CVE-2017-10388 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u1...
HighCVSS 7.5
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle jdk | = 1.6.0-update161 | No fix listed |
| oracle jdk | = 1.7.0-update151 | No fix listed |
| oracle jdk | = 1.8.0-update144 | No fix listed |
| oracle jdk | = 1.9.0 | No fix listed |
| oracle jre | = 1.6.0-update161 | No fix listed |
| oracle jre | = 1.7.0-update151 | No fix listed |
| oracle jre | = 1.8.0-update144 | No fix listed |
| oracle jre | = 1.9.0 | No fix listed |
| redhat satellite | = 5.8 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
Show 30 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp active iq unified manager | >= 7.3 | No fix listed |
| netapp active iq unified manager | >= 9.5 | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp e-series santricity management plug-ins | All versions | No fix listed |
| netapp e-series santricity os controller | >= 11.0, <= 11.70.1 | No fix listed |
| netapp e-series santricity storage manager | All versions | No fix listed |
| netapp e-series santricity web services | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand shift | All versions | No fix listed |
| netapp oncommand unified manager | <= 7.1 | No fix listed |
| netapp oncommand unified manager | All versions | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp plug-in for symantec netbackup | All versions | No fix listed |
| netapp snapmanager | All versions | No fix listed |
| netapp steelstore cloud integrated storage | All versions | No fix listed |
| netapp storage replication adapter for clustered data ontap | >= 7.2 | No fix listed |
| netapp vasa provider for clustered data ontap | >= 7.2 | No fix listed |
| netapp vasa provider for clustered data ontap | = 6.0 | No fix listed |
| netapp virtual storage console | >= 7.2 | No fix listed |
| netapp virtual storage console | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| oracle Java | = Java SE: 6u161 | No fix listed |
| oracle Java | = 7u151 | No fix listed |
| oracle Java | = 8u144 | No fix listed |
| oracle Java | = 9; Java SE Embedded: 8u144 | No fix listed |
References
- www.oracle.com patch vendor-advisory
- 101321 broken-link vdb-entry
- 1039596 broken-link vdb-entry
- RHSA-2017:2998 third-party-advisory vendor-advisory
- RHSA-2017:2999 third-party-advisory vendor-advisory
- RHSA-2017:3046 third-party-advisory vendor-advisory
- RHSA-2017:3047 third-party-advisory vendor-advisory
- RHSA-2017:3264 third-party-advisory vendor-advisory
- RHSA-2017:3267 third-party-advisory vendor-advisory
- RHSA-2017:3268 third-party-advisory vendor-advisory
- RHSA-2017:3392 third-party-advisory vendor-advisory
- RHSA-2017:3453 third-party-advisory vendor-advisory
- [debian-lts-announce] 20171123 [SECURITY] [DLA 1187-1] openjdk-7 security update mailing-list third-party-advisory
- GLSA-201710-31 third-party-advisory vendor-advisory
- GLSA-201711-14 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- DSA-4015 third-party-advisory vendor-advisory
- DSA-4048 third-party-advisory vendor-advisory
- www.synology.com third-party-advisory