PT-2017-11272 · Oracle+5 · Java Se Embedded+7

Published 2017-10-19 · Updated 2024-06-15 · CVE-2017-10285

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Java SE versions 6u161, 7u151, 8u144 and 9 Java SE Embedded version 8u144

Description A vulnerability in the Java SE and Java SE Embedded components of Oracle Java SE allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE and Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets.

Recommendations For Java SE versions 6u161, 7u151, 8u144 and 9, update to a version that contains a fix for this vulnerability. For Java SE Embedded version 8u144, update to a version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the RMI subcomponent until a patch is available. Avoid loading and running untrusted code in Java deployments that rely on the Java sandbox for security.

Fix

Related Identifiers

CESA-2017_2998

CESA-2017_3392

CVE-2017-10285

DLA-1187-1

DSA-4015-1

DSA-4048-1

MGASA-2017-0460

OPENSUSE-SU-2017_2998-1

OPENSUSE-SU-2018_0042-1

OPENSUSE-SU-2024:10876-1

RHSA-2017:2998

RHSA-2017:2999

RHSA-2017:3046

RHSA-2017:3047

RHSA-2017:3264

RHSA-2017:3267

RHSA-2017:3268

RHSA-2017:3392

RHSA-2017:3453

RHSA-2017_2998

RHSA-2017_2999

RHSA-2017_3046

RHSA-2017_3047

RHSA-2017_3264

RHSA-2017_3267

RHSA-2017_3268

RHSA-2017_3392

SUSE-SU-2017:2989-1

SUSE-SU-2017:3235-1

SUSE-SU-2017:3369-1

SUSE-SU-2017:3411-1

SUSE-SU-2017:3440-1

SUSE-SU-2017:3455-1

SUSE-SU-2018:0005-1

SUSE-SU-2018:0061-1

USN-3473-1

USN-3497-1

Affected Products

Centos

Ibm Aix

Java Platform

Java Se

Java Se Embedded

Red Hat

Suse

Ubuntu

References · 289

• https://osv.dev/vulnerability/SUSE-SU-2018:0005-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-4015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10348 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-10285 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3497-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10347 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10350 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4048-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-31 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10285 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4015-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10388 · Vendor Advisory