Skip to content
OpenAdvisories
Unscored CVE-2017-3526 EUVD-2017-12646GHSA-m3j3-4h27-6j85

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affec…

Published Apr 24, 2017 · Updated Oct 7, 2024 · Assigned by oracle

Vendor: Oracle Product: Java Package: openjdk-7 Package: openjdk-8 Ecosystem: Ubuntu

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

Affected products

VendorProductAffectedFixed
Oracle Java Java SE: 6u141, 7u131, 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 8 openjdk-7 7u131-2.6.9-2~deb8u1 DSA-3858-1
Debian 7 openjdk-7 7u131-2.6.9-2~deb7u1 DLA-954-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS openjdk-8 8u131-b11-0ubuntu1.16.04.2 USN-3275-1
Ubuntu 14.04 LTS openjdk-7 7u131-2.6.9-0ubuntu0.14.04.1 USN-3275-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 java-1.7.0-openjdk +6 1:1.7.0.141-2.6.10.1.el7_3 RHSA-2017:1204
RHEL 7 java-1.8.0-openjdk +15 1:1.8.0.131-2.b11.el7_3 RHSA-2017:1108
RHEL 6 java-1.7.0-openjdk +4 1:1.7.0.141-2.6.10.1.el6_9 RHSA-2017:1204
RHEL 6 java-1.8.0-openjdk +11 1:1.8.0.131-0.b11.el6_9 RHSA-2017:1109
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Extras Oracle Java 7 java-1.6.0-sun +5 1:1.6.0.151-1jpp.1.el7_3 RHSA-2017:1119
Red Hat Rhel Extras Oracle Java 7 java-1.7.0-oracle +5 1:1.7.0.141-1jpp.1.el7_3 RHSA-2017:1118
Red Hat Rhel Extras Oracle Java 7 java-1.8.0-oracle +5 1:1.8.0.131-1jpp.1.el7_3 RHSA-2017:1117
Red Hat Rhel Extras Oracle Java 6 java-1.6.0-sun +5 1:1.6.0.151-1jpp.1.el6 RHSA-2017:1119
Red Hat Rhel Extras Oracle Java 6 java-1.7.0-oracle +5 1:1.7.0.141-1jpp.1.el6 RHSA-2017:1118
Red Hat Rhel Extras Oracle Java 6 java-1.8.0-oracle +5 1:1.8.0.131-1jpp.1.el6 RHSA-2017:1117

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES 12 SP2 java-1_8_0-openjdk 1.8.0.131-26.3 SUSE-SU-2017:1445-1
SLES 12 SP1 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP2 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES for SAP 12 SP2 java-1_8_0-openjdk 1.8.0.131-26.3 SUSE-SU-2017:1445-1
SLES for SAP 12 SP1 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-1_8_0-openjdk 1.8.0.302-2.2 openSUSE-SU-2024:10876-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 java-1.7.0-openjdk +6 1:1.7.0.141-2.6.10.1.0.1.el7_3 ELSA-2017-1204
Oracle Linux 7 java-1.8.0-openjdk +15 1:1.8.0.131-2.b11.el7_3 ELSA-2017-1108

Advisories 15

References