Skip to content
OpenAdvisories
Unscored CVE-2017-3539 EUVD-2017-12659GHSA-mmfj-2h5p-6f47

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected a…

Published Apr 24, 2017 · Updated Oct 7, 2024 · Assigned by oracle

Vendor: Oracle Product: Java Package: openjdk-7 Package: openjdk-8 Ecosystem: Ubuntu

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

Affected products

VendorProductAffectedFixed
Oracle Java Java SE: 6u141, 7u131, 8u121; Java SE Embedded: 8u121 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 8 openjdk-7 7u131-2.6.9-2~deb8u1 DSA-3858-1
Debian 7 openjdk-7 7u131-2.6.9-2~deb7u1 DLA-954-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS openjdk-8 8u131-b11-0ubuntu1.16.04.2 USN-3275-1
Ubuntu 14.04 LTS openjdk-7 7u131-2.6.9-0ubuntu0.14.04.1 USN-3275-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 java-1.7.0-openjdk +6 1:1.7.0.141-2.6.10.1.el7_3 RHSA-2017:1204
RHEL 7 java-1.7.1-ibm +5 1:1.7.1.4.5-1jpp.1.el7_3 RHSA-2017:1221
RHEL 7 java-1.8.0-ibm +5 1:1.8.0.4.5-1jpp.1.el7_3 RHSA-2017:1220
RHEL 7 java-1.8.0-openjdk +15 1:1.8.0.131-2.b11.el7_3 RHSA-2017:1108
RHEL 6 java-1.6.0-ibm +6 1:1.6.0.16.45-1jpp.1.el6_9 RHSA-2017:1222
RHEL 6 java-1.7.0-openjdk +4 1:1.7.0.141-2.6.10.1.el6_9 RHSA-2017:1204
RHEL 6 java-1.7.1-ibm +5 1:1.7.1.4.5-1jpp.2.el6_9 RHSA-2017:1221
RHEL 6 java-1.8.0-ibm +5 1:1.8.0.4.5-1jpp.1.el6_9 RHSA-2017:1220
RHEL 6 java-1.8.0-openjdk +11 1:1.8.0.131-0.b11.el6_9 RHSA-2017:1109
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Extras Oracle Java 7 java-1.6.0-sun +5 1:1.6.0.151-1jpp.1.el7_3 RHSA-2017:1119
Red Hat Rhel Extras Oracle Java 7 java-1.7.0-oracle +5 1:1.7.0.141-1jpp.1.el7_3 RHSA-2017:1118
Red Hat Rhel Extras Oracle Java 7 java-1.8.0-oracle +5 1:1.8.0.131-1jpp.1.el7_3 RHSA-2017:1117
Red Hat Rhel Extras Oracle Java 6 java-1.6.0-sun +5 1:1.6.0.151-1jpp.1.el6 RHSA-2017:1119
Red Hat Rhel Extras Oracle Java 6 java-1.7.0-oracle +5 1:1.7.0.141-1jpp.1.el6 RHSA-2017:1118
Red Hat Rhel Extras Oracle Java 6 java-1.8.0-oracle +5 1:1.8.0.131-1jpp.1.el6 RHSA-2017:1117
Red Hat Network Satellite 5 java-1.8.0-ibm +1 1:1.8.0.5.5-1jpp.1.el6_9 RHSA-2017:3453

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES 12 SP2 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES 12 SP2 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES 12 SP2 java-1_8_0-openjdk 1.8.0.131-26.3 SUSE-SU-2017:1445-1
SLES 12 SP1 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES 12 SP1 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES 12 SP1 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES 12 java-1_6_0-ibm 1.6.0_sr16.45-49.1 SUSE-SU-2017:1389-1
SLES 12 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES 11 SP4 java-1_7_1-ibm 1.7.1_sr4.5-25.1 SUSE-SU-2017:1387-1
SLES 11 SP3 java-1_6_0-ibm 1.6.0_sr16.45-84.1 SUSE-SU-2017:1444-1
SLES 11 SP3 java-1_7_0-ibm 1.7.0_sr10.5-64.1 SUSE-SU-2017:1384-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP2 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES for SAP 12 SP2 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES for SAP 12 SP2 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES for SAP 12 SP2 java-1_8_0-openjdk 1.8.0.131-26.3 SUSE-SU-2017:1445-1
SLES for SAP 12 SP1 java-1_7_0-openjdk 1.7.0.141-42.1 SUSE-SU-2017:1400-1
SLES for SAP 12 SP1 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES for SAP 12 SP1 java-1_8_0-ibm 1.8.0_sr4.5-29.1 SUSE-SU-2017:1386-1
SLES for SAP 12 java-1_7_1-ibm 1.7.1_sr4.5-37.1 SUSE-SU-2017:1385-1
SLES for SAP 11 SP4 java-1_7_1-ibm 1.7.1_sr4.5-25.1 SUSE-SU-2017:1387-1
SUSE Linux Enterprise Point of Sale 11 SP3 java-1_6_0-ibm 1.6.0_sr16.45-84.1 SUSE-SU-2017:1444-1
SUSE Linux Enterprise Point of Sale 11 SP3 java-1_7_0-ibm 1.7.0_sr10.5-64.1 SUSE-SU-2017:1384-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-1_8_0-openjdk 1.8.0.302-2.2 openSUSE-SU-2024:10876-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 java-1.7.0-openjdk +6 1:1.7.0.141-2.6.10.1.0.1.el7_3 ELSA-2017-1204
Oracle Linux 7 java-1.8.0-openjdk +15 1:1.8.0.131-2.b11.el7_3 ELSA-2017-1108

Advisories 25

References