CVE-2016-0483

Name	CVE-2016-0483
Description	Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-410-1, DSA-3458-1, DSA-3465-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openjdk-7 (PTS)	jessie, jessie (lts)	7u321-2.6.28-0+deb8u1	fixed
openjdk-8 (PTS)	jessie, jessie (lts)	8u422-b05-1~deb8u1	fixed
	stretch (security)	8u332-ga-1~deb9u1	fixed
	stretch (lts), stretch	8u422-b05-1~deb9u1	fixed
	sid	8u422-b05-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
openjdk-6	source	squeeze	6b38-1.13.10-1~deb6u1	DLA-410-1
openjdk-6	source	wheezy	6b38-1.13.10-1~deb7u1	DSA-3465-1
openjdk-6	source	(unstable)	(unfixed)
openjdk-7	source	wheezy	7u95-2.6.4-1~deb7u1	DSA-3458-1
openjdk-7	source	jessie	7u95-2.6.4-1~deb8u1	DSA-3458-1
openjdk-7	source	(unstable)	7u95-2.6.4-1
openjdk-8	source	(unstable)	8u72-b15-1

https://bugzilla.redhat.com/show_bug.cgi?id=1299441#c2