CVE-2017-10053: Medium severity oracle java se 7 vulnerability
It was discovered that the JPEGImageReader implementation in the 2D component of OpenJDK would, in certain cases, read all image data even if that was not used later. A specially crafted image could cause a Java application to temporarily use an excessive amount of CPU and memory.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10053?
CVE-2017-10053 is classified as a high severity vulnerability due to its ease of exploitation and potential impact.
How do I fix CVE-2017-10053?
To fix CVE-2017-10053, you should upgrade to the latest version of Oracle JDK or JRE that is not affected, specifically versions beyond 6u151, 7u141, 8u131.
Which software versions are affected by CVE-2017-10053?
CVE-2017-10053 affects Oracle Java SE versions 6u151, 7u141, 8u131, Oracle Java SE Embedded 8u131, and JRockit R28.3.14.
Can CVE-2017-10053 be exploited remotely?
Yes, CVE-2017-10053 is an easily exploitable vulnerability that allows unauthenticated attackers to exploit it over the network.
What type of vulnerability is CVE-2017-10053?
CVE-2017-10053 is a vulnerability in the Java SE, Java SE Embedded, and JRockit components, specifically affecting the 2D subcomponent.