CVE-2017-10053
First published: Mon Jul 17 2017(Updated: )
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle OpenJDK 1.8.0 | =1.6.0-update151 | |
| Oracle OpenJDK 1.8.0 | =1.7.0-update141 | |
| Oracle OpenJDK 1.8.0 | =1.8.0-update131 | |
| Oracle JRE | =1.6.0-update151 | |
| Oracle JRE | =1.7.0-update141 | |
| Oracle JRE | =1.8.0-update131 | |
| Oracle Java SE | =r28.3.14 | |
| Debian | =9.0 | |
| Debian | =10.0 | |
| Red Hat Satellite | =5.8 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =7.3 | |
| Red Hat Enterprise Linux Server EUS | =7.4 | |
| Red Hat Enterprise Linux Server EUS | =7.5 | |
| Red Hat Enterprise Linux Server EUS | =7.6 | |
| Red Hat Enterprise Linux Server EUS | =7.7 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.7 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.7 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| NetApp Active IQ Unified Manager | >=7.3 | |
| NetApp Active IQ Unified Manager for VMware vSphere | >=9.5 | |
| NetApp Cloud Backup | ||
| NetApp E-Series SANtricity OS Controller | >=11.0<=11.70.1 | |
| NetApp E-Series SANtricity Storage Manager | ||
| NetApp Element OS | ||
| NetApp OnCommand Balance | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Performance Manager | ||
| NetApp OnCommand Shift | ||
| NetApp OnCommand Unified Manager for vSphere | <=7.1 | |
| NetApp OnCommand Unified Manager for Windows | <=7.1 | |
| NetApp OnCommand Unified Manager for 7-Mode | ||
| NetApp Plug-in for Symantec NetBackup | ||
| NetApp SnapManager for Oracle | ||
| NetApp SnapManager for SAP | ||
| NetApp SteelStore Cloud Integrated Storage | ||
| NetApp Storage Replication Adapter for Clustered Data ONTAP | >=7.2 | |
| NetApp Storage Replication Adapter | =9.6 | |
| NetApp VASA Provider for Clustered Data ONTAP | >=7.2 | |
| NetApp VASA Provider for Clustered Data ONTAP | =6.0 | |
| NetApp Virtual Storage Console for VMware vSphere | >=7.2 | |
| NetApp Virtual Storage Console for VMware vSphere | =6.0 | |
| NetApp Virtual Storage Console for VMware vSphere | =6.2.2 | |
| Phoenix Contact FL MGuard DM | <=1.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2017/dsa-3919
- http://www.debian.org/security/2017/dsa-3954
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.securityfocus.com/bid/99842
- http://www.securitytracker.com/id/1038931
- https://access.redhat.com/errata/RHSA-2017:1789
- https://access.redhat.com/errata/RHSA-2017:1790
- https://access.redhat.com/errata/RHSA-2017:1791
- https://access.redhat.com/errata/RHSA-2017:1792
- https://access.redhat.com/errata/RHSA-2017:2424
- https://access.redhat.com/errata/RHSA-2017:2469
- https://access.redhat.com/errata/RHSA-2017:2481
- https://access.redhat.com/errata/RHSA-2017:2530
- https://access.redhat.com/errata/RHSA-2017:3453
- https://cert.vde.com/en-us/advisories/vde-2017-002
- https://security.gentoo.org/glsa/201709-22
- https://security.netapp.com/advisory/ntap-20170720-0001/
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/686e47e14565
- https://bugzilla.redhat.com/show_bug.cgi?id=1471889
Frequently Asked Questions
What is the severity of CVE-2017-10053?
CVE-2017-10053 is classified as a high severity vulnerability due to its ease of exploitation and potential impact.
How do I fix CVE-2017-10053?
To fix CVE-2017-10053, you should upgrade to the latest version of Oracle JDK or JRE that is not affected, specifically versions beyond 6u151, 7u141, 8u131.
Which software versions are affected by CVE-2017-10053?
CVE-2017-10053 affects Oracle Java SE versions 6u151, 7u141, 8u131, Oracle Java SE Embedded 8u131, and JRockit R28.3.14.
Can CVE-2017-10053 be exploited remotely?
Yes, CVE-2017-10053 is an easily exploitable vulnerability that allows unauthenticated attackers to exploit it over the network.
What type of vulnerability is CVE-2017-10053?
CVE-2017-10053 is a vulnerability in the Java SE, Java SE Embedded, and JRockit components, specifically affecting the 2D subcomponent.
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10053
- agent/first-publish-date
- agent/references
- agent/severity
- agent/author
- agent/remedy
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle openjdk 1.8.0
- version/oracle openjdk 1.8.0/1.6.0-update151
- version/oracle openjdk 1.8.0/1.7.0-update141
- version/oracle openjdk 1.8.0/1.8.0-update131
- canonical/oracle jre
- version/oracle jre/1.6.0-update151
- version/oracle jre/1.7.0-update141
- version/oracle jre/1.8.0-update131
- canonical/oracle java se
- version/oracle java se/r28.3.14
- vendor/debian
- canonical/debian
- version/debian/9.0
- version/debian/10.0
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.8
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/7.3
- version/red hat enterprise linux server eus/7.4
- version/red hat enterprise linux server eus/7.5
- version/red hat enterprise linux server eus/7.6
- version/red hat enterprise linux server eus/7.7
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.3
- version/red hat enterprise linux server/7.4
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.7
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- vendor/netapp
- canonical/netapp active iq unified manager
- version/netapp active iq unified manager/7.3
- canonical/netapp active iq unified manager for vmware vsphere
- version/netapp active iq unified manager for vmware vsphere/9.5
- canonical/netapp cloud backup
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0
- version/netapp e-series santricity os controller/11.70.1
- canonical/netapp e-series santricity storage manager
- canonical/netapp element os
- canonical/netapp oncommand balance
- canonical/netapp oncommand insight
- canonical/netapp oncommand performance manager
- canonical/netapp oncommand shift
- canonical/netapp oncommand unified manager for vsphere
- version/netapp oncommand unified manager for vsphere/7.1
- canonical/netapp oncommand unified manager for windows
- version/netapp oncommand unified manager for windows/7.1
- canonical/netapp oncommand unified manager for 7-mode
- canonical/netapp plug-in for symantec netbackup
- canonical/netapp snapmanager for oracle
- canonical/netapp snapmanager for sap
- canonical/netapp steelstore cloud integrated storage
- canonical/netapp storage replication adapter for clustered data ontap
- version/netapp storage replication adapter for clustered data ontap/7.2
- canonical/netapp storage replication adapter
- version/netapp storage replication adapter/9.6
- canonical/netapp vasa provider for clustered data ontap
- version/netapp vasa provider for clustered data ontap/7.2
- version/netapp vasa provider for clustered data ontap/6.0
- canonical/netapp virtual storage console for vmware vsphere
- version/netapp virtual storage console for vmware vsphere/7.2
- version/netapp virtual storage console for vmware vsphere/6.0
- version/netapp virtual storage console for vmware vsphere/6.2.2
- vendor/phoenixcontact
- canonical/phoenix contact fl mguard dm
- version/phoenix contact fl mguard dm/1.8.0