3:a:oracle:jre:1.6.0:update26::::::
cpe:2.3:a:oracle:jre:1.6.0:update3::::::
cpe:2.3:a:oracle:jre:1.6.0:update4::::::
cpe:2.3:a:oracle:jre:1.6.0:update5::::::
cpe:2.3:a:oracle:jre:1.6.0:update6::::::
cpe:2.3:a:oracle:jre:1.6.0:update7::::::
cpe:2.3:a:oracle:jre:1.6.0:update8::::::
cpe:2.3:a:oracle:jre:1.6.0:update9::::::
cpe:2.3:a:oracle:jre:1.7.0:-::::::
cpe:2.3:a:oracle:jre:1.7.0:update1::::::
cpe:2.3:a:oracle:jre:1.7.0:update10::::::
cpe:2.3:a:oracle:jre:1.7.0:update10_b31::::::
cpe:2.3:a:oracle:jre:1.7.0:update11::::::
cpe:2.3:a:oracle:jre:1.7.0:update13::::::
cpe:2.3:a:oracle:jre:1.7.0:update15::::::
cpe:2.3:a:oracle:jre:1.7.0:update17::::::
cpe:2.3:a:oracle:jre:1.7.0:update17_b31::::::
cpe:2.3:a:oracle:jre:1.7.0:update17_b32::::::
cpe:2.3:a:oracle:jre:1.7.0:update2::::::
cpe:2.3:a:oracle:jre:1.7.0:update21::::::
cpe:2.3:a:oracle:jre:1.7.0:update21_b31::::::
cpe:2.3:a:oracle:jre:1.7.0:update25::::::
cpe:2.3:a:oracle:jre:1.7.0:update25_b33::::::
cpe:2.3:a:oracle:jre:1.7.0:update25_b34::::::
cpe:2.3:a:oracle:jre:1.7.0:update25_b35::::::
cpe:2.3:a:oracle:jre:1.7.0:update3::::::
cpe:2.3:a:oracle:jre:1.7.0:update4::::::
cpe:2.3:a:oracle:jre:1.7.0:update5::::::
cpe:2.3:a:oracle:jre:1.7.0:update6::::::
cpe:2.3:a:oracle:jre:1.7.0:update7::::::
cpe:2.3:a:oracle:jre:1.7.0:update7_b32::::::
cpe:2.3:a:oracle:jre:1.7.0:update9::::::
cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*
cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.4:::::::*
cpe:2.3:o:suse:linux_enterprise_java:10:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::-:::*

Related information, measures and tools

No	URL	refsource
1	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html	secalert_us@oracle.com
2	http://marc.info/?l=bugtraq&m=132750579901589&w=2	secalert_us@oracle.com
3	http://marc.info/?l=bugtraq&m=134254866602253&w=2	secalert_us@oracle.com
4	http://marc.info/?l=bugtraq&m=134254957702612&w=2	secalert_us@oracle.com
5	http://rhn.redhat.com/errata/RHSA-2013-1455.html	secalert_us@oracle.com
6	http://secunia.com/advisories/48308	secalert_us@oracle.com
7	http://security.gentoo.org/glsa/glsa-201406-32.xml	secalert_us@oracle.com
8	http://www.ibm.com/developerworks/java/jdk/alerts/	secalert_us@oracle.com
9	http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html	secalert_us@oracle.com
10	http://www.redhat.com/support/errata/RHSA-2011-1384.html	secalert_us@oracle.com
11	http://www.securityfocus.com/bid/50218	secalert_us@oracle.com
12	http://www.securitytracker.com/id?1026215	secalert_us@oracle.com
13	http://www.ubuntu.com/usn/USN-1263-1	secalert_us@oracle.com
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/70849	secalert_us@oracle.com
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13947	secalert_us@oracle.com
16	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html	af854a3a-2127-422b-91ae-364da2661108
17	http://marc.info/?l=bugtraq&m=132750579901589&w=2	af854a3a-2127-422b-91ae-364da2661108
18	http://marc.info/?l=bugtraq&m=134254866602253&w=2	af854a3a-2127-422b-91ae-364da2661108
19	http://marc.info/?l=bugtraq&m=134254957702612&w=2	af854a3a-2127-422b-91ae-364da2661108
20	http://rhn.redhat.com/errata/RHSA-2013-1455.html	af854a3a-2127-422b-91ae-364da2661108
21	http://secunia.com/advisories/48308	af854a3a-2127-422b-91ae-364da2661108
22	http://security.gentoo.org/glsa/glsa-201406-32.xml	af854a3a-2127-422b-91ae-364da2661108
23	http://www.ibm.com/developerworks/java/jdk/alerts/	af854a3a-2127-422b-91ae-364da2661108
24	http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html	af854a3a-2127-422b-91ae-364da2661108
25	http://www.redhat.com/support/errata/RHSA-2011-1384.html	af854a3a-2127-422b-91ae-364da2661108
26	http://www.securityfocus.com/bid/50218	af854a3a-2127-422b-91ae-364da2661108
27	http://www.securitytracker.com/id?1026215	af854a3a-2127-422b-91ae-364da2661108
28	http://www.ubuntu.com/usn/USN-1263-1	af854a3a-2127-422b-91ae-364da2661108
29	https://exchange.xforce.ibmcloud.com/vulnerabilities/70849	af854a3a-2127-422b-91ae-364da2661108
30	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13947	af854a3a-2127-422b-91ae-364da2661108
31	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3544	134c704f-9b21-4f2e-91b3-4a467353bcc0

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-284	不適切なアクセス制御	https://cwe.mitre.org/data/definitions/284.html

JVN Vulnerability Information

Oracle Java SE の Java Runtime Environment (JRE) コンポーネントにおける脆弱性

Title	Oracle Java SE の Java Runtime Environment (JRE) コンポーネントにおける脆弱性
Summary	Oracle Java SE の Java Runtime Environment (JRE) コンポーネントには、Scripting に関する処理に不備があるため、機密性、完全性、可用性に影響のある脆弱性が存在します。
Possible impacts	リモートの信頼できない Java Web Start アプリケーションや Java アプレットにより、情報が漏えいする、あるいは情報を改ざんされたり、サービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 18, 2011, midnight
Registration Date	Oct. 28, 2011, 10:19 a.m.
Last Update	Aug. 11, 2015, 4:16 p.m.

Affected System

サン・マイクロシステムズ

JDK 6 Update 27 およびそれ以前

JDK 7

JRE 6 Update 27 およびそれ以前

JRE 7

レッドハット

Red Hat Enterprise Linux Extras 4 extras

Red Hat Enterprise Linux HPC Node Supplementary 6

Red Hat Enterprise Linux Server Supplementary 6

Red Hat Enterprise Linux Server Supplementary EUS 6.1.z

Red Hat Enterprise Linux Workstation Supplementary 6

RHEL Desktop Supplementary 5 (client)

RHEL Desktop Supplementary 6

RHEL Supplementary 5 (server)

アップル

Apple Mac OS X v10.6.8

Apple Mac OS X v10.7.2

Apple Mac OS X Server v10.6.8

Apple Mac OS X Server v10.7.2

VMware

VMware ESX 3.5

VMware ESX 4.0

VMware ESX 4.1

VMware vCenter 4.0 (Windows)

VMware vCenter 4.1 (Windows)

VMware vCenter 5.0 (Windows)

VMware VirtualCenter 2.5 (Windows)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-3544	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544
National Vulnerability Database (NVD)
2	CVE-2011-3544	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3544

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT5045	http://support.apple.com/kb/HT5045
Oracle Critical Patch Update
2	Oracle Java SE Critical Patch Update Advisory - October 2011	http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
Red Hat Security Advisory
3	RHSA-2011:1384	http://rhn.redhat.com/errata/RHSA-2011-1384.html
4	RHSA-2013:1455	https://rhn.redhat.com/errata/RHSA-2013-1455.html
SECURITY BLOG
5	October 2011 Critical Patch Updates Released	http://blogs.oracle.com/security/entry/october_2011_critical_patch_updates
VMware Security Advisories
6	VMSA-2012-0003	http://www.vmware.com/jp/support/support-resources/advisories/VMSA-2012-0003.html

Change Log

No	Changed Details	Date of change
0	[2011年10月28日] 掲載 [2011年11月17日] 影響を受けるシステム：アップル (HT5045) の情報を追加ベンダ情報：アップル (HT5045) を追加 [2012年12月17日] 影響を受けるシステム：VMware (VMSA-2012-0003) の情報を追加ベンダ情報：VMware (VMSA-2012-0003) を追加 [2015年08月11日] ベンダ情報：レッドハット (RHSA-2013:1455) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk::::::::				1.6.0
cpe:2.3:a:oracle:jdk:1.6.0:-::::::
cpe:2.3:a:oracle:jdk:1.6.0:update1::::::
cpe:2.3:a:oracle:jdk:1.6.0:update10::::::
cpe:2.3:a:oracle:jdk:1.6.0:update11::::::
cpe:2.3:a:oracle:jdk:1.6.0:update12::::::
cpe:2.3:a:oracle:jdk:1.6.0:update13::::::
cpe:2.3:a:oracle:jdk:1.6.0:update14::::::
cpe:2.3:a:oracle:jdk:1.6.0:update15::::::
cpe:2.3:a:oracle:jdk:1.6.0:update16::::::
cpe:2.3:a:oracle:jdk:1.6.0:update17::::::
cpe:2.3:a:oracle:jdk:1.6.0:update18::::::
cpe:2.3:a:oracle:jdk:1.6.0:update19::::::
cpe:2.3:a:oracle:jdk:1.6.0:update2::::::
cpe:2.3:a:oracle:jdk:1.6.0:update20::::::
cpe:2.3:a:oracle:jdk:1.6.0:update21::::::
cpe:2.3:a:oracle:jdk:1.6.0:update22::::::
cpe:2.3:a:oracle:jdk:1.6.0:update23::::::
cpe:2.3:a:oracle:jdk:1.6.0:update24::::::
cpe:2.3:a:oracle:jdk:1.6.0:update25::::::
cpe:2.3:a:oracle:jdk:1.6.0:update26::::::
cpe:2.3:a:oracle:jdk:1.7.0:-::::::
cpe:2.3:a:oracle:jdk:1.7.0:update1::::::
cpe:2.3:a:oracle:jdk:1.7.0:update10::::::
cpe:2.3:a:oracle:jdk:1.7.0:update11::::::
cpe:2.3:a:oracle:jdk:1.7.0:update13::::::
cpe:2.3:a:oracle:jdk:1.7.0:update15::::::
cpe:2.3:a:oracle:jdk:1.7.0:update17::::::
cpe:2.3:a:oracle:jdk:1.7.0:update2::::::
cpe:2.3:a:oracle:jdk:1.7.0:update21::::::
cpe:2.3:a:oracle:jdk:1.7.0:update25::::::
cpe:2.3:a:oracle:jdk:1.7.0:update3::::::
cpe:2.3:a:oracle:jdk:1.7.0:update4::::::
cpe:2.3:a:oracle:jdk:1.7.0:update5::::::
cpe:2.3:a:oracle:jdk:1.7.0:update6::::::
cpe:2.3:a:oracle:jdk:1.7.0:update7::::::
cpe:2.3:a:oracle:jdk:1.7.0:update7_b32::::::
cpe:2.3:a:oracle:jdk:1.7.0:update9::::::
cpe:2.3:a:oracle:jdk:1.7.0:update9_b31::::::
cpe:2.3:a:oracle:jdk:1.7.0:update9_b32::::::
cpe:2.3:a:oracle:jre::::::::				1.6.0
cpe:2.3:a:oracle:jre:1.6.0:-::::::
cpe:2.3:a:oracle:jre:1.6.0:update1::::::
cpe:2.3:a:oracle:jre:1.6.0:update11::::::
cpe:2.3:a:oracle:jre:1.6.0:update12::::::
cpe:2.3:a:oracle:jre:1.6.0:update13::::::
cpe:2.3:a:oracle:jre:1.6.0:update14::::::
cpe:2.3:a:oracle:jre:1.6.0:update15::::::
cpe:2.3:a:oracle:jre:1.6.0:update16::::::
cpe:2.3:a:oracle:jre:1.6.0:update17::::::
cpe:2.3:a:oracle:jre:1.6.0:update18::::::
cpe:2.3:a:oracle:jre:1.6.0:update19::::::
cpe:2.3:a:oracle:jre:1.6.0:update2::::::
cpe:2.3:a:oracle:jre:1.6.0:update20::::::
cpe:2.3:a:oracle:jre:1.6.0:update21::::::
cpe:2.3:a:oracle:jre:1.6.0:update22::::::
cpe:2.3:a:oracle:jre:1.6.0:update23::::::
cpe:2.3:a:oracle:jre:1.6.0:update24::::::
cpe:2.3:a:oracle:jre:1.6.0:update25::::::
cpe:2.3:a:oracle:jre:1.6.0:update26::::::
cpe:2.3:a:oracle:jre:1.6.0:update3::::::
cpe:2.3:a:oracle:jre:1.6.0:update4::::::
cpe:2.3:a:oracle:jre:1.6.0:update5::::::
cpe:2.3:a:oracle:jre:1.6.0:update6::::::
cpe:2.3:a:oracle:jre:1.6.0:update7::::::
cpe:2.3:a:oracle:jre:1.6.0:update8::::::
cpe:2.3:a:oracle:jre:1.6.0:update9::::::
cpe:2.3:a:oracle:jre:1.7.0:-::::::
cpe:2.3:a:oracle:jre:1.7.0:update1::::::
cpe:2.3:a:oracle:jre:1.7.0:update10::::::
cpe:2.3:a:oracle:jre:1.7.0:update10_b31::::::
cpe:2.3:a:oracle:jre:1.7.0:update11::::::
cpe:2.3:a:oracle:jre:1.7.0:update13::::::
cpe:2.3:a:oracle:jre:1.7.0:update15::::::
cpe:2.3:a:oracle:jre:1.7.0:update17::::::
cpe:2.3:a:oracle:jre:1.7.0:update17_b31::::::
cpe:2.3:a:oracle:jre:1.7.0:update17_b32::::::
cpe:2.3:a:oracle:jre:1.7.0:update2::::::
cpe:2.3:a:oracle:jre:1.7.0:update21::::::
cpe:2.3:a:oracle:jre:1.7.0:update21_b31::::::
cpe:2.3:a:oracle:jre:1.7.0:update25::::::
cpe:2.3:a:oracle:jre:1.7.0:update25_b33::::::
cpe:2.3:a:oracle:jre:1.7.0:update25_b34::::::
cpe:2.3:a:oracle:jre:1.7.0:update25_b35::::::
cpe:2.3:a:oracle:jre:1.7.0:update3::::::
cpe:2.3:a:oracle:jre:1.7.0:update4::::::
cpe:2.3:a:oracle:jre:1.7.0:update5::::::
cpe:2.3:a:oracle:jre:1.7.0:update6::::::
cpe:2.3:a:oracle:jre:1.7.0:update7::::::
cpe:2.3:a:oracle:jre:1.7.0:update7_b32::::::
cpe:2.3:a:oracle:jre:1.7.0:update9::::::
cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*
cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.4:::::::*
cpe:2.3:o:suse:linux_enterprise_java:10:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::-:::*