CVE-2017-10108: Medium severity oracle java se 7 vulnerability
It was discovered that the implementation of the BasicAttribute class in OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted serialized input stream could cause JVM to consume an excessive amount of memory.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10108?
CVE-2017-10108 is rated as a high severity vulnerability.
How do I fix CVE-2017-10108?
To fix CVE-2017-10108, upgrade to the latest version of Java SE, Java SE Embedded, or JRockit that is not affected.
Who is affected by CVE-2017-10108?
Users running Java SE 6u151, 7u141, 8u131, Java SE Embedded 8u131, or JRockit R28.3.14 are affected by CVE-2017-10108.
What type of vulnerability is CVE-2017-10108?
CVE-2017-10108 is a vulnerability related to Java serialization that can be exploited by unauthenticated attackers.
Is there a patch available for CVE-2017-10108?
Yes, Oracle has released patches for CVE-2017-10108 that can be applied by updating affected software versions.