CVE-2011-3544: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-03-03
EPSS: 96.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-10-19 · updated 2026-06-16
Weakness: CWE-284

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Affected products

Canonical Ubuntu Linux: 10.04, 10.10, 11.04, 11.10
Oracle Java SE: before 1.6.0; 1.6.0, 1.6.0-update1, 1.6.0-update10, 1.6.0-update11, 1.6.0-update12, 1.6.0-update13 (+33) — fixed in 1.6.0
Oracle Java SE: before 1.6.0; 1.6.0, 1.6.0-update1, 1.6.0-update11, 1.6.0-update12, 1.6.0-update13, 1.6.0-update14 (+44) — fixed in 1.6.0
RedHat Satellite With Embedded Oracle: 5.4
SUSE Linux Enterprise Java: 10-sp4
SUSE Linux Enterprise Server: 10-sp4

How to fix

Upgrade to a fixed version: Oracle Java SE 1.6.0; Oracle Java SE 1.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2011-3544 or the next vulnerability affects your stack