First published: Mon Jul 17 2017(Updated: )
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Credit: secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
Oracle Java SE 7 | =1.6.0-update151 | |
Oracle Java SE 7 | =1.7.0-update141 | |
Oracle Java SE 7 | =1.8.0-update131 | |
Oracle JRE | =1.6.0-update151 | |
Oracle JRE | =1.7.0-update141 | |
Oracle JRE | =1.8.0-update131 | |
Oracle Java SE | =r28.3.14 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server EUS | =7.3 | |
Red Hat Enterprise Linux Server EUS | =7.4 | |
Red Hat Enterprise Linux Server EUS | =7.5 | |
Red Hat Enterprise Linux Server EUS | =7.6 | |
Red Hat Enterprise Linux Server EUS | =7.7 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.3 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Server | =7.3 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
NetApp Active IQ Unified Manager | >=7.3 | |
NetApp Active IQ Unified Manager for VMware vSphere | >=9.5 | |
NetApp Cloud Backup | ||
NetApp E-Series SANtricity OS Controller | >=11.0<=11.70.1 | |
NetApp SANtricity Storage Manager | ||
NetApp Management Services for Element Software | ||
NetApp OnCommand Balance | ||
NetApp OnCommand Insight | ||
NetApp OnCommand Performance Manager | ||
NetApp OnCommand Shift | ||
NetApp OnCommand Unified Manager for vSphere | <=7.1 | |
NetApp OnCommand Unified Manager for Windows | <=7.1 | |
NetApp OnCommand Unified Manager for 7-Mode | ||
NetApp Plug-in for Symantec NetBackup | ||
NetApp SnapManager for Oracle | ||
NetApp SnapManager for SAP | ||
NetApp SteelStore Cloud Integrated Storage | ||
NetApp Storage Replication Adapter for Clustered Data ONTAP | >=7.2 | |
NetApp Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere | =9.6 | |
NetApp VASA Provider | >=7.2 | |
NetApp VASA Provider | =6.0 | |
NetApp Virtual Storage Console for VMware vSphere | >=7.2 | |
NetApp Virtual Storage Console for VMware vSphere | =6.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2017-10109 is rated as a high severity vulnerability due to its exploitability by unauthenticated attackers.
To mitigate CVE-2017-10109, upgrade affected versions of Oracle Java SE to the latest version available.
CVE-2017-10109 affects Oracle Java SE versions 6u151, 7u141, and 8u131, along with Oracle JRockit version R28.3.14.
CVE-2017-10109 allows unauthenticated attackers to exploit a flaw in the serialization process.
Yes, CVE-2017-10109 is considered easily exploitable, allowing attackers to execute code remotely.