CVE-2017-3533
Description
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected products
26cpe:2.3:a:oracle:jdk:1.6.0:update141:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:jdk:1.6.0:update141:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update131:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.8.0:update121:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update141:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:jre:1.6.0:update141:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update_131:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.8.0:update_121:*:*:*:*:*:*
- cpe:2.3:a:oracle:jrockit:r28.3.13:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- Oracle Corporation/Javav5Range: Java SE: 6u141
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
16- www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlnvdPatchVendor Advisory
- www.debian.org/security/2017/dsa-3858nvdThird Party Advisory
- www.securityfocus.com/bid/97740nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1038286nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2017:1108nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1109nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1117nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1118nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1119nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1204nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1220nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1221nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:1222nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:3453nvdThird Party Advisory
- security.gentoo.org/glsa/201705-03nvdThird Party Advisory
- security.gentoo.org/glsa/201707-01nvdThird Party Advisory
News mentions
0No linked articles in our index yet.