Improper access control in Oracle Java SE - CVE-2017-10309

Vulnerability identifier: #VU8868

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-10309

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to access potentially sensitive information and cause DoS condition.

The weakness exists due to a flaw in the Deployment component. A remote attacker can partially read and modify arbitrary files and cause partial denial of service on the target system.

Oracle Java SE
Gentoo Linux
IBM AIX
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
SUSE Linux
Red Hat Satellite
java-1.8.0-oracle (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)

The vulnerability is addressed in the following version: 8u151.

java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7

• Exploit #4748 - Oracle Java SE Web Start jnlp XML External Entity Processing Information Disclosure Vulnerability (October 27, 2020)
• Exploit #1357 - Oracle Java SE - Web Start jnlp XML External Entity Processing Information Disclosure (March 18, 2020)

• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

• Multiple vulnerabilities in Oracle Java SE
• Gentoo update for Oracle JDK/JRE
• Multiple vulnerabilities in IBM AIX
• SUSE Linux update for java-1_8_0-ibm
• Red Hat update for java-1.8.0-ibm
• Red Hat update for java-1.8.0-ibm
• Red Hat update for java-1.8.0-ibm
• Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7 update for java-1.8.0-oracle