Skip to content
OpenAdvisories
Unscored CVE-2017-3511 EUVD-2017-12632GHSA-78hf-xmwm-4cc2

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affect…

Published Apr 24, 2017 · Updated Oct 4, 2024 · Assigned by oracle

Vendor: Oracle Product: Java Package: openjdk-7 Package: openjdk-8 Ecosystem: Ubuntu

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Affected products

VendorProductAffectedFixed
Oracle Java Java SE: 7u131, 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 8 openjdk-7 7u131-2.6.9-2~deb8u1 DSA-3858-1
Debian 7 openjdk-7 7u131-2.6.9-2~deb7u1 DLA-954-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS openjdk-8 8u131-b11-0ubuntu1.16.04.2 USN-3275-1
Ubuntu 14.04 LTS openjdk-7 7u131-2.6.9-0ubuntu0.14.04.1 USN-3275-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 java-1.7.0-openjdk +6 1:1.7.0.141-2.6.10.1.el7_3 RHSA-2017:1204
RHEL 7 java-1.7.1-ibm +5 1:1.7.1.4.5-1jpp.1.el7_3 RHSA-2017:1221
RHEL 7 java-1.8.0-ibm +5 1:1.8.0.4.5-1jpp.1.el7_3 RHSA-2017:1220
RHEL 7 java-1.8.0-openjdk +15 1:1.8.0.131-2.b11.el7_3 RHSA-2017:1108
RHEL 6 java-1.7.0-openjdk +4 1:1.7.0.141-2.6.10.1.el6_9 RHSA-2017:1204
RHEL 6 java-1.7.1-ibm +5 1:1.7.1.4.5-1jpp.2.el6_9 RHSA-2017:1221
RHEL 6 java-1.8.0-ibm +5 1:1.8.0.4.5-1jpp.1.el6_9 RHSA-2017:1220
RHEL 6 java-1.8.0-openjdk +11 1:1.8.0.131-0.b11.el6_9 RHSA-2017:1109
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Extras Oracle Java 7 java-1.7.0-oracle +5 1:1.7.0.141-1jpp.1.el7_3 RHSA-2017:1118
Red Hat Rhel Extras Oracle Java 7 java-1.8.0-oracle +5 1:1.8.0.131-1jpp.1.el7_3 RHSA-2017:1117
Red Hat Rhel Extras Oracle Java 6 java-1.7.0-oracle +5 1:1.7.0.141-1jpp.1.el6 RHSA-2017:1118
Red Hat Rhel Extras Oracle Java 6 java-1.8.0-oracle +5 1:1.8.0.131-1jpp.1.el6 RHSA-2017:1117
Red Hat Network Satellite 5 java-1.8.0-ibm +1 1:1.8.0.5.5-1jpp.1.el6_9 RHSA-2017:3453

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES 12 SP2 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES 12 SP2 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES 12 SP2 java-1_8_0-openjdk 1.8.0.131-26.3 SUSE-SU-2017:1445-1
SLES 12 SP1 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES 12 SP1 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES 12 SP1 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES 12 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES 11 SP4 java-1_7_1-ibm 1.7.1_sr4.5-25.1 SUSE-SU-2017:1387-1
SLES 11 SP3 java-1_7_0-ibm 1.7.0_sr10.5-64.1 SUSE-SU-2017:1384-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP2 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES for SAP 12 SP2 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES for SAP 12 SP2 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES for SAP 12 SP2 java-1_8_0-openjdk 1.8.0.131-26.3 SUSE-SU-2017:1445-1
SLES for SAP 12 SP1 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES for SAP 12 SP1 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES for SAP 12 SP1 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES for SAP 12 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES for SAP 11 SP4 java-1_7_1-ibm 1.7.1_sr4.5-25.1 SUSE-SU-2017:1387-1
SUSE Linux Enterprise Point of Sale 11 SP3 java-1_7_0-ibm 1.7.0_sr10.5-64.1 SUSE-SU-2017:1384-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-1_8_0-openjdk 1.8.0.302-2.2 openSUSE-SU-2024:10876-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 java-1.7.0-openjdk +6 1:1.7.0.141-2.6.10.1.0.1.el7_3 ELSA-2017-1204
Oracle Linux 7 java-1.8.0-openjdk +15 1:1.8.0.131-2.b11.el7_3 ELSA-2017-1108

Advisories 21

References