CVE-2017-10118MEDIUM
Description
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
References
http://www.debian.org/security/2017/dsa-3919
http://www.debian.org/security/2017/dsa-3954
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.securityfocus.com/bid/99782
http://www.securitytracker.com/id/1038931
https://access.redhat.com/errata/RHSA-2017:1790
https://access.redhat.com/errata/RHSA-2017:1791
https://cert.vde.com/en-us/advisories/vde-2017-002
Details
Source: MITRE
Published: 2017-08-08
Updated: 2020-09-08
Type: NVD-CWE-noinfo
Risk Information
CVSS v2.0
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3.0
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:oracle:jdk:1.7.0:update141:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update131:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update_141:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 121719 | Photon OS 1.0: Openjre PHSA-2017-0026 | Nessus | PhotonOS Local Security Checks | high |
| 121718 | Photon OS 1.0: Openjdk PHSA-2017-0026 | Nessus | PhotonOS Local Security Checks | high |
| 111875 | Photon OS 1.0: Openjdk / Openjre / Pycrypto / Python3 PHSA-2017-0026 (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 105714 | openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2018-14) | Nessus | SuSE Local Security Checks | high |
| 105538 | SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2018:0005-1) | Nessus | SuSE Local Security Checks | high |
| 103450 | GLSA-201709-22 : Oracle JDK/JRE, IcedTea: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 102806 | Debian DLA-1073-1 : openjdk-7 security update | Nessus | Debian Local Security Checks | medium |
| 102790 | Debian DSA-3954-1 : openjdk-7 - security update | Nessus | Debian Local Security Checks | medium |
| 102621 | openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2017-954) | Nessus | SuSE Local Security Checks | medium |
| 102584 | Ubuntu 14.04 LTS : openjdk-7 vulnerabilities (USN-3396-1) | Nessus | Ubuntu Local Security Checks | medium |
| 102541 | SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1) | Nessus | SuSE Local Security Checks | medium |
| 102092 | Ubuntu 16.04 LTS / 17.04 : openjdk-8 regression (USN-3366-2) | Nessus | Ubuntu Local Security Checks | medium |
| 102014 | Ubuntu 16.04 LTS / 17.04 : openjdk-8 vulnerabilities (USN-3366-1) | Nessus | Ubuntu Local Security Checks | medium |
| 101984 | Debian DSA-3919-1 : openjdk-8 - security update | Nessus | Debian Local Security Checks | medium |
| 700165 | Oracle Java SE 6 < Update 161 / 7 < Update 151 / 8 < Update 141 Multiple Vulnerabilities | Nessus Network Monitor | Web Clients | critical |
| 101881 | RHEL 6 / 7 : java-1.7.0-oracle (RHSA-2017:1791) | Nessus | Red Hat Local Security Checks | medium |
| 101880 | RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2017:1790) | Nessus | Red Hat Local Security Checks | medium |
| 101844 | Oracle Java SE Multiple Vulnerabilities (July 2017 CPU) (Unix) | Nessus | Misc. | medium |
| 101843 | Oracle Java SE Multiple Vulnerabilities (July 2017 CPU) | Nessus | Windows | medium |
| 101839 | Oracle JRockit R28.3.14 Multiple Vulnerabilities (July 2017 CPU) | Nessus | Windows | medium |