CVE-2017-10281

MEDIUM

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.securityfocus.com/bid/101378

http://www.securitytracker.com/id/1039596

https://access.redhat.com/errata/RHSA-2017:2998

https://access.redhat.com/errata/RHSA-2017:2999

https://access.redhat.com/errata/RHSA-2017:3046

https://access.redhat.com/errata/RHSA-2017:3047

https://access.redhat.com/errata/RHSA-2017:3264

https://access.redhat.com/errata/RHSA-2017:3267

https://access.redhat.com/errata/RHSA-2017:3268

https://access.redhat.com/errata/RHSA-2017:3392

https://access.redhat.com/errata/RHSA-2017:3453

https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html

https://security.gentoo.org/glsa/201710-31

https://security.gentoo.org/glsa/201711-14

https://security.netapp.com/advisory/ntap-20171019-0001/

https://www.debian.org/security/2017/dsa-4015

https://www.debian.org/security/2017/dsa-4048

Details

Source: MITRE

Published: 2017-10-19

Updated: 2020-09-08

Risk Information

CVSS v2.0

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3.0

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Impact Score: 1.4

Exploitability Score: 3.9

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:oracle:jdk:1.6.0:update_161:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.7.0:update151:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.8.0:update144:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.6.0:update_161:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.7.0:update_151:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.8.0:update_144:*:*:*:*:*:*

cpe:2.3:a:oracle:jre:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jrockit:r28.3.15:*:*:*:*:*:*:*

Tenable Plugins

View all (47 total)

IDNameProductFamilySeverity
127362NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0119)NessusNewStart CGSL Local Security Checks
medium
127357NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0116)NessusNewStart CGSL Local Security Checks
medium
127144NewStart CGSL MAIN 5.04 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0003)NessusNewStart CGSL Local Security Checks
medium
700655Oracle Java SE 6 < Update 171 / 7 < Update 161 / 8 < Update 151 / 9 < Update 1 Multiple Vulnerabilities (October 2017 CPU)Nessus Network MonitorWeb Clients
high
120008SUSE SLES12 Security Update : java-1_6_0-ibm (SUSE-SU-2017:3235-1)NessusSuSE Local Security Checks
high
105744SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0061-1)NessusSuSE Local Security Checks
high
105714openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2018-14)NessusSuSE Local Security Checks
high
105538SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2018:0005-1)NessusSuSE Local Security Checks
high
105506SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2017:3455-1)NessusSuSE Local Security Checks
high
105482SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:3440-1)NessusSuSE Local Security Checks
high
105462SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:3411-1)NessusSuSE Local Security Checks
high
105421Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2017-936)NessusAmazon Linux Local Security Checks
medium
105388SUSE SLES11 Security Update : java-1_6_0-ibm (SUSE-SU-2017:3369-1)NessusSuSE Local Security Checks
high
105312EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2017-1331)NessusHuawei Local Security Checks
medium
105311EulerOS 2.0 SP1 : java-1.7.0-openjdk (EulerOS-SA-2017-1330)NessusHuawei Local Security Checks
medium
105267RHEL 6 : Satellite Server (RHSA-2017:3453)NessusRed Hat Local Security Checks
high
105086Virtuozzo 7 : java-1.7.0-openjdk / etc (VZLSA-2017-3392)NessusVirtuozzo Local Security Checks
medium
105071Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/x86_64 (20171206)NessusScientific Linux Local Security Checks
medium
105069RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2017:3392)NessusRed Hat Local Security Checks
medium
105068Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2017-3392)NessusOracle Linux Local Security Checks
medium
105062CentOS 6 / 7 : java-1.7.0-openjdk (CESA-2017:3392)NessusCentOS Local Security Checks
medium
104846Ubuntu 14.04 LTS : openjdk-7 vulnerabilities (USN-3497-1)NessusUbuntu Local Security Checks
medium
104840RHEL 6 / 7 : java-1.7.1-ibm (RHSA-2017:3268)NessusRed Hat Local Security Checks
medium
104839RHEL 6 : java-1.8.0-ibm (RHSA-2017:3267)NessusRed Hat Local Security Checks
medium
104802RHEL 7 : java-1.8.0-ibm (RHSA-2017:3264)NessusRed Hat Local Security Checks
medium
104754Debian DSA-4048-1 : openjdk-7 - security updateNessusDebian Local Security Checks
medium
104746Debian DLA-1187-1 : openjdk-7 security updateNessusDebian Local Security Checks
medium
104695GLSA-201711-14 : IcedTea: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
104582Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2017-2998)NessusVirtuozzo Local Security Checks
medium
104531SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2989-1)NessusSuSE Local Security Checks
high
104527openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2017-1269)NessusSuSE Local Security Checks
high
104477Ubuntu 16.04 LTS / 17.04 / 17.10 : openjdk-8 vulnerabilities (USN-3473-1)NessusUbuntu Local Security Checks
medium
104365Debian DSA-4015-1 : openjdk-8 - security updateNessusDebian Local Security Checks
medium
104280EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2017-1255)NessusHuawei Local Security Checks
medium
104279EulerOS 2.0 SP1 : java-1.8.0-openjdk (EulerOS-SA-2017-1254)NessusHuawei Local Security Checks
medium
104232GLSA-201710-31 : Oracle JDK/JRE: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
104183Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2017-917)NessusAmazon Linux Local Security Checks
medium
104140RHEL 6 / 7 : java-1.6.0-sun (RHSA-2017:3047)NessusRed Hat Local Security Checks
high
104139RHEL 6 / 7 : java-1.7.0-oracle (RHSA-2017:3046)NessusRed Hat Local Security Checks
high
104116RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2017:2999)NessusRed Hat Local Security Checks
high
104093Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x, SL7.x i386/x86_64 (20171020)NessusScientific Linux Local Security Checks
medium
104092RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2017:2998)NessusRed Hat Local Security Checks
medium
104089Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2017-2998)NessusOracle Linux Local Security Checks
medium
104054CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2017:2998)NessusCentOS Local Security Checks
medium
103964Oracle Java SE Multiple Vulnerabilities (October 2017 CPU) (Unix)NessusMisc.
high
103963Oracle Java SE Multiple Vulnerabilities (October 2017 CPU)NessusWindows
high
103932Oracle JRockit R28.3.15 Multiple Vulnerabilities (October 2017 CPU)NessusWindows
medium