PT-2017-11327 · Oracle+5 · Java Se Embedded+7

Published 2017-10-19 · Updated 2024-06-15 · CVE-2017-10350

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Java SE versions 7u151, 8u144 and 9 Java SE Embedded version 8u144

Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE and Java SE Embedded, resulting in a partial denial of service. This vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security. It does not apply to Java deployments that load and run only trusted code, typically in servers.

Recommendations For Java SE versions 7u151, 8u144 and 9, update to a version that contains a fix for this issue. For Java SE Embedded version 8u144, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting the use of untrusted code in Java deployments to minimize the risk of exploitation.

Fix

Related Identifiers

CESA-2017_2998

CESA-2017_3392

CVE-2017-10350

DLA-1187-1

DSA-4015-1

DSA-4048-1

MGASA-2017-0460

OPENSUSE-SU-2017_2998-1

OPENSUSE-SU-2018_0042-1

OPENSUSE-SU-2024:10876-1

RHSA-2017:2998

RHSA-2017:2999

RHSA-2017:3046

RHSA-2017:3264

RHSA-2017:3267

RHSA-2017:3268

RHSA-2017:3392

RHSA-2017:3453

RHSA-2017_2998

RHSA-2017_2999

RHSA-2017_3046

RHSA-2017_3264

RHSA-2017_3267

RHSA-2017_3268

RHSA-2017_3392

SUSE-SU-2017:2989-1

SUSE-SU-2017:3235-1

SUSE-SU-2017:3369-1

SUSE-SU-2017:3411-1

SUSE-SU-2017:3440-1

SUSE-SU-2017:3455-1

SUSE-SU-2018:0005-1

SUSE-SU-2018:0061-1

USN-3473-1

USN-3497-1

Affected Products

Centos

Ibm Aix

Java Platform

Java Se

Java Se Embedded

Red Hat

Suse

Ubuntu

References · 288

• https://osv.dev/vulnerability/SUSE-SU-2018:0005-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-4015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10350 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3497-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10347 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10350 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4048-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-31 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10285 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4015-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10388 · Vendor Advisory