PT-2017-11324 · Oracle+5 · Jrockit+8

Published 2017-10-19 · Updated 2024-06-15 · CVE-2017-10347

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Java SE versions 6u161, 7u151, 8u144 and 9 Java SE Embedded version 8u144

Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit, resulting in a partial denial of service (partial DOS) of Java SE, JRockit. This vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security, such as clients running sandboxed Java Web Start applications or sandboxed Java applets.

Recommendations For Java SE versions 6u161, 7u151, 8u144 and 9, update to a version that contains a fix for this issue. For Java SE Embedded version 8u144, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting the use of the Serialization subcomponent in Java SE, JRockit until a patch is available. Avoid loading and running untrusted code in Java deployments that rely on the Java sandbox for security.

Fix

Related Identifiers

CESA-2017_2998

CESA-2017_3392

CVE-2017-10347

DLA-1187-1

DSA-4015-1

DSA-4048-1

MGASA-2017-0460

OPENSUSE-SU-2017_2998-1

OPENSUSE-SU-2018_0042-1

OPENSUSE-SU-2024:10876-1

RHSA-2017:2998

RHSA-2017:2999

RHSA-2017:3046

RHSA-2017:3047

RHSA-2017:3264

RHSA-2017:3267

RHSA-2017:3268

RHSA-2017:3392

RHSA-2017:3453

RHSA-2017_2998

RHSA-2017_2999

RHSA-2017_3046

RHSA-2017_3047

RHSA-2017_3264

RHSA-2017_3267

RHSA-2017_3268

RHSA-2017_3392

SUSE-SU-2017:2989-1

SUSE-SU-2017:3235-1

SUSE-SU-2017:3369-1

SUSE-SU-2017:3411-1

SUSE-SU-2017:3440-1

SUSE-SU-2017:3455-1

SUSE-SU-2018:0005-1

SUSE-SU-2018:0061-1

USN-3473-1

USN-3497-1

Affected Products

Centos

Ibm Aix

Jrockit

Java Platform

Java Se

Java Se Embedded

Red Hat

Suse

Ubuntu

References · 289

• https://osv.dev/vulnerability/SUSE-SU-2018:0005-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10347 · Vendor Advisory
• https://debian.org/security/2017/dsa-4015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10348 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3497-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10347 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10350 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4048-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-31 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10285 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4015-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10388 · Vendor Advisory