Denial of service in Oracle Java SE - CVE-2017-10347

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU8864

Denial of service in Oracle Java SE - CVE-2017-10347

Published: October 18, 2017


Vulnerability identifier: #VU8864
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10347
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Affected software

Oracle Java SE
Gentoo Linux
Amazon Linux AMI
Debian Linux
IBM AIX
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
SUSE OpenStack Cloud
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Ubuntu
Opensuse
IBM Algo Credit Manager
IBM Cognos Controller
Red Hat Satellite
java-1.6.0-sun-devel (Red Hat package)
java-1.6.0-sun-demo (Red Hat package)
java-1.6.0-sun (Red Hat package)
java-1.6.0-sun-src (Red Hat package)
java-1.6.0-sun-plugin (Red Hat package)
java-1.6.0-sun-jdbc (Red Hat package)
java-1.7.0-oracle-src (Red Hat package)
java-1.7.0-oracle (Red Hat package)
java-1.7.0-oracle-devel (Red Hat package)
java-1.7.0-oracle-javafx (Red Hat package)
java-1.7.0-oracle-jdbc (Red Hat package)
java-1.7.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)

How to mitigate CVE-2017-10347

The vulnerability is addressed in the following version: 8u151.

java-1.6.0-sun-devel (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-demo (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-src (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-plugin (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-jdbc (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.7.0-oracle-src (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-devel (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-javafx (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-jdbc (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-plugin (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7

External References

Related Security Bulletins