PT-2017-11286 · Oracle+4 · Java Se+5

Mr_Me · Published 2017-10-19 · Updated 2022-08-12 · CVE-2017-10309

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Java SE versions 8u144 and 9 Little CMS (affected versions not specified)

Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to Java SE accessible data and a partial denial of service of Java SE. This vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. In the case of Little CMS, a remote attacker could exploit an out-of-bounds read in the Type MLU Read function to cause the application to crash or obtain sensitive information.

Recommendations For Java SE version 8u144, update to a version that is not affected by this issue. For Java SE version 9, update to a version that is not affected by this issue. For Little CMS, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of untrusted images to minimize the risk of exploitation.

Exploit

Related Identifiers

CVE-2017-10309

RHSA-2017:2999

RHSA-2017:3264

RHSA-2017:3267

RHSA-2017:3453

RHSA-2017_2999

RHSA-2017_3264

RHSA-2017_3267

SUSE-SU-2017:3411-1

Affected Products

Ibm Aix

Java Platform

Java Se

Little Cms

Red Hat

Suse

References · 32

• 🔥 https://exploit-db.com/exploits/43103 · Exploit
• https://access.redhat.com/errata/RHSA-2017:3264 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2999 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3453 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10309 · Security Note
• https://security.gentoo.org/glsa/201710-31 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:3411-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10309 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-9841 · Note
• https://suse.com/security/cve/CVE-2017-10293 · Note
• https://suse.com/support/update/announcement/2017/suse-su-20173411-1 · Note
• https://suse.com/security/cve/CVE-2017-10348 · Note
• https://suse.com/security/cve/CVE-2017-10355 · Note