PT-2017-11262 · Oracle+4 · Java Se+5

Published 2017-10-19 · Updated 2024-06-15 · CVE-2017-10274

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Java SE versions 6u161, 7u151, 8u144 and 9

Description A difficult to exploit vulnerability in the Java SE component allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. This can result in unauthorized creation, deletion, or modification access to critical data or all Java SE accessible data, as well as unauthorized access to critical data or complete access to all Java SE accessible data. This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code and rely on the Java sandbox for security.

Recommendations For Java SE version 6u161, update to a version that includes the fix for this vulnerability. For Java SE version 7u151, update to a version that includes the fix for this vulnerability. For Java SE version 8u144, update to a version that includes the fix for this vulnerability. For Java SE version 9, update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting the use of the Smart Card IO subcomponent until a patch is available.

Fix

Related Identifiers

CESA-2017_2998

CESA-2017_3392

CVE-2017-10274

DLA-1187-1

DSA-4015-1

DSA-4048-1

MGASA-2017-0460

OPENSUSE-SU-2017_2998-1

OPENSUSE-SU-2018_0042-1

OPENSUSE-SU-2024:10876-1

RHSA-2017:2998

RHSA-2017:2999

RHSA-2017:3046

RHSA-2017:3047

RHSA-2017:3392

RHSA-2017_2998

RHSA-2017_2999

RHSA-2017_3046

RHSA-2017_3047

RHSA-2017_3392

SUSE-SU-2017:2989-1

SUSE-SU-2018:0005-1

USN-3473-1

USN-3497-1

Affected Products

Centos

Java Platform

Java Se

Red Hat

Suse

Ubuntu

References · 270

• https://osv.dev/vulnerability/SUSE-SU-2018:0005-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-4015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10348 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10274 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3473-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3497-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10355 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10347 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10350 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0460 · Vendor Advisory